About this project

Yarn 1.x is a package manager for JavaScript projects, described in its README as fast, reliable, and secure dependency management. This repository holds the sources for the 1.x line (latest version at the time of writing being 1.22) and is explicitly frozen: new features and bugfixes now happen in the yarnpkg/berry repository, while this one is kept mostly for historical purposes and occasional hotfixes to ease migration from 1.x to later releases. Key capabilities documented in the README: - Caching: every downloaded package is cached, so the same package never needs to be downloaded again. - Concurrency: most operations run concurrently to maximize resource utilization, which the project says results in faster installs. - Deterministic installs: a detailed but concise lockfile format plus a deterministic install algorithm aim to guarantee that an installation working on one system works the same on another, regardless of installation order. - Integrity checks: checksums are used to verify every installed package before its code is executed. - Offline mode: previously installed packages can be installed again without an internet connection. - Network performance and resilience: requests are queued efficiently to avoid request waterfalls, and a single failed request does not fail the whole installation because requests are automatically retried. - Flat mode: mismatched dependency versions are resolved to a single version to avoid duplicates. Installation and usage instructions are not included in the README itself; it points to the Installation Guide and Usage Guide on the yarnpkg.com website. The README also notes that the 1.x codebase is fairly old and will only accept security fixes, recommending migration to the latest release, where the nodeLinker setting allows choosing between node_modules (like npm), symlinks (like pnpm), or manifest files via Yarn PnP. Prior art is credited to Bundler, Cargo, and npm, and the README thanks Sam Holmes for donating the npm package name. Sponsorship sections mention Doppler and WorkOS.