Move from yarn to npm?

[jonahgraham]

The way of the industry has been to move off yarn (at least yarn v1) and to npm. Both vscode and theia did in the last couple of years:

• Investigate moving from yarn back to npm microsoft/vscode#196795
• Migrate away from yarn v1 eclipse-theia/theia#13948

The PR #500 which needed to use npm for part of the flow meant now seems like a good time to start this discussion (again - the project, in its early days, swung back and forth between yarn and npm).

[jreineckearm]

I support that idea of moving back to npm. We went down that route for internal projects. And are about to make the move for an Open-CMSIS-Pack project that started with yarn.

We needed features like this to set up counter measures for supply-chain attacks: https://docs.npmjs.com/cli/v11/using-npm/config#omit-lockfile-registry-resolved We weren't able to easily replicate with yarn.

Main caveat during migration is to ensure we catch dependabot fixes for transient dependencies which may only be present in lock files. And the fact that npm isn't as good in managing multiple versions of a dependencies (IIRC from our last migration). Apart from that, a lot should be straight forward (our migration ticket on Open-CMSIS-Pack.

[cwalther]

I have no opinion on this – I am not deep enough in web development these days to tell what the pros and cons of each are.