Netlify-cms: Package has both yarn.lock and package-lock.json

[giraffesyo]

This package seems to be mixing use of yarn and npm. With the advent of yarn 1.7.0 we were given the ability to import package-lock.json from npm into yarn.

It's recommended that we choose one package manager and stick to it throughout the project, to prevent confusion. In the contributing.md, yarn is recommended to be installed, but then is never used within the instructions. In the package.json file npm is chosen over yarn within the scripts.

I also think that we should not maintain two lock files.

Are there any thoughts on this?

[erquhart]

I was planning on using Renovate to keep both lock files up to date, but after reading up a bit the consistency issues are best avoided. Choosing to support one or the other is tough, but sounds like we should.

If yarn users have the option of running import locally, that makes package-lock.json an appealing choice, but the extra step for yarn users is an annoying prospect, especially considering that it's currently our primary.

Anyone up for running some comparison tests between the two and posting results here?

[tech4him1]

@erquhart I thought Yarn was pretty much required for Lerna workspaces?

[erquhart]

It sort of is - I could have sworn I had an idea on how to just use the npm lockfile even with that being the case, but can't recall now. Not seeing precedent of checking in package-lock.json in any of the better known Lerna projects.

[tech4him1]

Yarn can import package-lock.json now -- but there are still differences: https://yarnpkg.com/blog/2018/06/04/yarn-import-package-lock/. Some packages will be on different versions after importing. The post ends with:

We highly recommend you to delete the package-lock.json file if you decide to use yarn in order to avoid future confusion and possible consistency issues.

[talves]

Just for clarification: workspaces are Yarn Workspaces and Lerna takes advantage of this structure using yarn.

[tech4him1]

Yup, exactly. It seems like Lerna has it's own code to handle workspaces without Yarn -- it's not as nice, though. See https://github.com/lerna/lerna/pull/899.

[LayersOfAbstraction]

I have a React web app that keeps generating those files on Github repo even though I've deleted them from my local repo and explicitly said to exclude them in my .gitnore file. These two files have over 60 vulnerbilities that I'm getting auto fixes for. Any idea and how I can stop them from being uploaded?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[erquhart]

We should just drop package-lock.json. With our yarn dependency due to workspaces, documentation should be updated to indicate yarn rather than npm.

Regarding vulnerabilities, we should be in much better shape now if you're on the latest version. The bots are here to save us all.