RFC: Change package manager to npm

[jurekbarth]

I would like to propose the change from yarn to npm package manager.

I would like to do so, because of npm audit and because it feels more "native".

What do you think about it?

[SheepFromHeaven]

For me that's the case already. I just use npm. I think we should allow developers to use yarn or npm, we just should exclude the yarn.lock from the project to keep it clean.

…

On Wed, Dec 5, 2018, 07:41 Jurek Barth ***@***.***> wrote: I would like to propose the change from yarn to npm package manager. I would like to do so, because of npm audit and because it feels more "native". What do you think about it? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#20>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AITF7tH0QsmcF36Rfqd74tuIpmzi8uGRks5u12qugaJpZM4ZCGeC> .

[timomayer]

why remove it? we should keep commiting lock files to have reproducable behaviours, in our projects.
I like yarn more, but it is ok for me to switch back to npm feature wise it makes no difference we did the move to yarn before npm had the lock file feature

[SheepFromHeaven]

@timomayer the problem is, that we need to update the yarn.lock file manually after each install of automatically before every push. This takes quite a time. In addition to that we should enforce NPM because of the audit feature. So we make sure no malicious packages get installed.

[timomayer]

@SheepFromHeaven ok the audit feature is a reason to switch back, i agree.

[timomayer]

@dannystey maybe you can look into that as well when you are doing the 2 bugfixes?

[dannystey]

@SheepFromHeaven @timomayer the audit feature isnt a reason to switch back anymore, as yarn has the audit feature since 1.12.0, but i would also prefer that the developer has the chance to decide if he/she likes to use yarn or npm. yarn imports the package-json.lock since version 1.7.0, so there is no need to have a yarn.lock in the repository.

[timomayer]

Done