Yarn

Yarn is the standard JavaScript package manager for all projects.

• Why Yarn over npm
• Installing Yarn
  • Node
  • Corepack
  • Hardening
• Setting up Yarn in a project
  • Prerequisites
  • Configuring Yarn
  • Verifying the version
  • Version control
• Common commands

Why Yarn over npm

• Pinned versions per project. The packageManager field in package.json locks every contributor and CI pipeline to the exact same Yarn version, eliminating discrepancies caused by differing package manager versions across machines.
• Deterministic installs. yarn.lock ensures the full dependency tree is resolved consistently on every install.
• Consistent tooling. Using one package manager across all projects reduces friction when switching between them.

Installing Yarn

Node

Laravel Herd installs nvm and the latest version of Node for you.

Corepack

Corepack ships with Node.js 16.9 and later. It manages package manager versions per project, so Yarn does not need to be installed globally.

Corepack only needs to be enabled once:

corepack enable

This registers shims for yarn and pnpm that delegate to whichever version is declared in the project's package.json.

WARNING

If you are using multiple Node versions via nvm, corepack enable must be run once for each version.

Hardening

To mitigate against supply chain attacks, it is recommended to configure the npmMinimalAgeGate and enableScripts settings:

yarn config set --home npmMinimalAgeGate 4320 # 3 days
yarn config set --home enableScripts false

Setting up Yarn in a project

Prerequisites

If an .nvmrc file already exists, run nvm use to switch to the correct version of Node. Otherwise create the .nvmrc file based on the active major version of Node:

nvm current | sed 's/^v//;s/\..*//' > .nvmrc

If a package.json file does not yet exist, run yarn init to create it.

Configuring Yarn

Run the following:

corepack use yarn@stable

This sets the packageManager field in package.json to the latest stable Yarn 4 release and downloads it.

Create or update .yarnrc.yml to set the node linker:

nodeLinker: node-modules

As a 'belt and braces' measure in case the machine-wide defaults above have not been set, configure the same hardening settings for the project:

yarn config set npmMinimalAgeGate 4320 # 3 days
yarn config set enableScripts false

Verifying the version

yarn --version

The output should be 4.x.x. A 1.x.x result means the project is still using Yarn Classic, which is in maintenance mode and should be upgraded.

Version control

Commit the following Yarn-generated files:

• package.json – includes the packageManager declaration
• yarn.lock – ensures reproducible installs
• .yarnrc.yml – Yarn Berry configuration

Add the following to .gitignore:

node_modules/
.yarn/*
!.yarn/patches
!.yarn/plugins
!.yarn/releases
!.yarn/sdks
!.yarn/versions

.yarn/cache/ holds downloaded packages and .yarn/install-state.gz is a local optimisation file – neither should be committed.

Common commands

Command	Description
yarn	Install all dependencies
yarn add <package>	Add a runtime dependency
yarn add -D <package>	Add a dev dependency
yarn remove <package>	Remove a dependency
yarn dlx <package>	Run a one-off package without installing it (equivalent to npx)
yarn run <script>	Run a script defined in package.json