Package Manager Commands
Compare the commands of npm, pnpm, Yarn, Bun, Composer, uv and pip side by side: CI installs, adding and removing dependencies, updates, audits, running scripts and binaries, and lock files.
Free · No sign-up · Your inputs stay in your browser
Input
npm, pnpm, Yarn, Bun, Composer and uv commands side by side
Output
npm to pnpm
| Task | npm | pnpm |
|---|---|---|
| Install from the lock file (CI) | npm ci | pnpm install --frozen-lockfile |
| Install everything | npm install | pnpm install |
| Add a dependency | npm install zod | pnpm add zod |
| Add a dev dependency | npm install -D vitest | pnpm add -D vitest |
| Remove a dependency | npm uninstall zod | pnpm remove zod |
| Update within ranges | npm update | pnpm update |
| List outdated | npm outdated | pnpm outdated |
| Why is this installed? | npm explain lodash | pnpm why lodash |
| Security audit | npm audit | pnpm audit |
| Run a script | npm run build | pnpm build |
| Run a package binary once | npx cowsay hi | pnpm dlx cowsay hi |
| Global install | npm install -g pkg | pnpm add -g pkg |
| Lock file | package-lock.json | pnpm-lock.yaml |
Yarn here is Yarn 4 (Berry); Yarn 1 commands are closer to npm's. The CI row matters most: an install that may rewrite the lock file in CI means the build can run different code from the one that was reviewed. Commit the lock file of whichever tool you use, and only one of them.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The CI install matters most
npm ci, pnpm install --frozen-lockfile, yarn install --immutable and composer install fail if the lock file and manifest disagree instead of quietly updating the lock file. That guarantees the build installs exactly what was reviewed. The npm ci documentation describes the behaviour.
One tool per project
Lock files of different managers do not agree, and two in one repository means two dependency trees. Pick one, commit its lock file and set packageManager in package.json so Corepack enforces the choice.