What Is Yarn In Code?

Yarn is an open-source JavaScript package manager that automates the process of installing, updating, configuring, and removing dependencies in a project.

Created by Facebook (now Meta) in 2016, Yarn was initially developed to address shortcomings in speed, security, and consistency with npm, the default Node.js package manager. While still compatible with the npm registry, Yarn introduced significant architectural and feature-based improvements that have made it a cornerstone of modern JavaScript development.

The core purpose of a package manager

To understand Yarn, it's essential to first understand the role of a package manager. In JavaScript, projects often rely on external libraries and modules (known as packages) to perform specific tasks. A package manager is a command-line tool that automates the handling of these dependencies.

1. Dependency resolution: A project's package.json file lists its direct dependencies. The package manager is responsible for recursively figuring out all the dependencies of those dependencies, and so on, creating a full dependency tree.
2. Installation: The package manager fetches all the necessary packages from a central registry (typically the npm registry) and installs them into a node_modules folder in the project.
3. Updating and removal: It provides commands to update packages to new versions or remove unused ones.
4. Consistency: For team development, the package manager ensures that every developer has the exact same versions of all dependencies, preventing "works on my machine" bugs.

Yarn's differentiating features

While npm is a robust package manager, Yarn introduced a number of innovations that differentiated it when it first arrived.

Speed and performance

Yarn was designed for speed from the ground up.

• Parallel installations: Unlike older versions of npm that installed packages one by one, Yarn downloads and installs dependencies simultaneously, significantly reducing installation time.
• Offline caching: Yarn caches every package it downloads. If you install that same package in another project, or reinstall it in the same one, Yarn pulls it from the local cache instead of re-downloading it from the registry. This makes subsequent installations incredibly fast and allows for offline development.

Predictable and deterministic installs

A major source of inconsistency in early npm projects was a lack of deterministic installs. Different installations, even with the same package.json file, could result in different node_modules structures.

• yarn.lock file: Yarn automatically generates a yarn.lock file. This lockfile records the exact version of every single dependency in the tree, along with a cryptographic checksum to ensure its integrity. This guarantees that every install will produce an identical dependency tree across all machines.

Security

Yarn was built with a strong focus on security.

• Checksum verification: The yarn.lock file contains checksums of all installed packages. Before executing any code, Yarn verifies the package integrity against this checksum, ensuring the package hasn't been tampered with.
• Controlled script execution: Yarn provides more control over which lifecycle scripts (e.g., install scripts) are executed during the installation process, protecting against potentially malicious code running automatically.

Workspaces

For projects containing multiple sub-packages in a single repository (known as a monorepo), Yarn's built-in workspaces feature is a major advantage.

• Simplified dependency management: Workspaces allow you to manage dependencies for all sub-packages from the root of the project. A single yarn install command installs all dependencies for all sub-packages in one pass.
• Dependency hoisting: Dependencies common to multiple sub-packages are "hoisted" to the root node_modules directory, which reduces duplication and saves disk space.
• Local linking: Workspaces automatically create symbolic links between inter-dependent sub-packages, so local changes are immediately reflected in dependent packages without needing to publish them to the registry.

Yarn versions: Classic vs. Berry

The Yarn project has evolved over time, resulting in two major versions that have distinct approaches to package management.

Yarn Classic (Yarn 1.x)

• The original Yarn, which primarily focused on improving the performance and reliability of the node_modules and package.json workflow.
• It functions similarly to npm but with the added benefits of speed and lockfile integrity.
• It still installs dependencies into a node_modules directory.

Yarn Berry (Yarn 2+)

• A complete rewrite that introduced a more radical approach to dependency management.
• Plug'n'Play (PnP): Yarn Berry's most significant innovation is Plug'n'Play. This feature eliminates the node_modules folder entirely. Instead, Yarn generates a single .pnp.cjs file that tells Node.js exactly where to find each dependency, resolving them directly from a global cache. This drastically speeds up installations and reduces disk space.
• Zero-installs: By committing the cache files (.yarn/cache) to the repository, a developer can clone the project and immediately start working without running yarn install. All dependencies are already present in the repository, guaranteeing a perfectly reproducible build.
• Plugins and extensibility: Yarn Berry has a flexible plugin-based architecture that allows developers to extend its functionality.

Yarn vs. npm: A modern comparison

When Yarn was first released, its advantages over npm were significant. However, npm has since adopted many of Yarn's best features, including lockfiles (package-lock.json), caching, and parallel installs. In their modern forms, the choice between Yarn and npm often comes down to specific project needs and philosophical preferences.

How to use Yarn

Getting started

1. Install Yarn: You can install Yarn globally using npm: npm install -g yarn. For Yarn Berry, you can install it per project using Corepack, which comes with Node.js.
2. Initialize a project: Navigate to your project directory and run yarn init to create a package.json file.

Basic commands

• Add a package:yarn add <package-name> adds a package and saves it as a dependency.
• Remove a package:yarn remove <package-name> uninstalls a package and removes it from your package.json.
• Install all dependencies:yarn or yarn install installs all dependencies listed in package.json.
• Run scripts:yarn <script-name> executes a script defined in your package.json file. For example, yarn start.

Conclusion

Yarn is a powerful and versatile package manager for JavaScript that has significantly influenced the evolution of dependency management tools. Its core value proposition—speed, reliability, and security—has solidified its place in the JavaScript ecosystem. While Yarn Classic offers a traditional but highly optimized experience, Yarn Berry pushes the boundaries with innovations like Plug'n'Play and Zero-Installs. Ultimately, the right package manager depends on a project's scale, team's preferences, and desired workflow, but Yarn provides a compelling and robust choice for developers at all levels.