For deterministic dependency installation

What is Corepack
Section titled: What is CorepackCorepack is a package manager, manager.
- The purpose of a package manager is to ensure that everyone installs exactly the same version of a projects dependencies.
- But that is not guaranteed if different people are using different versions of the same package manager.
- A package manager manager then ensures that everyone installs exactly the same version of that package manager, ensuring that your project installs are always deterministic.
- Different versions of a package manager can result in different versions of dependencies getting installed and cause lock file versioning issues
Similar to how nvm/fnm lets you have multiple versions of node installed simultaneously, Corepack lets you have multiple versions of npm/pnpm/yarn installed.
Install Corepack on your machine
Section titled: Install Corepack on your machineFirst uninstall existing package managers
Section titled: First uninstall existing package managersFirst uninstall your global yarn
and pnpm
binaries (just leave npm).
How you do this will differ depending on how you installed them in the first place. These two commands are a good place to start:
npm uninstall -g yarn pnpmbrew uninstall yarn
Now check if there are still other versions installed:
which pnpm # we want: "pnpm not found"which yarn # we want: "yarn not found"
If which
outputs “not found”, then you’re good to go. If it outputs a file path, then that’s where the binary that you still have to remove lives.
If you don’t know how to uninstall it based on the path, then you can always just rm -rf
the directory that which
output.
Now install the latest version of Corepack
Section titled: Now install the latest version of Corepacknpm i -g corepack@latestcorepack enable
Now go into any project and try to use the appropriate package manager, you’ll see something like the following:
pnpm -v! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-9.15.2.tgz? Do you want to continue? [Y/n]
Hit y
or enter Corepack will automatically download and start using the specified version of that package manager. If the project doesn’t specify a package manager version (boo 👎) then it will default to a known good version; but continue reading the next section to see how to fix that.
Using Corepack in your project
Section titled: Using Corepack in your projectTo specify a particular package manager version in your project, you’ll want to run the corepack use
command:
corepack use pnpmcorepack use yarn@1corepack use npm@latest
This will add a packageManager
field at the bottom of the package.json
:
"packageManager": "pnpm@10.15.0+sha512.486ebc259d3e999a4e8691ce03b5cac4a71cbeca39372a9b762cb500cfdf0873e2cb16abe3d951b1ee2cf012503f027b98b6584e4df22524e0c7450d9ec7aa7b"
This accomplishes two things for all other developers with Corepack enabled:
- Running
pnpm install
will automatically download and use pnpm version 10.15.0, ensuring deterministic project installs - Trying to use any other package manager to install dependencies will result in an error:
This project is configured to use pnpm because /my-project/package.json has a "packageManager" field
Troubleshooting
Section titled: TroubleshootingNode version 16
Section titled: Node version 16➜ corepack install
Type Error: URL.canParse is not a function
Node 16 comes preinstalled with one of corepack 0.10, 0.11, or 0.12. All three of those versions of corepack predate the corepack use
command, so they operate significantly different than the modern version.
But using the latest of Corepack version relies on the URL.canParse()
method which was introduced in Node.js version 19.9.0 and backported 18.17.0.
This creates a catch-22 where you can’t use the Node 16 (no corepack use) or the Node 24 (url parse error) version of Corepack to get a packageManager
field added to your package.json.
I’ve found two solutions to this problem:
- Manually specify the
packageManager
field, without the optional hash."packageManager": "yarn@1.22.22" - Use corepack v0.20.0;
npm i -g corepack@0.20.0
. I’ve found that this version specifically straddles the line where it doesn’t useURL.canParse()
but does have thecorepack use
command.