{"action":"created","issue":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/5654","repository_url":"https://api.github.com/repos/yarnpkg/yarn","labels_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5654/labels{/name}","comments_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5654/comments","events_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5654/events","html_url":"https://github.com/yarnpkg/yarn/issues/5654","id":313523598,"node_id":"MDU6SXNzdWUzMTM1MjM1OTg=","number":5654,"title":"Competing lockfiles create poor UX","user":{"login":"jmorrell","id":175496,"node_id":"MDQ6VXNlcjE3NTQ5Ng==","avatar_url":"https://avatars3.githubusercontent.com/u/175496?v=4","gravatar_id":"","url":"https://api.github.com/users/jmorrell","html_url":"https://github.com/jmorrell","followers_url":"https://api.github.com/users/jmorrell/followers","following_url":"https://api.github.com/users/jmorrell/following{/other_user}","gists_url":"https://api.github.com/users/jmorrell/gists{/gist_id}","starred_url":"https://api.github.com/users/jmorrell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmorrell/subscriptions","organizations_url":"https://api.github.com/users/jmorrell/orgs","repos_url":"https://api.github.com/users/jmorrell/repos","events_url":"https://api.github.com/users/jmorrell/events{/privacy}","received_events_url":"https://api.github.com/users/jmorrell/received_events","type":"User","site_admin":false},"labels":[{"id":446993282,"node_id":"MDU6TGFiZWw0NDY5OTMyODI=","url":"https://api.github.com/repos/yarnpkg/yarn/labels/cat-compatibility","name":"cat-compatibility","color":"77543b","default":false},{"id":732713829,"node_id":"MDU6TGFiZWw3MzI3MTM4Mjk=","url":"https://api.github.com/repos/yarnpkg/yarn/labels/needs-discussion","name":"needs-discussion","color":"fbca04","default":false},{"id":594046112,"node_id":"MDU6TGFiZWw1OTQwNDYxMTI=","url":"https://api.github.com/repos/yarnpkg/yarn/labels/triaged","name":"triaged","color":"c5def5","default":false}],"state":"open","locked":false,"assignee":{"login":"imsnif","id":795598,"node_id":"MDQ6VXNlcjc5NTU5OA==","avatar_url":"https://avatars3.githubusercontent.com/u/795598?v=4","gravatar_id":"","url":"https://api.github.com/users/imsnif","html_url":"https://github.com/imsnif","followers_url":"https://api.github.com/users/imsnif/followers","following_url":"https://api.github.com/users/imsnif/following{/other_user}","gists_url":"https://api.github.com/users/imsnif/gists{/gist_id}","starred_url":"https://api.github.com/users/imsnif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imsnif/subscriptions","organizations_url":"https://api.github.com/users/imsnif/orgs","repos_url":"https://api.github.com/users/imsnif/repos","events_url":"https://api.github.com/users/imsnif/events{/privacy}","received_events_url":"https://api.github.com/users/imsnif/received_events","type":"User","site_admin":false},"assignees":[{"login":"imsnif","id":795598,"node_id":"MDQ6VXNlcjc5NTU5OA==","avatar_url":"https://avatars3.githubusercontent.com/u/795598?v=4","gravatar_id":"","url":"https://api.github.com/users/imsnif","html_url":"https://github.com/imsnif","followers_url":"https://api.github.com/users/imsnif/followers","following_url":"https://api.github.com/users/imsnif/following{/other_user}","gists_url":"https://api.github.com/users/imsnif/gists{/gist_id}","starred_url":"https://api.github.com/users/imsnif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imsnif/subscriptions","organizations_url":"https://api.github.com/users/imsnif/orgs","repos_url":"https://api.github.com/users/imsnif/repos","events_url":"https://api.github.com/users/imsnif/events{/privacy}","received_events_url":"https://api.github.com/users/imsnif/received_events","type":"User","site_admin":false}],"milestone":null,"comments":68,"created_at":"2018-04-11T23:34:42Z","updated_at":"2018-07-25T06:52:39Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"NB: I'm creating this issue in the yarn repo, but this is actually a shared issue between yarn and npm.\r\n\r\nWith the release of npm 5 back in May, the Node ecosystem now has two lockfile-based package managers. This was overall a win for users, and it has been good to see competition in this space.\r\n\r\nHowever now that there are two competing lockfile formats this can create a new problem for users, especially beginning developers.\r\n\r\nWhen npm 5 came out, Heroku added a [new failure if an application was submitted with both npm and yarn lockfiles](https://github.com/heroku/heroku-buildpack-nodejs/blob/master/lib/failure.sh#L77-L94). In the past few months **this has become the most common reason Node builds fail on Heroku** and these failures account for ~10-12% of all Node build failures on the platform. **Thousands of developers hit this every month**.\r\n\r\nIt's surprisingly easy to end up with both in your repository. Even as an experienced developer I've found myself running the wrong tool for a specific project and having to catch myself before commiting. For an inexperienced developer building their first server / react / angular project who might not understand what a package manager, lockfile, or git repo is, this can be highly confusing.\r\n\r\nNeither tool will give a warning or error if the other lockfile exists:\r\n\r\n```\r\n❯ ls *lock*   \r\nls: *lock*: No such file or directory\r\n                                                                                                                                                         \r\n❯ npm --version\r\n5.8.0\r\n                                                                                                                                                         \r\n❯ yarn --version\r\n1.5.1\r\n\r\n❯ npm install\r\nnpm notice created a lockfile as package-lock.json. You should commit this file.\r\n\r\nadded 659 packages from 437 contributors in 10.553s\r\n                                                                                                                                                         \r\n❯ yarn install  \r\nyarn install v1.5.1\r\ninfo No lockfile found.\r\n[1/4] 🔍  Resolving packages...\r\n[2/4] 🚚  Fetching packages...\r\n[3/4] 🔗  Linking dependencies...\r\n[4/4] 📃  Building fresh packages...\r\nsuccess Saved lockfile.\r\n✨  Done in 7.67s.\r\n                                                                                                                                                         \r\n❯ ls *lock*          \r\npackage-lock.json yarn.lock\r\n```\r\n\r\nThis is likely especially true for Yarn users where most of the documentation on the web instructs users to `npm install`.  Users who copy + paste commands from docs or Stack Overflow are likely to end up here.\r\n\r\nI've spoken to @zkat and @iarna at npm and @arcanis on yarn, and all agreed that this is an issue that should be addressed, but there was not full agreement on how. Ideally this issue prompts discussion and both tools can agree on how we can help users here.\r\n\r\nI've compiled a list of potential mitigations that have been suggested to me:\r\n\r\n## Potential solutions\r\n\r\n#### Do nothing\r\n\r\nIs there a technical reason a user might want two lockfiles? In this case, how can external tools determine which package manager should be used for that application?\r\n\r\n#### Error if the other lockfile exists\r\n\r\nYarn could print an error and exit if `package-lock.json` exists and vice-versa.\r\n\r\nPros:\r\n  - simple and easy to implement\r\n  - the user gets an error where they are in a position to immediately fix it\r\n\r\nCons:\r\n  - Not a fantastic user experience\r\n\r\n#### Convert the other lockfile\r\n\r\nYarn could read `package-lock.json`, convert it into `yarn.lock`, and remove `package-lock.json`. npm could do the opposite.\r\n\r\nPros:\r\n  - great user experience\r\n  - users switching tools would not get a new set of dependencies as a side-effect\r\n\r\nCons:\r\n  - My understanding is that due to the different dependency resolution strategies this conversion would be lossy both ways\r\n  - Requires each tool to add and maintain code to understand the other lockfile\r\n  - Lockfile formats may change over time\r\n\r\n#### Delete the other's lockfile\r\n\r\nJust remove the other lockfile and create a new one\r\n\r\nPros:\r\n  - effectively prevents this situation\r\n\r\nCons:\r\n  - surprising behavior\r\n  - user gets new set of dependencies\r\n  \r\n#### Run the other tool for the user\r\n\r\nIf yarn sees a `package-lock.json` but not a `yarn.lock` it could log a warning and call `npm install` for the user\r\n\r\nPros:\r\n  - User gets what they wanted\r\n\r\nCons:\r\n  - Surprising behavior\r\n  - somewhat complicated\r\n\r\n#### Add config to `package.json` to indicate\r\n\r\nAdd a field in `package.json` to indicate which package manager a project should use\r\n\r\n```\r\n\"package-manager\": \"yarn\"\r\n```\r\n\r\nPros:\r\n  - Explicitly conveys the user's intent\r\n\r\nCons:\r\n  - Adds more config for the user\r\n \r\n#### Other?\r\n\r\nMaybe I'm missing something that would work better\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/comments/407652755","html_url":"https://github.com/yarnpkg/yarn/issues/5654#issuecomment-407652755","issue_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5654","id":407652755,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNzY1Mjc1NQ==","user":{"login":"nottrobin","id":519935,"node_id":"MDQ6VXNlcjUxOTkzNQ==","avatar_url":"https://avatars2.githubusercontent.com/u/519935?v=4","gravatar_id":"","url":"https://api.github.com/users/nottrobin","html_url":"https://github.com/nottrobin","followers_url":"https://api.github.com/users/nottrobin/followers","following_url":"https://api.github.com/users/nottrobin/following{/other_user}","gists_url":"https://api.github.com/users/nottrobin/gists{/gist_id}","starred_url":"https://api.github.com/users/nottrobin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nottrobin/subscriptions","organizations_url":"https://api.github.com/users/nottrobin/orgs","repos_url":"https://api.github.com/users/nottrobin/repos","events_url":"https://api.github.com/users/nottrobin/events{/privacy}","received_events_url":"https://api.github.com/users/nottrobin/received_events","type":"User","site_admin":false},"created_at":"2018-07-25T06:52:39Z","updated_at":"2018-07-25T06:52:39Z","author_association":"NONE","body":"I can see from @imsnif and @arcanis' responses that the official position here seems to be that Yarn was \"never intended\" to continue to work seamlessly alongside NPM.\r\n\r\nBut I totally agree with @Spongman that this is the impression Yarn gave, and I really don't think that was an accident at the time. That was its genius - you could have improved speed, security etc. while still completely supporting the official NPM standards.\r\n\r\nIn either case, this issue makes Yarn's position on this much more clear for me than it was previously, and of course, Yarn's maintainers can choose to take it whatever direction they choose.\r\n\r\nBut I think you're **drastically** under-estimating the number of people who used Yarn precisely because they believed it maintained compatibility with NPM, and would never have made the switch otherwise. I believe that the 254 :+1:s (and 10 :heart:s) on https://github.com/yarnpkg/yarn/issues/3614 and the 57 upvotes on \"[Should I commit yarn.lock and package-lock.json files?](https://stackoverflow.com/questions/44552348/should-i-commit-yarn-lock-and-package-lock-json-files/44904494)\" make this abundantly clear.\r\n\r\nIf you abdicate any responsibility on that front I think you'll lose not only @Spongman and my teams, but many others besides."}}
{"actor":{"display_login":"nottrobin"}}