7 ms·

I'm definitely curious to see if the update to npm 5.5.1 resolves most of the issues people have seen on the 5.x releases. Otherwise having an LTS release with

I'm definitely curious to see if the update to npm 5.5.1 resolves most of the issues people have seen on the 5.x releases. Otherwise having an LTS release with a rough release of npm might be pretty painful for a lot of the ecosystem.

abritinthebay 9y ago
I’ve seen zero issue with npm locally or in production (have more issues with Webpack tbh) What kind of problems?
- dikaiosune 9y ago
  There are a bunch of linked issues at https://github.com/nodejs/node/issues/13815 https://github.com/nodejs/node/issues/13815 and https://github.com/npm/npm/issues/16991 https://github.com/npm/npm/issues/16991, such as https://github.com/facebookincubator/create-react-app/issues/2558 https://github.com/facebookincubator/create-react-app/issues....
- 0x0 9y ago
  I've had major trouble with the fact that the new package-lock.json doesn't sufficiently lock versions. In one working copy you can run "nom install" and everything works with no files or package-lock being changed. Yet, in another clean checkout, "npm install" brings in a different set of dependency versions despite having a -lock file, and things start to break. Yarn's yarn.lock seems to get this right.
  - tuananh 9y ago
    any chance that you did `npm install --production` maybe? i think the lock file might be different for that case.
saas_co_de 9y ago
yarn has resolved most of the issues already :)
- abritinthebay 9y ago
  In my experience that’s simply not true. We’ve seen more issues with Yarn in CI & prod than with npm 5.x Both are great projects but npm is significantly more mature.
  - rawrmaan 9y ago
    Agreed. I tried to switch to yarn a couple times now and it simply wasn't reliable (though the last attempt was a few months ago)
  - jhgaylor 9y ago
    We finally got NPM out of the loop for production deploys and it's been glorious. We ship down a tarball of the repo after an npm install and include a node interpreter.
    - abritinthebay 9y ago
      Ah well, that’s a whole different kind of system. Similar to doing a docker image ship. Still have to do the install on a deploy server.
    - tuananh 9y ago
      seems like a perfect use case for Docker.
      - jhgaylor 9y ago
        I whole heartedly agree. Would you tell that to my boss? :D
  - mtphil 9y ago
    Just out of curiosity, having never encountered any issues myself - what sort of issues have you run into with Yarn in CI/prod ?
    - abritinthebay 9y ago
mindcrash 9y ago
Yarn [0] might be a great alternative for those who have been bitten in the proverbial ass by npm a bit too many times. [0] https://yarnpkg.com/lang/en/ https://yarnpkg.com/lang/en/
- dikaiosune 9y ago
  I've recommended yarn for projects of mine that were broken by npm5, but it has some of its own issues. It's also not bundled by default which is really important for JavaScript tools that are used by beginners.
  - TAForObvReasons 9y ago
    Our deployment setups explicitly roll back to npm 4. every version of npm5 has had problems with some step (currently fighting issues with react-native), including the latest 5.5.1 :(
- alvis 9y ago
  Another option is pnpm(https://pnpm.js.org https://pnpm.js.org), a lesser known but much faster alternative.
vacri 9y ago
How are we nearly a decade into the life of NodeJS and still suffering from problems with its package manager, which itself is up to version 5.x?
- TheCoreh 9y ago
  Because npm 5 was a pretty big update that fundamentally changed how a lot of npm portions work, in order to close the gap between it and Yarn, a competing package manager. The 5.0 release was super rushed IMO (I personally hit several bugs), but if you stuck to node LTS you skipped over most of the v5 breakage (now it works 99.99% of the time again, and when it doesn't work deleting node_modules usually does the trick)
  - nailer 9y ago
    npm v5 is still deleting private packages - the issue has been open, accepted and replicable since npm v5 was released - see https://github.com/npm/npm/issues/17929 https://github.com/npm/npm/issues/17929 nad various related issued linked from that page. This sucks if you use a monorepo. yarn workspaces works a treat though.
- pcsanwald 9y ago
  package management is a harder problem than most people seem to want to admit. I've run into tons of issues with every package management system you can think of: rpm does some extremely dodgy caching stuff at times, navigating maven dependency trees to identify the offending version of slf4j that is harshing the vibe, etc. I can't think of a single package management system that works well and people seem to love.
  - nfriedly 9y ago
    Cargo?
  - ojanik 9y ago
    Nuget. Can't remember last time i had issues.

abritinthebay 9y ago

I’ve seen zero issue with npm locally or in production (have more issues with Webpack tbh) What kind of problems?

dikaiosune 9y ago
There are a bunch of linked issues at https://github.com/nodejs/node/issues/13815 https://github.com/nodejs/node/issues/13815 and https://github.com/npm/npm/issues/16991 https://github.com/npm/npm/issues/16991, such as https://github.com/facebookincubator/create-react-app/issues/2558 https://github.com/facebookincubator/create-react-app/issues....
0x0 9y ago
I've had major trouble with the fact that the new package-lock.json doesn't sufficiently lock versions. In one working copy you can run "nom install" and everything works with no files or package-lock being changed. Yet, in another clean checkout, "npm install" brings in a different set of dependency versions despite having a -lock file, and things start to break. Yarn's yarn.lock seems to get this right.
- tuananh 9y ago
  any chance that you did `npm install --production` maybe? i think the lock file might be different for that case.

saas_co_de 9y ago

yarn has resolved most of the issues already :)

abritinthebay 9y ago
In my experience that’s simply not true. We’ve seen more issues with Yarn in CI & prod than with npm 5.x Both are great projects but npm is significantly more mature.
- rawrmaan 9y ago
  Agreed. I tried to switch to yarn a couple times now and it simply wasn't reliable (though the last attempt was a few months ago)
- jhgaylor 9y ago
  We finally got NPM out of the loop for production deploys and it's been glorious. We ship down a tarball of the repo after an npm install and include a node interpreter.
  - abritinthebay 9y ago
    Ah well, that’s a whole different kind of system. Similar to doing a docker image ship. Still have to do the install on a deploy server.
  - tuananh 9y ago
    seems like a perfect use case for Docker.
    - jhgaylor 9y ago
      I whole heartedly agree. Would you tell that to my boss? :D
- mtphil 9y ago
  Just out of curiosity, having never encountered any issues myself - what sort of issues have you run into with Yarn in CI/prod ?
  - abritinthebay 9y ago

mindcrash 9y ago

Yarn [0] might be a great alternative for those who have been bitten in the proverbial ass by npm a bit too many times. [0] https://yarnpkg.com/lang/en/ https://yarnpkg.com/lang/en/

dikaiosune 9y ago
I've recommended yarn for projects of mine that were broken by npm5, but it has some of its own issues. It's also not bundled by default which is really important for JavaScript tools that are used by beginners.
- TAForObvReasons 9y ago
  Our deployment setups explicitly roll back to npm 4. every version of npm5 has had problems with some step (currently fighting issues with react-native), including the latest 5.5.1 :(
alvis 9y ago
Another option is pnpm(https://pnpm.js.org https://pnpm.js.org), a lesser known but much faster alternative.

vacri 9y ago

How are we nearly a decade into the life of NodeJS and still suffering from problems with its package manager, which itself is up to version 5.x?

TheCoreh 9y ago
Because npm 5 was a pretty big update that fundamentally changed how a lot of npm portions work, in order to close the gap between it and Yarn, a competing package manager. The 5.0 release was super rushed IMO (I personally hit several bugs), but if you stuck to node LTS you skipped over most of the v5 breakage (now it works 99.99% of the time again, and when it doesn't work deleting node_modules usually does the trick)
- nailer 9y ago
  npm v5 is still deleting private packages - the issue has been open, accepted and replicable since npm v5 was released - see https://github.com/npm/npm/issues/17929 https://github.com/npm/npm/issues/17929 nad various related issued linked from that page. This sucks if you use a monorepo. yarn workspaces works a treat though.
pcsanwald 9y ago
package management is a harder problem than most people seem to want to admit. I've run into tons of issues with every package management system you can think of: rpm does some extremely dodgy caching stuff at times, navigating maven dependency trees to identify the offending version of slf4j that is harshing the vibe, etc. I can't think of a single package management system that works well and people seem to love.
- nfriedly 9y ago
  Cargo?
- ojanik 9y ago
  Nuget. Can't remember last time i had issues.