What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To find out why a package is in your Yarn dependency tree, use yarn why <package> in Yarn Classic (Yarn 1). Don’t search yarn.lock with sed and try to work it out by hand. The lockfile is generated, structured resolution data. sed can print lines from it, but it doesn’t resolve which package requested what, so it can’t explain why an entry exists. This article covers where that line falls, which command belongs to which Yarn generation, and how to keep installs from quietly rewriting the lockfile.
What sed can and can’t do with yarn.lock
Yarn Classic’s documentation describes yarn.lock as auto-generated and says it should be handled entirely by Yarn. It records the exact package versions needed for the dependency tree and sits at the project root. Yarn updates it when dependencies are added, upgraded, or removed, and the Classic page advises against editing it directly.
As an Amazon Associate I earn from qualifying purchases.
A Classic entry looks like this:
lodash@^4.17.20, lodash@^4.17.21: version "4.17.21" resolved "..." integrity sha512-...
Running sed -n '/^lodash@/,/^$/p' yarn.lock prints that block. It does not tell you whether the range came from your package.json or from another package’s dependencies, and it does not explain why that version won. Matching text is also ambiguous: a range line can match more than one entry, and nested dependency lines inside other entries mention lodash too. Rebuilding the relationships from those lines means writing a parser that understands the file’s structure, which is exactly what Yarn already does.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThat is the distinction behind the title. sed is not wrong to use for inspection or for extracting a snippet. It just isn’t the tool for asking Yarn which dependency relationship produced an entry.
Ask the package question with yarn why (Yarn Classic)
In Yarn Classic, the package-level question has a documented command:
yarn why lodash
According to the Classic yarn why reference, the command explains why a package was installed. It reports which packages depend on it, or whether it was explicitly specified in package.json. The official usage form is yarn why <query>, and the examples in the Classic reference use package names.
Read the output in two cases:
- Explicitly listed. If the package appears in your
package.json, the answer points to a direct dependency. To change it, edit the manifest withyarn add,yarn upgrade, oryarn remove. - Pulled in by others. If it’s transitive, the dependents shown are the packages you need to look at. Trace upward from there until you reach a direct dependency.
The Classic reference describes package-level explanation, not graph rendering. Don’t expect a complete visual tree from this command. If you need the whole tree, that’s a separate task, and the Classic reference doesn’t document a full-graph output format.
Keep the lockfile stable during installs
Stability depends on which generation of Yarn your project uses. The two generations have different settings, so check first.
Rank #3
Yarn Classic (Yarn 1)
- Commit
yarn.lockat the project root. Don’t hand-edit it. - Plain install reuses the lockfile. When the lockfile satisfies
package.json,yarn installinstalls the recorded versions instead of checking for newer ones. - Use the frozen flag in CI. Run
yarn install --frozen-lockfile. If the install would need to update the lockfile, the command fails and does not write a new one. - Change dependencies through Yarn. Use
yarn add,yarn upgrade, oryarn remove, which update the lockfile as part of the change.
Current Yarn (Berry)
- Set
enableImmutableInstallsin.yarnrc.yml. When enabled, Yarn refuses to change lockfile entries. The Yarn settings reference documents a default of true on CI. - Treat it as configuration, not a flag.
enableImmutableInstallsis a key in the current configuration file. Don’t substitute Classic’s--frozen-lockfileand expect the same behavior. - Understand how resolution works. Yarn’s architecture documentation describes resolution as loading existing lockfile entries, comparing them with project manifests, and resolving entries that are missing. The lockfile is an input to that process, not a standalone record independent of
package.json.
enableImmutableInstalls: true
Which generation are you on?
Run yarn --version. A 1.x result means Yarn Classic. Version 2 or later means the current generation, which the Yarn documentation refers to as Berry in its configuration and architecture pages.
| Question | Yarn Classic (Yarn 1) | Current Yarn (Berry) |
|---|---|---|
| Stop CI from changing the lockfile | yarn install --frozen-lockfile (command-line flag) |
enableImmutableInstalls in .yarnrc.yml; documented default true on CI |
| Why is this package installed? | yarn why <package> reports dependents or an explicit entry in package.json |
Not stated in the current settings or architecture references this article relies on |
| Behavior when the lockfile must change | Frozen install fails and writes no lockfile | Yarn refuses to change lockfile entries while immutable installs are enabled |
| Who maintains the file | Yarn only; edit through yarn add, yarn upgrade, yarn remove |
Yarn only; the lockfile is resolved against manifests on each install |
Don’t mix the two sets of commands in one project. If your repository uses Classic, its CI and documentation should use the Classic flags. If it uses current Yarn, use the configuration key.
When a frozen install fails
A failed frozen install usually means package.json changed without a matching lockfile update. Fix it in this order:
- Run
yarn --versionto confirm which generation the project uses. - Reproduce the failure locally with a normal install. In Classic, run
yarn installwithout--frozen-lockfile. In current Yarn, temporarily disableenableImmutableInstallsfor that one local run, then turn it back on. - Review the change with
git diff yarn.lock. Check whether the entries that moved are the ones you intended to change. - For any unexpected package that moved, run
yarn why <package>(Classic) to find its dependents before accepting the change. - Commit the updated lockfile with the manifest change, then rerun CI with the frozen or immutable setting.
What the lockfile does not tell you
- It is not a security guarantee. A lockfile records which versions were resolved. Its presence doesn’t show that those versions are free of vulnerabilities. Check them with your usual vulnerability scanning.
- It doesn’t render a graph. Neither the Classic
yarn whyreference nor the current architecture documentation describes a visual dependency graph. - It doesn’t describe your project’s installs. The behavior above comes from official Yarn documentation. Confirm it against your own repository’s
yarn.lock, Yarn version, and CI configuration.
The Yarn Classic pages cited here are the official yarn.lock, yarn install, and yarn why references. The current behavior is from the official Yarn settings and architecture pages.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
