Migration from yarn-classic to npm

[sbernard31]

This issue aim to track work on migration from yarn-classic to modern yarn

(Spoiler : we finally decide to go with npm)

This is part of #1492.

[sbernard31]

I begin to read some documentation about that and I understand that :

1. Modern Yarn version need corepack enable and corepack seems to be experimental at this day and also corepack is not yet available in debian stable repository (see also debian@bug980316)

2. Not sure if this will really work well with frontend-maven-plugin : Support of Modern Yarn (Yarn 2+) eirslett/frontend-maven-plugin#1126

So maybe too soon to make that move ? 🤔

[sbernard31]

Looking at #1566, I came to the conclusion that probably the right way is to create standard SBOM (e.g. CycloneDX)
But it seems there is not dedicated yarn tool while it exists npm one (see yarnpkg/berry#6063)

And benefits to use yarn on small project like our demos doesn't maybe worth drawbacks : https://blog.logrocket.com/javascript-package-managers-compared/

So maybe we should consider to switch to npm instead of migrate to modern yarn ?

[sbernard31]

I tested to migrate from yarn to npm in #1573. That sounds easy.

[sbernard31]

Looking at #1566, I came to the conclusion that probably the right way is to create standard SBOM (e.g. CycloneDX)
But it seems there is not dedicated yarn tool while it exists npm one (see yarnpkg/berry#6063)

There is now tooling for yarn to generate SBOM but only for modern yarn. (>v3 is required) : https://github.com/CycloneDX/cyclonedx-node-yarn

[sbernard31]

I will try to move forward on this.
I think the simple solution is to move to npm for reason express above.

[sbernard31]

Some reason to finally use npm :

• simple to setup : only need to download nodejs while for yarn you need to nodejs+yarn
• no so much difference now (https://blog.logrocket.com/javascript-package-managers-compared/)
• servers demo are simple project, let's try to keep it simple.
• no so easy to use a recent version of yarn. (Migration from yarn-classic to npm #1550 (comment))

[sbernard31]

This is done with :

• Move from Yarn to Npm #1672
• Use cyclonedx-npm to generate SBOM directly in maven.  #1573

[sbernard31]

This is done.
Now we use a recent npm version.