npmpackage.info

Gathering detailed insights and metrics for @yoitsro/lerna-bootstrap

@yoitsro/lerna-bootstrap - 3.5.1 | npmpackage.info

@yoitsro/lerna-bootstrap

Lerna is a fast, modern build system for managing and publishing multiple JavaScript/TypeScript packages from the same repository.

3.5.1

35,972

MIT

TypeScript

39.22 kB

4.4

Installations

npm install @yoitsro/lerna-bootstrap

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

>= 6.9.0

Node Version

10.13.0

NPM Version

6.4.1 Pull Requests

Open

5

Total

1,400

Closed

408

Merged

987

Issues

Open

392

Total

2,667

Closed

2,275

Releases

243

v8.2.3

Updated on Jun 29, 2025

v8.2.2

Updated on Apr 10, 2025

v8.2.1

Updated on Mar 03, 2025

v8.2.0

Updated on Feb 19, 2025

v8.1.9

Updated on Oct 31, 2024

v8.1.8

Updated on Aug 05, 2024

View All 243 releases

Languages

TypeScript

JavaScript

Shell

CSS

Batchfile

TypeScript (95.89%)

JavaScript (3.1%)

Shell (0.5%)

CSS (0.5%)

Batchfile (0.01%)

Developer

lerna

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

35,972 Stars

2,816 Commits

2,276 Forks

251 Watchers

33 Branches

338 Contributors

Updated on Jul 10, 2025

Maintainers

View All 338 Contributors

Package Meta Information

Latest Version

3.5.1

Package Id

@yoitsro/lerna-bootstrap@3.5.1

Unpacked Size

39.22 kB

Size

11.53 kB

File Count

NPM Version

6.4.1

Node Version

10.13.0

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

`@lerna/bootstrap`

Link local packages together and install remaining package dependencies

Usage

1$ lerna bootstrap

Bootstrap the packages in the current Lerna repo. Installs all of their dependencies and links any cross-dependencies.

When run, this command will:

npm install all external dependencies of each package.
Symlink together all Lerna packages that are dependencies of each other.
npm run prepublish in all bootstrapped packages.
npm run prepare in all bootstrapped packages.

lerna bootstrap respects the --ignore, --ignore-scripts, --scope and --include-filtered-dependencies flags (see Filter Flags).

Pass extra arguments to npm client by placing them after --:

1$ lerna bootstrap -- --production --no-optional

May also be configured in lerna.json:

1{
2  ...
3  "npmClient": "yarn",
4  "npmClientArgs": ["--production", "--no-optional"]
5}

--hoist [glob]

Install external dependencies matching glob at the repo root so they're available to all packages. Any binaries from these dependencies will be linked into dependent package node_modules/.bin/ directories so they're available for npm scripts. If the option is present but no glob is given the default is ** (hoist everything). This option only affects the bootstrap command.

1$ lerna bootstrap --hoist

For background on --hoist, see the hoist documentation.

Note: If packages depend on different versions of an external dependency, the most commonly used version will be hoisted, and a warning will be emitted.

--nohoist [glob]

Do not install external dependencies matching glob at the repo root. This can be used to opt out of hoisting for certain dependencies.

1$ lerna bootstrap --hoist --nohoist=babel-*

--ignore

1$ lerna bootstrap --ignore component-*

The --ignore flag, when used with the bootstrap command, can also be set in lerna.json under the command.bootstrap.ignore key. The command-line flag will take precedence over this option.

Example

1{
2  "version": "0.0.0",
3  "command": {
4    "bootstrap": {
5      "ignore": "component-*"
6    }
7  }
8}

Hint: The glob is matched against the package name defined in package.json, not the directory name the package lives in.

Options

`--ignore-scripts`

Skip any lifecycle scripts normally run (prepare, etc) in bootstrapped packages.

1$ lerna bootstrap --ignore-scripts

`--registry <url>`

When run with this flag, forwarded npm commands will use the specified registry for your package(s).

This is useful if you do not want to explicitly set up your registry configuration in all of your package.json files individually when e.g. using private registries.

`--npm-client <client>`

Must be an executable that knows how to install npm package dependencies. The default --npm-client is npm.

1$ lerna bootstrap --npm-client=yarn

May also be configured in lerna.json:

1{
2  ...
3  "npmClient": "yarn"
4}

`--use-workspaces`

Enables integration with Yarn Workspaces (available since yarn@0.27+). The values in the array are the commands in which Lerna will delegate operation to Yarn (currently only bootstrapping). If --use-workspaces is true then packages will be overridden by the value from package.json/workspaces. May also be configured in lerna.json:

1{
2  ...
3  "npmClient": "yarn",
4  "useWorkspaces": true
5}

The root-level package.json must also include a workspaces array:

1{
2  "private": true,
3  "devDependencies": {
4    "lerna": "^2.2.0"
5  },
6  "workspaces": ["packages/*"]
7}

This list is broadly similar to lerna's packages config (a list of globs matching directories with a package.json), except it does not support recursive globs ("**", a.k.a. "globstars").

`--no-ci`

When using the default --npm-client, lerna bootstrap will call npm ci instead of npm install in CI environments. To disable this behavior, pass --no-ci:

1$ lerna bootstrap --no-ci

To force it during a local install (where it is not automatically enabled), pass --ci:

1$ lerna bootstrap --ci

This can be useful for "clean" re-installs, or initial installations after fresh cloning.

How It Works

Let's use babel as an example.

babel-generator and source-map (among others) are dependencies of babel-core.
babel-core's package.json lists both these packages as keys in dependencies, as shown below.

1// babel-core package.json
2{
3  "name": "babel-core",
4  ...
5  "dependencies": {
6    ...
7    "babel-generator": "^6.9.0",
8    ...
9    "source-map": "^0.5.0"
10  }
11}

Lerna checks if each dependency is also part of the Lerna repo.
- In this example, babel-generator can be an internal dependency, while source-map is always an external dependency.
- The version of babel-generator in the package.json of babel-core is satisfied by packages/babel-generator, passing for an internal dependency.
- source-map is npm installed (or yarned) like normal.
packages/babel-core/node_modules/babel-generator symlinks to packages/babel-generator
This allows nested directory imports

Notes

When a dependency version in a package is not satisfied by a package of the same name in the repo, it will be npm installed (or yarned) like normal.
Dist-tags, like latest, do not satisfy semver ranges.
Circular dependencies result in circular symlinks which may impact your editor/IDE.

Webstorm locks up when circular symlinks are present. To prevent this, add node_modules to the list of ignored files and folders in Preferences | Editor | File Types | Ignored files and folders.

No vulnerabilities found.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

5

Maintained

Determines if the project is "actively maintained".

5

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

5

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

2

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 2

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:173: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:198: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:203: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:129: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/claude.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/claude.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/claude.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/claude.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/other-node-versions.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/other-node-versions.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/other-node-versions.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/other-node-versions.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/other-node-versions.yml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/other-node-versions.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/website-deploy.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/lerna/lerna/website-deploy.yml/main?enable=pin
Warn: npmCommand not pinned by hash: tools/scripts/build.sh:20
Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 6 third-party GitHubAction dependencies pinned
Info: 3 out of 4 npmCommand dependencies pinned

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

Score

4.4

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More