{"slug": "yarn", "name": "Yarn", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 6, "commenters": 19, "warners": 6, "score": 1.639, "rising": -1.96, "first": "2025-11-24", "latest": "2026-06-11", "why": "yarn still has a feature that I frequently miss: the project-local cache", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 7, "compare": 1, "warn": 7}, "spark": [1, 0, 0, 0, 1, 0, 1, 2, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "yarn still has a feature that I frequently miss: the project-local cache", "kind": "", "icon": false, "domain": "yarnpkg.com", "github_repo": null, "official_url": "https://yarnpkg.com", "pricing": "", "aliases": ["Yarn", "yarn"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 775812385, "item_id": 48488274, "url": "https://news.ycombinator.com/item?id=48488274", "by": "Timon3", "date": "2026-06-11", "stance": "recommend", "quote": "yarn still has a feature that I frequently miss: the project-local cache", "excerpt": "Though I mostly use pnpm these days, yarn still has a feature that I frequently miss: the project-local cache[0]. Basically, every dependency archive fetched from a registry is stored in your repo in .yarn/cache, so unless you're adding/updating dependencies a `yarn install` will work fully offline. I'm sure there are drawbacks to this method regarding repo size etc., but it just feels good knowing that my repo conta", "context": "", "use_case": "Offline dependency cache", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 773708336, "item_id": 48356771, "url": "https://news.ycombinator.com/item?id=48356771", "by": "dmix", "date": "2026-06-01", "stance": "recommend", "quote": "Our company uses yarn 4 which has an option to prevent you from installing an npm package", "excerpt": "Our company uses yarn 4 which has an option to prevent you from installing an npm package for the first number of days of its release. Most of these seem to be caught within that timeframe (1-3 days). https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104", "context": "works at a company using Yarn 4", "use_case": "Package management", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 770829408, "item_id": 48176838, "url": "https://news.ycombinator.com/item?id=48176838", "by": "DanielHB", "date": "2026-05-18", "stance": "recommend", "quote": "it made for very concise way to represent the logic", "excerpt": "The JS package manager Yarn had an experimental feature to define dependency constraints using prolog, it made for very concise way to represent the logic. https://v3.yarnpkg.com/features/constraints It never got released for good though. I actually had need of such feature for a project but I thought that using an exoteric programming language and an experimental feature was a bit much. I ended up setting up those c", "context": "", "use_case": "dependency constraints", "switched_from": "", "story": "Prolog Coding Horror"}, {"id": 758626912, "item_id": 47414182, "url": "https://news.ycombinator.com/item?id=47414182", "by": "Dangeranger", "date": "2026-03-17", "stance": "recommend", "quote": "There are alternative package managers like Yarn that use zip files as a way to store each Node package.", "excerpt": "There are alternative package managers like Yarn that use zip files as a way to store each Node package.[0] [0] https://yarnpkg.com/advanced/pnp-spec#zip-access", "context": "", "use_case": "", "switched_from": "", "story": "Why Node.js needs a virtual file system"}, {"id": 737100177, "item_id": 46068761, "url": "https://news.ycombinator.com/item?id=46068761", "by": "moritzwarhier", "date": "2025-11-27", "stance": "recommend", "quote": "it's best to use 'npm ci' or 'yarn install --immutable'", "excerpt": "You are right that 'npm install' can upgrade versions even when a lock file is present, but AFAIK this should only happen it the lock file is not compatible with the package.json. I haven't seen it in a long time, and AFAIK it can't happen without you changing the package.json. But yes, it's a reason to pin dependencies and use npm ci / yarn immutable etc. Updates of transitive dependencies are afaik not automaticall", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Safe-NPM \u2013 only install packages that are +90 days old"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 775595873, "item_id": 48474742, "url": "https://news.ycombinator.com/item?id=48474742", "by": "mkesper", "date": "2026-06-10", "stance": "warn", "quote": "It was a giant mistake to keep 'classic' (umnaintained, unpatched) yarn around.", "excerpt": "It was a giant mistake to keep 'classic' (umnaintained, unpatched) yarn around. Switched to pnpm in part due to that reason.", "context": "", "use_case": "JS package management", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 775587520, "item_id": 48474220, "url": "https://news.ycombinator.com/item?id=48474220", "by": "tuwtuwtuwtuw", "date": "2026-06-10", "stance": "warn", "quote": "Deterministic to a fault unless you mix Windows and Linux.", "excerpt": "Deterministic to a fault unless you mix Windows and Linux. https://github.com/yarnpkg/berry/issues/6105", "context": "", "use_case": "", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 772258882, "item_id": 48266180, "url": "https://news.ycombinator.com/item?id=48266180", "by": "cxr", "date": "2026-05-25", "stance": "warn", "quote": "futzing around with with NPM/Yarn", "excerpt": "The submission is about \"Build[ing] Adafruit projects right from Firefox\" with \"no extra tools or complex setup required\". It works by using the esptool-js library, a \"flasher tool for Espressif chips, running in web browser using WebSerial\". Suppose that immediately after reading the title and the copy on the corresponding page, you clicked through to the <https://github.com/espressif/esptool-js/> project to see how", "context": "", "use_case": "", "switched_from": "", "story": "Build Adafruit projects right from Firefox"}, {"id": 758642769, "item_id": 47415173, "url": "https://news.ycombinator.com/item?id=47415173", "by": "chrisweekly", "date": "2026-03-17", "stance": "warn", "quote": "Strong recommendation to use PNPM instead of yarn or npm.", "excerpt": "Strong recommendation to use PNPM instead of yarn or npm. IME (webdev since 1998) it's the only sane tool for stewardship of an npm dependency graph. See https://pnpm.io/motivation Also, while popularity isn't necessarily a great indicator of quality, a quick comparison shows that the community has decided on pnpm: https://www.npmcharts.com/compare/pnpm,yarn,npm", "context": "", "use_case": "", "switched_from": "", "story": "Why Node.js needs a virtual file system"}]}], "who": [{"by": "dmix", "context": "works at a company using Yarn 4", "url": "https://news.ycombinator.com/item?id=48356771", "date": "2026-06-01"}], "tags": [], "use_cases": ["package management", "offline dependency cache", "js package management", "javascript package manager", "dependency constraints", "monorepo package management"], "compared": [{"slug": "pnpm", "name": "pnpm", "co": 11, "switched_from": 0, "switched_to": 1}, {"slug": "npm", "name": "npm", "co": 10, "switched_from": 1, "switched_to": 0}, {"slug": "bun", "name": "Bun", "co": 2, "switched_from": 0, "switched_to": 1}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48467705", "title": "Upcoming breaking changes for NPM v12", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=48356625", "title": "NPM packages from RedHat have been compromised", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=47413195", "title": "Why Node.js needs a virtual file system", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=46027878", "title": "Show HN: Safe-NPM \u2013 only install packages that are +90 days old", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48231547", "title": "Build Adafruit projects right from Firefox", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48173268", "title": "Prolog Coding Horror", "mentions": 1}], "sentiment_by_month": {"2025-11": {"warn": 1, "recommend": 1, "neutral": 1}, "2025-12": {"neutral": 1}, "2026-01": {"neutral": 1}, "2026-02": {}, "2026-03": {"neutral": 1, "recommend": 1, "warn": 2}, "2026-04": {"neutral": 1}, "2026-05": {"neutral": 1, "recommend": 1, "warn": 1}, "2026-06": {"recommend": 2, "neutral": 1, "compare": 1, "warn": 3}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 775812385, "item_id": 48488274, "url": "https://news.ycombinator.com/item?id=48488274", "by": "Timon3", "date": "2026-06-11", "stance": "recommend", "quote": "yarn still has a feature that I frequently miss: the project-local cache", "excerpt": "Though I mostly use pnpm these days, yarn still has a feature that I frequently miss: the project-local cache[0]. Basically, every dependency archive fetched from a registry is stored in your repo in .yarn/cache, so unless you're adding/updating dependencies a `yarn install` will work fully offline. I'm sure there are drawbacks to this method regarding repo size etc., but it just feels good knowing that my repo conta", "context": "", "use_case": "Offline dependency cache", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 775595873, "item_id": 48474742, "url": "https://news.ycombinator.com/item?id=48474742", "by": "mkesper", "date": "2026-06-10", "stance": "warn", "quote": "It was a giant mistake to keep 'classic' (umnaintained, unpatched) yarn around.", "excerpt": "It was a giant mistake to keep 'classic' (umnaintained, unpatched) yarn around. Switched to pnpm in part due to that reason.", "context": "", "use_case": "JS package management", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 775587520, "item_id": 48474220, "url": "https://news.ycombinator.com/item?id=48474220", "by": "tuwtuwtuwtuw", "date": "2026-06-10", "stance": "warn", "quote": "Deterministic to a fault unless you mix Windows and Linux.", "excerpt": "Deterministic to a fault unless you mix Windows and Linux. https://github.com/yarnpkg/berry/issues/6105", "context": "", "use_case": "", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 775583264, "item_id": 48473954, "url": "https://news.ycombinator.com/item?id=48473954", "by": "arcatek", "date": "2026-06-10", "stance": "warn", "quote": "", "excerpt": "I don't doubt that 3.x probably has worst perfs (it's almost two years old now), but just to clarify we closely track performances and Yarn and pnpm and pretty much on similar level: https://p.datadoghq.eu/sb/d2wdprp9uki7gfks-c562c42f4dfd0ade4885690fa719c818", "context": "", "use_case": "", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 775575408, "item_id": 48473463, "url": "https://news.ycombinator.com/item?id=48473463", "by": "homebrewer", "date": "2026-06-10", "stance": "compare", "quote": "One distinguishing feature is their optional install strategy", "excerpt": "One distinguishing feature is their optional install strategy: running packages directly from compressed archives instead of unpacking them into node_modules. https://yarnpkg.com/features/pnp Very similar to using .jar's in Java instead of directory trees of .class files. It's somewhat hacky though, and editor/tool support varies. - since there are far fewer small files, it can be faster especially on Windows if you'", "context": "", "use_case": "JavaScript package manager", "switched_from": "", "story": "Upcoming breaking changes for NPM v12"}, {"id": 773723232, "item_id": 48357702, "url": "https://news.ycombinator.com/item?id=48357702", "by": "vinnymac", "date": "2026-06-01", "stance": "recommend", "quote": "", "excerpt": "In case others are unaware, you just have to set https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate to the value you want. It defaults to 1 day.", "context": "", "use_case": "Package management", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 773721569, "item_id": 48357598, "url": "https://news.ycombinator.com/item?id=48357598", "by": "vinnymac", "date": "2026-06-01", "stance": "neutral", "quote": "on by default in yarn 4 too now", "excerpt": "It\u2019s on by default in yarn 4 too now, but pnpm was the first to market that default minimum gate. https://github.com/yarnpkg/berry/pull/7135", "context": "", "use_case": "", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 773708336, "item_id": 48356771, "url": "https://news.ycombinator.com/item?id=48356771", "by": "dmix", "date": "2026-06-01", "stance": "recommend", "quote": "Our company uses yarn 4 which has an option to prevent you from installing an npm package", "excerpt": "Our company uses yarn 4 which has an option to prevent you from installing an npm package for the first number of days of its release. Most of these seem to be caught within that timeframe (1-3 days). https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104", "context": "works at a company using Yarn 4", "use_case": "Package management", "switched_from": "", "story": "NPM packages from RedHat have been compromised"}, {"id": 772258882, "item_id": 48266180, "url": "https://news.ycombinator.com/item?id=48266180", "by": "cxr", "date": "2026-05-25", "stance": "warn", "quote": "futzing around with with NPM/Yarn", "excerpt": "The submission is about \"Build[ing] Adafruit projects right from Firefox\" with \"no extra tools or complex setup required\". It works by using the esptool-js library, a \"flasher tool for Espressif chips, running in web browser using WebSerial\". Suppose that immediately after reading the title and the copy on the corresponding page, you clicked through to the <https://github.com/espressif/esptool-js/> project to see how", "context": "", "use_case": "", "switched_from": "", "story": "Build Adafruit projects right from Firefox"}, {"id": 770829408, "item_id": 48176838, "url": "https://news.ycombinator.com/item?id=48176838", "by": "DanielHB", "date": "2026-05-18", "stance": "recommend", "quote": "it made for very concise way to represent the logic", "excerpt": "The JS package manager Yarn had an experimental feature to define dependency constraints using prolog, it made for very concise way to represent the logic. https://v3.yarnpkg.com/features/constraints It never got released for good though. I actually had need of such feature for a project but I thought that using an exoteric programming language and an experimental feature was a bit much. I ended up setting up those c", "context": "", "use_case": "dependency constraints", "switched_from": "", "story": "Prolog Coding Horror"}, {"id": 769632401, "item_id": 48102025, "url": "https://news.ycombinator.com/item?id=48102025", "by": "chuckadams", "date": "2026-05-11", "stance": "neutral", "quote": "I ditched npm for yarn years ago", "excerpt": "It is the default in both cargo and npm, but \"npm install\" stupidly enough still updates the lockfile, and you need \"npm ci\" to actually respect it. I think there's some flag to make install work sanely, but long-term I find the best approach is to use anything other than npm. I ditched npm for yarn years ago because it had saner dependency resolution (npm's peer dependency algorithm was a constantly moving target), ", "context": "", "use_case": "", "switched_from": "npm", "story": "TanStack NPM Packages Compromised"}, {"id": 762513522, "item_id": 47657095, "url": "https://news.ycombinator.com/item?id=47657095", "by": "abustamam", "date": "2026-04-05", "stance": "neutral", "quote": "I use yarn or pnpm for monorepos.", "excerpt": "I use bun for everything except for monorepos with isolated deployment targets and shared packages. I use yarn or pnpm for monorepos. Maybe it's changed in the last six months but I could never get docker to properly resolve my dependencies when I only want to build the web app, for example, since the bun lock is deterministic based off of all the packages in the repo so isolating a single leaf makes it error. Maybe ", "context": "", "use_case": "monorepo package management", "switched_from": "", "story": "We replaced Node.js with Bun for 5x throughput"}, {"id": 758642769, "item_id": 47415173, "url": "https://news.ycombinator.com/item?id=47415173", "by": "chrisweekly", "date": "2026-03-17", "stance": "warn", "quote": "Strong recommendation to use PNPM instead of yarn or npm.", "excerpt": "Strong recommendation to use PNPM instead of yarn or npm. IME (webdev since 1998) it's the only sane tool for stewardship of an npm dependency graph. See https://pnpm.io/motivation Also, while popularity isn't necessarily a great indicator of quality, a quick comparison shows that the community has decided on pnpm: https://www.npmcharts.com/compare/pnpm,yarn,npm", "context": "", "use_case": "", "switched_from": "", "story": "Why Node.js needs a virtual file system"}, {"id": 758633760, "item_id": 47414610, "url": "https://news.ycombinator.com/item?id=47414610", "by": "Normal_gaussian", "date": "2026-03-17", "stance": "warn", "quote": "yarn pnp is currently broken on Node v25.7+", "excerpt": "yarn pnp is currently broken on Node v25.7+; - https://github.com/yarnpkg/berry/issues/7065 - https://github.com/nodejs/node/issues/62012 This is because yarn patches fs in order to introduce virtual file path resolution of modules in the yarn cache (which are zips), which is quite brittle and was broken by a seemingly unrelated change in 25.7. The discussion in issue 62012 is notable - it was suggested yarn just wai", "context": "", "use_case": "JavaScript package management", "switched_from": "", "story": "Why Node.js needs a virtual file system"}, {"id": 758626912, "item_id": 47414182, "url": "https://news.ycombinator.com/item?id=47414182", "by": "Dangeranger", "date": "2026-03-17", "stance": "recommend", "quote": "There are alternative package managers like Yarn that use zip files as a way to store each Node package.", "excerpt": "There are alternative package managers like Yarn that use zip files as a way to store each Node package.[0] [0] https://yarnpkg.com/advanced/pnp-spec#zip-access", "context": "", "use_case": "", "switched_from": "", "story": "Why Node.js needs a virtual file system"}, {"id": 758487409, "item_id": 47405463, "url": "https://news.ycombinator.com/item?id=47405463", "by": "johannesrexx", "date": "2026-03-16", "stance": "neutral", "quote": "yarn install   # build it or", "excerpt": "npm install corepack # installs yarn cd ~/Applications git clone https://github.com/katspaugh/ichinichi.git cd ichinichi yarn install # build it or yarn build # build it or production yarn dev # launch it. Now open a web browser to http://localhost:5173/", "context": "", "use_case": "Package manager", "switched_from": "", "story": "Show HN: Ichinichi \u2013 One note per day, E2E encrypted, local-first"}, {"id": 745566480, "item_id": 46597905, "url": "https://news.ycombinator.com/item?id=46597905", "by": "ashishb", "date": "2026-01-12", "stance": "neutral", "quote": "- yarn", "excerpt": "> This looks awesome! Do you have a mental process you run through to determine what gets run in the sandbox, or is it your default mode for all tools? Here's what I use it for right now - yarn - npm - pnpm - mdl - Ruby-based Markdown linter - fastlane - Ruby-based mobile app release tool by Google - Claude Code - Gemini CLI Over time, my goal is to run all CLI-based tools that only need access to the current directo", "context": "", "use_case": "", "switched_from": "", "story": "A deep dive on agent sandboxes"}, {"id": 740255360, "item_id": 46265960, "url": "https://news.ycombinator.com/item?id=46265960", "by": "madeofpalk", "date": "2025-12-14", "stance": "neutral", "quote": "enableScripts: false in .yarnrc.yml", "excerpt": "enableScripts: false in .yarnrc.yml https://yarnpkg.com/configuration/yarnrc#enableScripts And then opt certain packages back in with dependenciesMeta in package.json https://yarnpkg.com/configuration/manifest#dependenciesMeta.built", "context": "", "use_case": "Package management", "switched_from": "", "story": "Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem"}, {"id": 737115168, "item_id": 46069698, "url": "https://news.ycombinator.com/item?id=46069698", "by": "yokto", "date": "2025-11-27", "stance": "neutral", "quote": "Yarn has a configurable npmMinimalAgeGate setting as well since version 4.10", "excerpt": "Yarn has a configurable npmMinimalAgeGate setting as well since version 4.10: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Safe-NPM \u2013 only install packages that are +90 days old"}, {"id": 737100177, "item_id": 46068761, "url": "https://news.ycombinator.com/item?id=46068761", "by": "moritzwarhier", "date": "2025-11-27", "stance": "recommend", "quote": "it's best to use 'npm ci' or 'yarn install --immutable'", "excerpt": "You are right that 'npm install' can upgrade versions even when a lock file is present, but AFAIK this should only happen it the lock file is not compatible with the package.json. I haven't seen it in a long time, and AFAIK it can't happen without you changing the package.json. But yes, it's a reason to pin dependencies and use npm ci / yarn immutable etc. Updates of transitive dependencies are afaik not automaticall", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Safe-NPM \u2013 only install packages that are +90 days old"}, {"id": 736597554, "item_id": 46037347, "url": "https://news.ycombinator.com/item?id=46037347", "by": "ashishb", "date": "2025-11-24", "stance": "warn", "quote": "Run npm and yarn inside docker", "excerpt": "Run npm and yarn inside docker [1]. Infact, do this for all risky tools[2] 1 - https://github.com/ashishb/dotfiles/blob/067de6f90c72f0cf849fb6edcd941b347712ced9/bashrc_includes/custom_aliases.bash#L19-L21 2 - https://ashishb.net/programming/run-tools-inside-docker/", "context": "", "use_case": "", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}]}