Package Manager Operations

Day-to-day use of npm, Yarn, pnpm, Bun and Composer: which one a repo uses, which install command belongs in dev, CI and deploy, how to pin Node and PHP so every machine agrees, how to run packages without fetching strangers' code, and how to get off the legacy tools. Written for server-rendered sites (Craft CMS, Laravel, WordPress) on DDEV with a Vite or Laravel Mix build, where these mistakes are common: two lockfiles, unpinned Node, no require.php, end-of-life PHP and npx in READMEs.

Facts verified as of 2026-10-06 against docs.npmjs.com, yarnpkg.com, pnpm.io, bun.com, getcomposer.org (checked against the 2.10.3 tag), nodejs.org, php.net and docs.ddev.com. Current majors: npm 12 (since 2026-07-08; Node 24 and 26 still bundle npm 11), pnpm 12, Yarn 4, Composer 2 (2.10.3), Bun 1. Each reference cites its sources. For a version-sensitive answer, read assets/package-manager-facts.json and re-check upstream when this date is stale; keeping it current (scripts/check-pm-facts.py) is in version-pinning.md.

Start here