PnP (Yarn) support

[DanielRuf]

There is the new Plug'n'Play concept which makes node_modules obsolete:

yarnpkg/rfcs#101

yarnpkg/yarn#6382

https://www.reddit.com/r/node/comments/9fh89w/yarn_plugnplay_getting_rid_of_node_modules/

[DanielRuf]

So it might make sense to define the directory to check or some mapping (like the new pnp file).

[ken-duck]

Heavy. Thanks for the heads up. I'll look into exploring these various options. It will have to wait a little while as I am currently mostly focussed on getting the other OSS clients upgraded (for other languages/ecosystems).
Once I have them upgraded I will be able to revisit the npm client and ensure it works for these alternatives.

[DanielRuf]

For npm, see https://github.com/npm/tink which is a different implementation.

[ken-duck]

Whoa, this one has lingered. Sorry for that. I am looking into implementing a lock file check, which I suspect is one way to deal with this problem. Once that is done I will dig further to see if there are more alternatives that make sense.

[ken-duck]

Release 3.1.1 is out, with support for the yarn.lock file:

auditjs -p yarn.lock

[DarthHater]

I believe this can be closed, and we have yarn support in 4.0.x (see #125 as feedback there would be very useful!)