npm has eroded so much of my trust that I am hesitant to switch back to it (from yarn) any time soon. I've tried npm out every few months (since npm 3), and ha

npm has eroded so much of my trust that I am hesitant to switch back to it (from yarn) any time soon. I've tried npm out every few months (since npm 3), and have consistently run into infuriating bugs or unexpected behaviors. Much of it has been fixed over time, but the frequency and duration of these issues is concerning—and, I think, points to architectural deficiencies being the root of the problem. For example: * npm 5.0.0—5.7.0 didn't play nice with git-based dependencies (https://github.com/npm/npm/issues/17379 https://github.com/npm/npm/issues/17379) * npm 5.0.0—5.4.1 edits package-lock.json unexpectedly (https://github.com/npm/npm/issues/17979 https://github.com/npm/npm/issues/17979) * npm 5.0.0—5.4.? doesn't honor incompatible version differences in package.json compared to package-lock.json (https://github.com/npm/npm/issues/16866 https://github.com/npm/npm/issues/16866) * Take a look at the issues labeled as [big-bug], and how long they've languished: https://github.com/npm/npm/issues?q=is%3Aissue+is%3Aopen+sort%3Acomments-desc+label%3Abig-bug https://github.com/npm/npm/issues?q=is%3Aissue+is%3Aopen+sor... * and a bunch of others I can't remember off the top of my head; especially nondeterministic behavior in the v2 and v3 era. --- Btw, I'm not trying to tear down npm contributors here; people have put in a monumental amount of work into the project, and the node ecosystem wouldn't be where it is without npm.