Does registry.yarnpkg.com always just proxy to the npm registry, or is it caching results and serving directly as well.
Yarn – A new package manager for JavaScript
251–260 of 486 posts
Re: Yarn – A new package manager for JavaScript
#252Earlier quoted context omitted.
> Why bother with semantic versioning if everybody is expected to manually > check and pin their dependencies anyway? I think this is the disconnect here: the lockfile does protect me from updates, but ranges are still useful: they allow a tool to help me upgrade my dependencies. With the lockfile-based approach, you usually _don't_ pin to specific versions: with Cargo, we even defaulted to the ^ operator, so 'foo =…
> That is, ranges allow you to use semver as a tool. I understand that, but you're looking at it from a technical perspective, while it's partially a psychological issue - namely, the question of how you drive certain desirable behaviour. When you make upgrades explicit, rather than automatically installing newer versions, you reduce the deployment of (security) bugfixes, because many people simply will not run `upgr…
Thanks for elaborating. I think we fundamentally disagree, but I understand your perspective a lot better now.
Re: Yarn – A new package manager for JavaScript
#253Earlier quoted context omitted.
Explain why duplication is mandatory?
Just imagine two packages you depend on (a and b) that both have a shared dependency (x). Both start off depending on x version 1.0 but then later a is updated to 2.0 while b isn't. Now you have two packages depending on different versions of the same package and hence the need for duplication. You have a that needs x@2.0 and b that needs x@1.0, so both copies are kept.
Don't upgrade a when it wants a half-baked x. Choose versions of a and b that agree on a known-good version of x. If there aren't any, it's not sane to use a and b together unless x is written very carefully to accommodate data from past and future versions of itself.
Re: Yarn – A new package manager for JavaScript
#254Earlier quoted context omitted.
Yarn isn't a replacement for npm itself. It's a client that can read/write to npm, and other registries such as Bower.
npm = node package manager = CLI tool which Yarn replaces. npmjs.com = package repo which Yarn can use. at least as far as I can tell
I'm almost sure complain was about npm as a tool, not about repo :)
Re: Yarn – A new package manager for JavaScript
#255Earlier quoted context omitted.
they have millions of installs and can't break them?
Well, but remember that time they shipped an SSL cert that broke all updated clients? I'm not sure they move slowly because they don't want to break things, because that would have been a pretty easy bug to catch... http://blog.npmjs.org/post/78165272245/more-help-with-selfsi...
That's not really a good counter example. It's more of a mistake on a release...
Re: Yarn – A new package manager for JavaScript
#256Earlier quoted context omitted.
Lots of ways you can install Yarn over here: https://yarnpkg.com/en/docs/install
Just a heads up: someone tried to comment out the Windows choco instructions with HTML comments but the angle brackets were escaped so the instructions are still there (with the escaped brackets).
Oops, that's my fault. It looked fine in the Github editor's preview when I commented it out, so I assumed it'd actually work properly.
Chocolatey is coming soon, once they approve the package.
Re: Yarn – A new package manager for JavaScript
#257The acronym means "Yes: another repo's name!".
Re: Yarn – A new package manager for JavaScript
#258Earlier quoted context omitted.
The whole version range stuff got me many times. I went to use fixed versions on my own package.json files, but the deps of my deps could still be dynamic, which is even worse, since they sit deeper in my dependency graph AND there are more indirect deps than direct deps. (~50 direct, >200 indirect) Also, npm isn't deterministic and it got even worse with v3. Sometimes you get a flat list of libs, if a lib is used wi…
The fun of kicking off a CI build after the weekend with no commits and see stuff randomly break because some dependency of a dependency got updated and broke things in a minor version is something I've only experienced in JS - beautiful.
In fairness to the language and tools, this seems to be more of a cultural problem than anything.
You can do the same kind of version range tricks in typical Java builds, for example (Maven), but most people hardcode the values to keep builds as deterministic as possible.
For some reason, the JS community seems to prefer just trusting that new versions won't break anything. Its either very brave of them really (or maybe just foolish).
Re: Yarn – A new package manager for JavaScript
#259Does registry.yarnpkg.com always just proxy to the npm registry, or is it caching results and serving directly as well.
Elsewhere in the thread, the devs have said its just a CNAME.
Re: Yarn – A new package manager for JavaScript
#260 yarn global add typescript
yarn link typescript
error No registered module found called "typescript".
info Visit http://yarnpkg.com/en/docs/cli/link for documentation about this command.
edit: also,
$ yarn add typescript
yarn add v0.15.1
[1/4] Resolving packages...
[2/4] Fetching packages...
[3/4] Linking dependencies...
error ENOENT: no such file or directory, open 'C:\Users\******REDACTED******\@types\react\index.d.ts' at Error (native)
info Visit http://yarnpkg.com/en/docs/cli/add for documentation about this command.