Semantic Versioning is a formal specification for how version numbers are assigned and incremented. It exists because version numbers without a shared meaning are useless for dependency management: a consumer cannot look at 2.4.1 and know whether upgrading to 2.5.0 is safe, or whether 3.0.0 will break their code. SemVer solves this by tying each…
The previous chapters established how pnpm links packages from a global store and constructs a virtual store. This chapter explains the consequence: a strictly isolated node_modules layout that forbids access to undeclared dependencies. npm and Yarn Classic hoist packages to the root, allowing a project to import anything in the tree. pnpm’s default behavior is…
A project’s package.json is not just a dependency manifest. It is also a command registry. The scripts field defines named commands that can be invoked with a short alias, and Yarn provides a resolution layer that decides whether a given name refers to a script, a taskfile, or a binary from a dependency. In Yarn…
The two files serve opposite purposes in the same dependency system. package.json is the manifest: it declares the project’s metadata, scripts, and the ranges of acceptable dependency versions. package-lock.json is the resolution: it records the exact version of every package that was actually installed, including transitive dependencies that package.json never mentions. The distinction matters because…
A project’s package.json is both a manifest and a command registry. The scripts field defines named commands that can be invoked with a short alias, and pnpm provides a resolution layer that decides whether a given name refers to a script, a taskfile, or a binary from a dependency. In pnpm, the run keyword is…
A monorepo stores multiple packages in a single repository. Yarn Workspaces is the mechanism that makes this practical: it installs all packages’ dependencies together, links packages to each other without publishing to a registry, and provides commands to run scripts across the entire project. In Yarn Berry (2+), the feature set expands significantly with the…
npm installs packages in two locations, and the flag determines which one. A local install, the default, places the package in the node_modules folder of the current project and records it in package.json. A global install, triggered by -g or –global, places the package in a system-wide location (/usr/local/lib/node_modules on most Unix systems) and makes…
A monorepo stores multiple packages in a single repository. pnpm Workspaces is the mechanism that makes this practical: it installs all packages’ dependencies together into a single virtual store, links packages to each other without publishing to a registry, and provides commands to run scripts across the entire project. The architecture is defined by a…
Every package manager before Yarn PnP relied on the same fundamental mechanism: placing files into a node_modules directory and letting Node.js walk up the directory tree to find them. Yarn Plug’n’Play discards this model entirely. Instead of copying packages into a folder tree, PnP generates a single loader file—.pnp.cjs—that contains a complete map of the…
npx is the command that resolves the tension between local and global installation. It runs a package’s binary without requiring a permanent install, checking first in the local node_modules/.bin, then in the npm cache, and downloading temporarily only if the binary is not found anywhere . The command ships with npm since version 5.2.0, so…