Let's explore package manager of JavaScript.

May 12, 20265 min read

A software package is a collection of files that are bundled together and can be installed and removed as a group.

A package manager keeps track of what software is installed on your computer and allow you to easily install a new software, upgrade the software to its newer version, or remove software that you previously installed. Package managers deals with packages.

You can write code without using package managers, but it will be a cumbersome task.

There are advantages of using a package manager:#

It manages dependencies automatically
It provides unified updates and security patches
It creates lock files that record the exact version of every library used.
It makes the reproducibility easier for a new developer.
It uses centralised repositories that act as a single source of truth.
When you uninstall software manually, it often leaves behind "orphaned" files, leftover folders, registry entries, or old libraries that just take up space. A package manager keeps a log of every file it installs, ensuring that when you remove a package, it performs a clean removal and can even offer to remove dependencies that are no longer needed by any other program.

Disadvantages of Packet manager:#

They are prime target for hackers because package managers makes it easy to download code
Version conflicts happen sometimes due to updates.
Package managers often priortise "making it work" over "save space". To avoid version conflicts, managers like npm often download a fresh copy of every dependency for every project. This can result in gigabytes of duplicate files across your hard drive.
You might install one small tool that pulls in 50 other libraries you didn't know you needed.
Reliance over repository to build your project or deploy your software
Package managers add a layer of abstraction that can be hard to fix when things go wrong.
Each manager has its own unique syntax, configuration files and "quirks" you have to learn.

npm#

npm is the package manager for Node.js. It was created in 2009 as an open source project to help JavaScript developers easily share packaged modules of code.

The npm Registry is a public collection of packages of open-source code for Node.js, front-end web apps, mobile apps, robots, routers, and countless other needs of the JavaScript community.

npm is the command line client that allows developers to install and publish those packages.

It was under npm, Inc., a company founded in 2014, and was acquired by GitHub in 2020. npm is a critical part of the JavaScript community and helps support one of the largest developer ecosystems in the world.

It comes as a default package manager with node.js.

It is slower than its competitors.

In long run, it starts bloating and takes more space.

yarn#

The first major JavaScript package manager, npm, was built shortly after Node.js was introduced, and it quickly became one of the most popular package managers in the world. Thousands of new open source projects were created and engineers shared more code than ever before.

Facebook faced problems with consistency when installing dependencies across different machines and users, the amount of time it took to pull dependencies in, and had some security concerns with the way the npm client executes code from some of those dependencies automatically.

Rather than continue building infrastructure around the npm client, Facebook decided to try looking at the problem more holistically.

With the help of engineers from Exponent, Google, and Tilde, Facebook built out the Yarn client and tested and validated its performance on every major JS framework and for additional use cases outside of Facebook.

Yarn is a new package manager that replaces the existing workflow for the npm client or other package managers while remaining compatible with the npm registry. It has the same feature set as existing workflows while operating faster, more securely, and more reliably.

Yarn resolves these issues around sematic versioning and non-determinism by using lockfiles and an install algorithm that is deterministic and reliable. These lockfiles lock the installed dependencies to a specific version, and ensure that every install results in the exact same file structure in node_modules across all machines. The written lockfile uses a concise format with ordered keys to ensure that changes are minimal and review is simple.

By breaking these steps down cleanly and having deterministic results, Yarn is able to parallelize operations, which maximizes resource utilization and makes the install process faster.

Throughout this entire process, Yarn imposes strict guarantees around package installation. You have control over which lifecycle scripts are executed for which packages. Package checksums are also stored in the lockfile to ensure that you get the same package every single time.

Yarn is a drop in replacement.

Yarn supports dependency linking.

Yarn has feature of workspaces. Workspaces are the name of individual packages that are part of the same project and that Yarn will install and link together to simplify cross-references.

This pattern is often called monorepo when used in conjunction with a repository. Workspaces were initially popularized by projects like Lerna, but Yarn was the first package manager to provide native support for them - support which never stopped improving over years as we build more features around them.

pnpm#

pnpm (performant npm) was created by developer Rico Sta. Cruz and Zoltan Kochan in 2016. Zoltan designed it as a performant and disk space-efficient alternative to the standard npm package manager.

It is an alternative package manager for Node.js. It is a drop-in replacement for npm, but faster and more efficient.

It is even faster than yarn.

When you install a package, pnpm keep it in a global store on your machine, then it creates a hard link from it instead of copying. For each version of a module, there is only ever one copy kept on disk. So, pnpm allows you to save gigabytes of disk space.

Yarn makes installations faster and it has some nice new features, it uses the same flat node_modules structure that npm does.

Flattened dependency trees come with a bunch of issues:

modules can access packages they don’t depend on

the algorithm of flattening a dependency tree is pretty complex

some of the packages have to be copied inside one project’s node_modules folder

Pnpm solves the disk space usage issue. With pnpm, the dependency will be stored in a content-addressable store.

By default, pnpm uses symlinks to add only the direct dependencies of the project into the root of the modules directory.

It creates non-flat node_modules directory.

It has strict depedency resolution. All required dependencies are identified and fetched to the store.

pnpm has built-in support for monorepositories . You can create a workspace to unite multiple projects inside a single repository.

bun#

bun is the modern JavaScript and TypeScript runtime. It was designed and created by software engineer Jarred Sumner. He first launched the project in 2021 to solve the slow build times he was experiencing with other development tools.

Sumner subsequently founded a startup called Oven.sh to develop bun and th company was later aquired by Anthropic. Despite the aquisition, bun remains an open source project.

It is fastest than its competitiors.

It is also a package manager and test runner.

It is designed as a drop in replacement for Node.js.

Bun uses Safari's JavaScriptCore and its JavaScript engine. As you know Node.js runs on V8 engine of Google.

bun is all in one toolkit: JavaScript Runtime, package manager faster than npm, test runner and bundler. It has monorepo support

It is used by many.