Mastering the Art of Node Package Management
Tags: node, npm, yarn, pnpm
Published: 2023-08-10 12:13:17

---
title: Mastering the Art of Node Package Management
published: true
date: 2023-08-08 05:41:55 UTC
tags: node, npm, yarn, pnpm
canonical_url: https://blog.amanpreet.dev/mastering-the-art-of-node-package-management
---
![Package Management](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7sx778gkdt72p3j4oup8.jpg)

## Introduction

Before we deep dive into the world of Node package manager, we need to understand and know what is a package manager.

In simple words, a _package manager_ is a system or set of tools used to automate installing, upgrading, configuring, and using software or applications.

A package manager is not just limited to Node.js, in fact, the OS which we use on a daily basis also uses package managers. E.g.

For MacOS we use the `brew` package manager. Similarly for Ubuntu, we use the `apt-get` package manager, and for Windows, the package manager we use is `Winget` or `Chocolatey`.

## A brief history of Node Package Managers

Node.js comes with a default package manager NPM i.e. Node Package Manager. NPM is the world's largest software registry and hosts more than a million packages that are used by javascript developers daily.

There are other package managers too such as Yarn introduced by Meta, in 2016. Then we have PNPM i.e. Performant Node Package Manager released in 2017.

Together with `npm`, `yarn`, and `pnpm` there were a few more node package managers introduced like `tink` and `ied` but later on, was discontinued.

### All about the package.json file

The `package.json` file is a fundamental part of every Node.js project or application and is used by all package managers including NPM, Yarn, and PNPM. The file serves as the manifest of your project and contains metadata about the project and its dependencies.

Here is an example of what a `package.json` file might look like

```
{
  "name": "my-node-project",
  "version": "1.0.0",
  "description": "A sample Node.js project",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "test": "jest"
  },
  "dependencies": {
    "express": "^4.17.13"
  },
  "devDependencies": {
    "@types/express": "^4.17.13"
  },
  "keywords": [],
  "author": "",
  "license": "ISC"
}

```

Here are some of the common properties you will see in a `package.json` file

- `name`: The name of your project and the application.

- `version`: The current version of the project.

- `description`: A short description of the project.

- `main`: The main entry point of your project. Usually, it is the first file that is executed for the application.

- `scripts`: It is an object which holds all the script commands that are part of the application's lifecycle such as starting the application, building, testing, etc.

- `dependencies`: These are the packages that are required for your application to execute. These are installed using `npm install --save <package_name>` E.g. `express`

- `devDependencies`: Some packages are required for development purposes only. These are installed using `npm i --save-dev <package_name>` for e.g `types@express`

- There are a few more fields in the `package.json` file like `keywords`, `author` and `license` etc.

## NPM (Node Package Manager)

NPM manages all the packages and modules for Node.js and consists of the command line client `npm`. It gets installed into the system with the installation of Node.js. The required packages and modules in the Node.js project are installed, uninstalled, and removed using NPM.

### Key Features

- **Package installation and management** : Easily install, update, and remove packages with simple commands.

- **Dependency resolution** : Automatically resolves and installs package dependencies.

- **npm scripts** : Run predefined scripts to automate tasks, such as building, testing, and deploying your application.

- **Semantic versioning** : Manage package versions using semantic versioning, making it easy to control and update dependencies.

- **Security and auditing** : Scanning projects for vulnerabilities and automatically applying patches with `npm audit`.

### Examples

To install, update or remove a package using NPM, simply run the following commands:

```
# For installing a package
npm install <package_name>

# For updating a package
npm update <package_name>

# To removing a package
npm uninstall <package_name>

# To install all dependencies
npm install

```

## Yarn

If you are looking for fast, reliable, and secure dependency management, `yarn` is the ultimate choice.

### Installation

To install Yarn, we can use `npm` which comes as the default Node.js package manager. Though they are a few alternatives too for installing Yarn. Let's find out them below.

- Using `npm`: Installing `yarn` package globally allows us to use it across different projects via the command line.

- For macOS: we can install it via `Brew` or `curl`. Let us check the commands to be used.

- For Windows: You can install it by executing a .msi file, Link available [here](https://classic.yarnpkg.com/latest.msi), or by using a package manager like _Chocolatey_.

### All about the `yarn.lock` file

The file `yarn.lock` is created or updated whenever dependencies are added. By using a lock file and a deterministic installation algorithm, `Yarn` can ensure that the structure of the `node_modules` directory is the same in every environment, whether it's your local development machine or a production server.

### Key Features

- **Fast & Efficient** : Parallel downloads with offline caching and selective version inclusion makes managing packages efficient

- **Deterministic installs:** yarn lock files ensures consistent dependency installations across different environments

- **Workspaces** : Easily manages multiple packages in a single repository.

- **Improved Security** : Enforces strict SSL & checksums which ensures the integrity of downloaded packages.

- **Compatibility** : Yarn is compatible with the NPM registry, thus allowing access to millions of NPM packages.

### Examples

To install a package using Yarn, run the following command:

```
# To add a new package 
yarn add <package_name>

# To update an already installed package
yarn upgrade <package_name>

# To remove a package
yarn remove <package_name>

# To install all dependencies for a project
yarn install

```

## PNPM (Performant Node Package Manager)

In simple words, PNPM is a fast, disk-space-efficient package manager.

### Installation

- Using `npm`: To install PNPM, we can use npm which comes as the default Node.js package manager.

- `@pnpm/exe` is packaged with Node.js into an executable, so it may be used on a system with no Node.js installed.

- For macOS: we can install it via _Brew_. Let us check the commands to be used. Using the brew package manager:

- For Windows: You can install using a package manager like _Chocolatey_ or _Winget_.

### All about the `pnpm-lock` file

Like other package managers, PNPM also creates a lock file `pnpm-lock.yaml` when you install packages. This file ensures that every install results in the exact same dependency tree, across all environments.

### Key Features

- **Efficient package storage** : Uses a global package store, saving disk space and reducing installation times.

- **Strict Dependency management** : Prevents the accidental use of packages that are not explicitly listed in your project's dependencies.

- **Workspaces** : Supports mono-repos and simplifies dependency management for multi-package projects.

- **Content addressable caches** : Ensures packages are immutable and cacheable, improving performance and security. 

- **Compatibility** : Compatible with the NPM registry, and use most npm-compatible tools.

### Examples

To install, update or delete a package using PNPM, run the following command:

```
# To add a new package 
pnpm add <package_name>

# To update an already installed package
pnpm update <package_name>

# To remove a package
pnpm remove <package_name>

# To install all dependencies for a project
pnpm install

```

## Choosing the right package manager

There's no one-size-fits-all solution when it comes to package managers. The choice depends on your project's requirements and your personal preferences. Here are some guidelines to help you decide:

- If you prioritize compatibility and the support of a vast ecosystem, NPM is a reliable choice.

- If speed, security, and offline capabilities are important to you, consider Yarn.

- If disk space and installation efficiency are your main concerns, PNPM might be the best option.

## Feature Comparison

| Feature | NPM | Yarn | PNPM |
| --- | --- | --- | --- |
| Workspace Support | ✔️ | ✔️ | ✔️ |
| Hoisted `node_modules` | ✔️ (by default) | ✔️ | ✔️ |
| Isolated `node_modules` | ✔️ | ✔️ | ✔️ (by default) |
| Managing node.js versions | ❌ | ❌ | ✔️ |
| Autoinstalling peers | ✔️ | ❌ | ✔️ |
| Lock file | package-lock.json | yarn.lock | pnpm-lock.yaml |
| Patching dependencies | ❌ | ✔️ | ✔️ |
| Dynamic package execution | ✔️ via `npx` | ✔️ via `yarn dlx` | ✔️ via `pnpm dlx` |
| Content addressable storage | ❌ | ❌ | ✔️ |
| Zero-Installs | ❌ | ✔️ | ❌ |
| CLI available | ✔️ | ✔️ | ✔️ |

## Conclusion

Javascript package managers have expanded to offer developers a wide range of choices beyond NPM. While NPM remains the default for many, Yarn and PNPM are also widely used, each bringing its own unique advantages.

Choosing between NPM, Yarn, and PNPM should be based on the specific needs of your project or team.

I hope you have learned something new as I did. If so, kindly like and share the article and also follow me to read more exciting articles.

## References

- [NPM Website](http://npmjs.com)

- [Yarn Website](https://classic.yarnpkg.com/lang/en/)

- [PNPM Website](https://pnpm.io/)