由于npm v7官方 docs （强调我的）：
此命令安装一个软件包及其依赖的任何软件包。如果软件包具有软件包锁，或NPM缩小包装文件或 YARN锁定文件，则依赖关系的安装将由该
驱动
我试图找到有关 npm安装的更多信息。 用 yarn.lock 出现的行为，但没有发现太多。 此博客文章指出：
使用新的软件包 - 洛克.json文件，我们将解锁执行确定性重复可再现的构建的能力。现在，它应该包括NPM安装所需软件包所需的一切。 NPM忽略了NPM 7 Yarn.lock ，但事实并非如此。现在可以使用它来与包装树保持最新。
github blog ：
在先前的版本中，忽略了YARN.LOCK文件，NPM CLI现在可以使用Yarn.lock作为软件包元数据的来源和分辨率指南。如果存在 Yarn.lock 文件，则NPM也将与包装树的内容保持最新状态。
但是，他们俩都没有清楚地了解我在使用 npm安装的情况下实际发生的情况。
我想掌握它：
- 我可以在本地运行
YARN 生成 Yarn.lock 并使用 npm install ？
- 当我使用
npm安装使用 yarn.lock 时，该怎么办？它会更新吗？可以使用（一种） - 冻结 - 洛克菲尔运行吗？ npm ci 命令不提及 Yarn.lock 。
- 它是否支持
V1 和 Berry ？
Since NPM v7 the official docs state the following about npm install (emphasis mine):
This command installs a package and any packages that it depends on. If the package has a package-lock, or an npm shrinkwrap file, or a yarn lock file, the installation of dependencies will be driven by that
I was trying to find more information about npm install behavior with the yarn.lock present, but didn't find much. This blog post states:
With the new package-lock.json file we'll unlock the ability to do deterministically reproducible builds. It should now include everything npm needs to install the packages needed. Before npm 7 yarn.lock was ignored by npm, but this is no longer the case. It can now use it to keep itself up to date with the package tree.
GitHub blog:
In prior versions, the yarn.lock files were ignored, the npm CLI can now use yarn.lock as the source of package metadata and resolution guidance. If a yarn.lock file is present, then npm will also keep it up-to-date with the contents of the package tree.
But neither of them gives a clear picture of what actually happens when I run npm install with yarn.lock.
I'd like to get a grasp on it:
- Can I run
yarn locally to generate yarn.lock and reproduce the package tree on CI with npm install?
- What exactly happens when I run
npm install with yarn.lock? Does it get updated? Can it be run with (sort of) --frozen-lockfile? The npm ci command doesn't mention yarn.lock at all.
- Does it support both
v1 and berry?
发布评论
评论（3）
不，如果要使用NPM V7复制包装树，您仍然需要一个
package-lock.json文件。 V7仅将YARN.LOCK文件用作包装元数据的来源和解决指南。这是因为NPM V7使用新的
lockfileversion生成了锁紧files：2（向后兼容），以提高性能并允许具有确定性树形状的可重复性构建；它还试图从package.json元数据文件中减少读数。是的，
yarn.lock文件将被更新，而NPM仍将创建package> package-lock.json文件，如果package> package> package> package-lock.json 文件，它将用作创建树形的权威定义。按照他们不支持yarn.lock文件的原因是
最后，
这尚不清楚，并且暗示为
berry更改，因为YARN使用Yarn.lock文件和纱线版本的组合来保证确定性分辨率。我建议阅读此blogpost 上述帖子来自 npm 用于更多的in-depth for-depth。
No, you still need a
package-lock.jsonfile if you want to reproduce the package tree using npm v7. v7 only uses the yarn.lock file as a source of package metadata and resolution guidance.This is because npm v7 generates the lockfiles with the a new
lockFileVersion: 2(backward compatible) to improve performance and allow reproducible builds with deterministic tree shape; it also tries to reduce reading frompackage.jsonfile for metadata.Yes, the
yarn.lockfile will be updated and npm will still create apackage-lock.jsonfile, and if apackage-lock.jsonfile is present, it’ll be used as the authoritative definition of the tree shape to create.As per this NPM blog post, the reason they don't support yarn.lock file yet is
Finally,
This is not clear, and is implied to change for
berryas yarn uses a combination ofyarn.lockfile and yarn version to guarantee deterministic resolution.I suggest reading this blogpost along with the above post from npm for more in-depth explanation.
由于您做了很多研究，而且似乎进一步的文档搜索无法减轻您的不确定性，为什么不采取未来的一步来查看源代码呢？不要害怕阅读代码
，因此，我在repo 发现这个文件
href =“ https://github.com/npm/cli/blob/latest/workspaces/arborist/arborist/lib/shrinkwrap.js ”
是的，除非您使用一些仅归因于
berry而不支持NPM的协议npm i时，yarn.lock将被更新。至少它将进行一些格式更改并覆盖注册表URL。如果npm找不到软件包的已解析版本或已解决的版本无效，则它将从注册表中获取并在package> package-lock.json和Yarn.lock。npm CI需要package-lock.json，否则将立即退出它与
Berry无法很好地工作。npm将覆盖yarn.lock，其格式YARN LOCKFILE V1Since you have done so much research and it seemed further document searching wouldn't alleviate your uncertainty, why not take a future step to take a look at the source code? Don't be afraid to read code
So, I did a superficial search on the repo https://github.com/npm/cli and found this file can answer your question
For takeaway,
Yes, unless you use some protocols only attributed to
berryand unsupported by npmnpm i,yarn.lockwill get updated. At least it will make some formatting changes and overwrite the registry URL. Ifnpmcannot find the resolved version of a package or the resolved version isn't valid, it will get it from the registry and update in bothpackage-lock.jsonandyarn.lock.npm cirequirespackage-lock.jsonotherwise it will exit immediatelyit don't work well with
berry.npmwill overwrite theyarn.lockwith the format of yarn lockfile v1该文档应该有助于解释一点： https://blog.npmjs.org/post/621733939456933888/npm-v7-series-why-keep-package -lockjson.html＃：〜：text = when％20npm％20 ress％20％20岁，t％20ideal％20英寸20英寸20％20％20例20case 。
此链接在YARN和NPM上有点说明了您从NPM转换为纱线的想法，因此相反，但比较命令（CI）可以有趣地查看： https://classic.yarnpkg.com/lang/en/docs/migrating-from-npm/
我对其他差异不太了解，然后YARN安装速度更快，包装既更快又构建了一点不同的。找不到解释切换到NPM的文档。在开始NPM之前删除Yarn.lock。否则，请参见上述答案。
This doc should help explain a bit: https://blog.npmjs.org/post/621733939456933888/npm-v7-series-why-keep-package-lockjson.html#:~:text=While%20npm%20uses%20the%20yarn,t%20ideal%20in%20these%20cases.
This link explains a bit on yarn and npm interacting tho on the idea that your switching from npm to yarn, so kinda the opposite but a list of comparison commands (CI) that could be interesting to view: https://classic.yarnpkg.com/lang/en/docs/migrating-from-npm/
I don't know much about the difference other then Yarn install faster and the packages are built a little different. Couldn't find a doc that explains switching to npm. Delete the yarn.lock before starting npm. Otherwise, see above answer.