{"action":"created","issue":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/5745","repository_url":"https://api.github.com/repos/yarnpkg/yarn","labels_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5745/labels{/name}","comments_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5745/comments","events_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5745/events","html_url":"https://github.com/yarnpkg/yarn/pull/5745","id":318380251,"number":5745,"title":"feat(import): convert package-lock.json to yarn.lock","user":{"login":"imsnif","id":795598,"avatar_url":"https://avatars3.githubusercontent.com/u/795598?v=4","gravatar_id":"","url":"https://api.github.com/users/imsnif","html_url":"https://github.com/imsnif","followers_url":"https://api.github.com/users/imsnif/followers","following_url":"https://api.github.com/users/imsnif/following{/other_user}","gists_url":"https://api.github.com/users/imsnif/gists{/gist_id}","starred_url":"https://api.github.com/users/imsnif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imsnif/subscriptions","organizations_url":"https://api.github.com/users/imsnif/orgs","repos_url":"https://api.github.com/users/imsnif/repos","events_url":"https://api.github.com/users/imsnif/events{/privacy}","received_events_url":"https://api.github.com/users/imsnif/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"BYK","id":126780,"avatar_url":"https://avatars3.githubusercontent.com/u/126780?v=4","gravatar_id":"","url":"https://api.github.com/users/BYK","html_url":"https://github.com/BYK","followers_url":"https://api.github.com/users/BYK/followers","following_url":"https://api.github.com/users/BYK/following{/other_user}","gists_url":"https://api.github.com/users/BYK/gists{/gist_id}","starred_url":"https://api.github.com/users/BYK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BYK/subscriptions","organizations_url":"https://api.github.com/users/BYK/orgs","repos_url":"https://api.github.com/users/BYK/repos","events_url":"https://api.github.com/users/BYK/events{/privacy}","received_events_url":"https://api.github.com/users/BYK/received_events","type":"User","site_admin":false},"assignees":[{"login":"BYK","id":126780,"avatar_url":"https://avatars3.githubusercontent.com/u/126780?v=4","gravatar_id":"","url":"https://api.github.com/users/BYK","html_url":"https://github.com/BYK","followers_url":"https://api.github.com/users/BYK/followers","following_url":"https://api.github.com/users/BYK/following{/other_user}","gists_url":"https://api.github.com/users/BYK/gists{/gist_id}","starred_url":"https://api.github.com/users/BYK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BYK/subscriptions","organizations_url":"https://api.github.com/users/BYK/orgs","repos_url":"https://api.github.com/users/BYK/repos","events_url":"https://api.github.com/users/BYK/events{/privacy}","received_events_url":"https://api.github.com/users/BYK/received_events","type":"User","site_admin":false}],"milestone":null,"comments":10,"created_at":"2018-04-27T11:50:02Z","updated_at":"2018-05-11T06:48:48Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/yarnpkg/yarn/pulls/5745","html_url":"https://github.com/yarnpkg/yarn/pull/5745","diff_url":"https://github.com/yarnpkg/yarn/pull/5745.diff","patch_url":"https://github.com/yarnpkg/yarn/pull/5745.patch"},"body":"This is the first step to addressing: https://github.com/yarnpkg/yarn/issues/5654\r\n\r\n## Overview (TLDR)\r\nAt the moment, one is able to `yarn import` using `node_modules` as the dependency-tree state to create a `yarn.lock` file.\r\nThe feature created by this PR allows one to `yarn import` using `package-lock.json` as the dependency-tree state. When one enters the `yarn import` command, if a `package-lock.json` file exists, yarn would attempt to import from it. If not, it would import from `node_modules` normally.\r\n\r\n## How does this work?\r\nA logical dependency tree is created from the `package-lock.json` file, then yarn walks through the dependencies as normal, using the logical tree to determine the package details. Often, this tree will not include the full information needed by yarn (eg. package `shasum`), and for this reason the package manifest is downloaded from the registry. This makes the process a little lengthy, but not terribly so. I deem this acceptable, seeing as this is not an everyday process. Would love to hear your thoughts if you disagree.\r\n\r\nI opted not to fall back on (or search initially for) the manifest in node_modules, because I felt this would be error prone and introduce non-trivial complexity (eg. corrupted node_modules).\r\n\r\n## Limitations\r\nRarely, a `yarn.lock` would not be 100% logically identical to the `package-lock.json` from which it was created. In all incidents I encountered, this happens because of built-in limitations in `yarn`.\r\nAn example is two different packages with the same semver range string (eg. `^2.0.0`) being resolved in `package-lock.json` to two different versions (eg. `2.0.1` and `2.0.2`).\r\nAnother example is bundled dependencies.\r\n\r\nI encourage the readers to test things for themselves (if there is interest, I have a script that logically compares yarn/npm trees - I can clean it up and post it somewhere).\r\n\r\n## Open Questions / Issues\r\n1. This PR only adds a `package-lock.json` import feature and does not address the full concerns raised in the issue linked above. I feel this is a good first step, after which we can continue discussing whether `yarn install` should issue a warning/error if it finds a `package-lock.json` file, and whether `import` should delete the `package-lock.json` file after successfully importing. As well as the myriad of other concerns raised there.\r\n2. The careful reader would notice that there is a slight discrepancy in the import types. By nature when importing from `node_modules`, the user would end up with a fully installed `node_modules` folder consistent with their `yarn.lock` file. This is not the case when importing from `package-lock.json`. One must `yarn install` after `yarn import`ing from a `package-lock.json`. In my eyes, this is a desired behaviour for the conversion (which I see more as a 'surgical fix') even if it is not such a desired behaviour for the `import` command. I chose to give more weight to the former, but am of course open to different approaches. \r\n3. Continuing point 2, an empty `node_modules` folder is created when importing from `package-lock.json` as mentioned here: https://github.com/yarnpkg/yarn/issues/5419\r\n\r\n## Tests\r\nIn the tests for this feature I copied the relevant cases from the existing import tests. I did not (as I initially intended) add tests that make a logical comparison of the created `yarn.lock` against the originating `package-lock.json`.\r\nThe existing cases use file snapshots, and I felt this would be more coherent upon failure. Would love to hear differing opinions though."},"comment":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/comments/388276775","html_url":"https://github.com/yarnpkg/yarn/pull/5745#issuecomment-388276775","issue_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5745","id":388276775,"user":{"login":"BYK","id":126780,"avatar_url":"https://avatars3.githubusercontent.com/u/126780?v=4","gravatar_id":"","url":"https://api.github.com/users/BYK","html_url":"https://github.com/BYK","followers_url":"https://api.github.com/users/BYK/followers","following_url":"https://api.github.com/users/BYK/following{/other_user}","gists_url":"https://api.github.com/users/BYK/gists{/gist_id}","starred_url":"https://api.github.com/users/BYK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BYK/subscriptions","organizations_url":"https://api.github.com/users/BYK/orgs","repos_url":"https://api.github.com/users/BYK/repos","events_url":"https://api.github.com/users/BYK/events{/privacy}","received_events_url":"https://api.github.com/users/BYK/received_events","type":"User","site_admin":false},"created_at":"2018-05-11T06:48:48Z","updated_at":"2018-05-11T06:48:48Z","author_association":"OWNER","body":"Yarn doesn't handle bundledDependencies properly, can this be the reason?\r\n\r\nTheory: since yarn doesn't handle bundled dependencies, it expects these packages in the cache but they are not there so it fails."}}
{"actor":{"display_login":"BYK"}}