`yarn install --frozen-lockfile` should be the default behavior
**Do you want to request a *feature* or report a *bug*?** It's a feature-request due to a default behavior that leads to unexpected behavior during: yarn install **What is the current behavior?** On `yarn install` the default behavior is that the yarn.lock file is mutated if `package.json` and `yarn.lock` are out of sync: ``` yarn init yarn add moment npm install --save lodash ``` The `yarn.lock` contains: ``` moment@^2.18.1: version "2.18.1" resolved "https://registry.yarnpkg.com/moment/-/moment-2.18.1.tgz#c36193dd3ce1c2eed2adb7c802dbbc77a81b1c0f" ``` Now if one runs yarn install the `yarn.lock` will be unexpectedly updated with an unknown future version of a dependency, only defined by the range of the provided semvar potentially breaking the build in the future, esp. if run on a build machine (jenkins): ``` $ yarn install v0.27.5 warning ../package.json: No license field [1/4] Resolving packages... [2/4] Fetching packages... [3/4] Linking dependencies... [4/4] Building fresh packages... success Saved lockfile. Done in 0.53s. ``` The `yarn.lock` now contains the following *on the build machine*, yet the version of `lodash` is not locked in and prone to change in the future: ``` lodash@^4.17.4: version "4.17.4" resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.4.tgz#78203a4d1c328ae1d86dca6460e369b57f4055ae" moment@^2.18.1: version "2.18.1" resolved "https://registry.yarnpkg.com/moment/-/moment-2.18.1.tgz#c36193dd3ce1c2eed2adb7c802d
Posted by k0pernikus on Aug 11, 2017, 8:43 AM
Tags
Related issues
Raise real-world problems, find people facing the same issue, and discuss solutions.4,500 issues0 comments
onboarding (Marketing)
> Keep in mind the typical user doesn't care enough to go install any ad blocker I hate that you are right about this :-) It really hit...
Moving from Node to Bun spikes container CPU and memory usage until it crashes
`yarn install --frozen-lockfile` should be the default behavior
`yarn install --frozen-lockfile` should be the default behavior
**Do you want to request a *feature* or report a *bug*?** It's a feature-request due to a default behavior that leads to unexpected behavior during: yarn install **What is the current behavior?** On `yarn install` the default behavior is that the yarn.lock file is mutated if `package.json` and `yarn.lock` are out of sync: ``` yarn init yarn add moment npm install --save lodash ``` The `yarn.lock` contains: ``` moment@^2.18.1: version "2.18.1" resolved "https://registry.yarnpkg.com/moment/-/moment-2.18.1.tgz#c36193dd3ce1c2eed2adb7c802dbbc77a81b1c0f" ``` Now if one runs yarn install the `yarn.lock` will be unexpectedly updated with an unknown future version of a dependency, only defined by the range of the provided semvar potentially breaking the build in the future, esp. if run on a build machine (jenkins): ``` $ yarn install v0.27.5 warning ../package.json: No license field [1/4] Resolving packages... [2/4] Fetching packages... [3/4] Linking dependencies... [4/4] Building fresh packages... success Saved lockfile. Done in 0.53s. ``` The `yarn.lock` now contains the following *on the build machine*, yet the version of `lodash` is not locked in and prone to change in the future: ``` lodash@^4.17.4: version "4.17.4" resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.4.tgz#78203a4d1c328ae1d86dca6460e369b57f4055ae" moment@^2.18.1: version "2.18.1" resolved "https://registry.yarnpkg.com/moment/-/moment-2.18.1.tgz#c36193dd3ce1c2eed2adb7c802d
Comments (0)
No comments yet. Start the discussion.