Live data from Hacker News

Npm v5.0.0 released

blog.npmjs.org

11–20 of 117 posts

Re: Npm v5.0.0 released

#11
post #9

So happy with the --save by default. Someone at work kept installing new dependencies without save (they didn't knew about it, somehow). We then had an unusable package.json. I had to manually find directories in node_modules and install them on production -_-.

You should implement basic ci with travis et al. That commit should never be able to make it into master. If you are using Github you can force green tests before a pull request is mergeable.

Re: Npm v5.0.0 released

#12

How does this stack up against yarn now?

I built a project to compare yarn and npm. See https://github.com/thomaschaaf/npm-vs-yarn

The different shows how much better npm@5 is :)

It installs two node.js projects (react & ghost) and shows how long it takes to do under multiple scenarios (cold cache, installed and lockfile). It is automatically run each day. It also creates an average if one version is run multiple times.

Re: Npm v5.0.0 released

#13
post #6

Just tried on a couple of projects with a lot of dependencies, we moved to yarn a while ago due to performance issues and it seems to be resolved. On cold cache: Yarn: 20.94 seconds NPM5: 21.11 seconds With cache: Yarn: 10.35 seconds NPM5: 15.20 seconds For some reason, when node_modules folder is still there, yarn exits in a couple hundres milliseconds but npm5 does something for around 5 seconds. Haven't checked lo…

If I recall correctly, npm5 with an existing node_modules folder still goes out to the internet and checks some data whereas yarn does not.

Re: Npm v5.0.0 released

#14
> A new npm cache verify command that will garbage collect your cache, reducing disk usage for things you don’t need (-handwave-), and will do full integrity verification on both the index and the content

Nice.

Re: Npm v5.0.0 released

#15
Someone told they now use hashes for versioning, like Nix, is this true?

Is it finally save to install 2 times and get 100% the same packages?

Re: Npm v5.0.0 released

#16

First of all: Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. Couple questions: Question 1: Does anyone else who's been around more than a couple years share my view that Yarn : NPM :: IO.JS : Node? IOW: healthy competition, catalyst for necessary change, ultimately a bridge or stopgap. Question 2: Any good compreh…

When io.js merged back into node.js the following happened:

1. Node.js was abandoned and replaced with io.js.

2. Io.js was relabelled as node.js.

3. The node.js project was put under open governance via the creation of the Node Foundation.

This doesn't really compare to npm:

* The npm-cli's name is using npm Inc's trademark: giving it away would leave the company with no name or create unwanted ambiguity between npm Inc the company and npm-cli the (then) community-owned open source project unaffiliated with the company.

* Yarn does not share any source code directly with npm-cli, it's a complete reimplementation of a similar feature set. It's currently backed by a mirror of the npm registry but that's the extent of the overlap.

* The Node Foundation already exists and Yarn is already owned by the community. I could see Yarn joining the Node Foundation and the Node Foundation replacing its bundled dependency on the commercially owned npm-cli but even then npm Inc has nothing to contribute to the process.

Personally I would much rather see Yarn join the JavaScript Foundation because it speaks to the broader appeal of Yarn outside the traditional "Node community" and the politics involved in the latter and its close ties to npm Inc.

FWIW I consider the close ties between the Node project and npm Inc nothing more than a historical accident that has resulted in a conflict of interest that is overdue to be resolved by dropping npm-cli from the official releases.

Now that yarn is no longer distributed using npm (although it's still possible to install it that way) that seems more realistic than ever.

Re: Npm v5.0.0 released

#17

Seems like their catching up to Yarn, and finally they are there. I'm happy to ditch Yarn and go back to NPM once it's as good.

Why go back if you already migrated?

- Global dependencies do not work on Yarn if you install node with brew.

- NPM comes pre-installed with Node.

Re: Npm v5.0.0 released

#19
post #16

First of all: Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. Couple questions: Question 1: Does anyone else who's been around more than a couple years share my view that Yarn : NPM :: IO.JS : Node? IOW: healthy competition, catalyst for necessary change, ultimately a bridge or stopgap. Question 2: Any good compreh…

When io.js merged back into node.js the following happened: 1. Node.js was abandoned and replaced with io.js. 2. Io.js was relabelled as node.js. 3. The node.js project was put under open governance via the creation of the Node Foundation. This doesn't really compare to npm: * The npm-cli's name is using npm Inc's trademark: giving it away would leave the company with no name or create unwanted ambiguity between npm…

They probably need to do something like docker did.

Re: Npm v5.0.0 released

#20
post #16

First of all: Thank you, yarn, for helping the community see the naked emperor. Deterministic builds by default are such an obvious (in retrospect) core requirement. Couple questions: Question 1: Does anyone else who's been around more than a couple years share my view that Yarn : NPM :: IO.JS : Node? IOW: healthy competition, catalyst for necessary change, ultimately a bridge or stopgap. Question 2: Any good compreh…

When io.js merged back into node.js the following happened: 1. Node.js was abandoned and replaced with io.js. 2. Io.js was relabelled as node.js. 3. The node.js project was put under open governance via the creation of the Node Foundation. This doesn't really compare to npm: * The npm-cli's name is using npm Inc's trademark: giving it away would leave the company with no name or create unwanted ambiguity between npm…

>resolved by dropping npm-cli from the official releases.

But that would break 7 years of documentation and tutorials, likely bad for newcomers and thus the ecosystem

Post reply on HN