Package Managers: npm, yarn, & pnpm

In the JavaScript world, the Package Manager is the heart of your build process. It manages dependencies—the external libraries your project needs to run.

🛠️ The Big Three

While npm is the default, alternatives like yarn and pnpm offer performance and efficiency improvements.

📂 The Anatomy of package.json

This file is your project's command center. It tracks metadata, dependencies, and configuration.

{
  "name": "my-awesome-app",
  "version": "1.0.0",
  "dependencies": {
    "express": "^4.18.2"
  },
  "devDependencies": {
    "nodemon": "^3.0.1"
  }
}

• dependencies: Required for the app to run in production.
• devDependencies: Only used during development (e.g., testing tools, linters).

🛡️ The Importance of Lockfiles

When you run npm install, the package manager creates a search for the best versions. A Lockfile (package-lock.json, pnpm-lock.yaml) freezes these versions.

[!IMPORTANT] Always Commit Your Lockfile! Lockfiles ensure that every developer and your production server have the exact same version of every library. Without it, a library update could break your app without you knowing why.

🔢 Understanding SemVer (Semantic Versioning)

Package managers use SemVer to determine which updates are safe.

[!TIP] Which one to use? Starting out? Stick with npm. Working on large enterprise projects or mono-repos? Use pnpm for massive speed and disk space savings.