Migration from `yarn-classic` to `npm`

[sbernard31]

This issue aim to track work on migration from yarn-classic to modern yarn

(Spoiler : we finally decide to go with npm)

This is part of https://github.com/eclipse-leshan/leshan/issues/1492.

[sbernard31]

I begin to read some documentation about that and I understand that :

1. Modern Yarn version need corepack enable and corepack seems to be experimental at this day and also corepack is not yet available in debian stable repository (see also debian@bug980316)

2. Not sure if this will really work well with frontend-maven-plugin : https://github.com/eirslett/frontend-maven-plugin/issues/1126

So maybe too soon to make that move ? :thinking:

[sbernard31]

Looking at #1566, I came to the conclusion that probably the right way is to create standard SBOM (e.g. CycloneDX) But it seems there is not dedicated yarn tool while it exists npm one (see https://github.com/yarnpkg/berry/discussions/6063)

And benefits to use yarn on small project like our demos doesn't maybe worth drawbacks : https://blog.logrocket.com/javascript-package-managers-compared/

So maybe we should consider to switch to npm instead of migrate to modern yarn ?

[sbernard31]

I tested to migrate from yarn to npm in https://github.com/eclipse-leshan/leshan/pull/1573. That sounds easy.

[sbernard31]

Looking at https://github.com/eclipse-leshan/leshan/issues/1566, I came to the conclusion that probably the right way is to create standard SBOM (e.g. CycloneDX) But it seems there is not dedicated yarn tool while it exists npm one (see https://github.com/yarnpkg/berry/discussions/6063)

There is now tooling for yarn to generate SBOM but only for modern yarn. (>v3 is required) : https://github.com/CycloneDX/cyclonedx-node-yarn

[sbernard31]

I will try to move forward on this. I think the simple solution is to move to npm for reason express above.

[sbernard31]

Some reason to finally use npm :

• simple to setup : only need to download nodejs while for yarn you need to nodejs+yarn
• no so much difference now (https://blog.logrocket.com/javascript-package-managers-compared/)
• servers demo are simple project, let's try to keep it simple.
• no so easy to use a recent version of yarn. (https://github.com/eclipse-leshan/leshan/issues/1550#issuecomment-1829600779)

[sbernard31]

This is done with :

• https://github.com/eclipse-leshan/leshan/pull/1672
• https://github.com/eclipse-leshan/leshan/pull/1573