What is the fundamental difference between
npm? Just want something plain and simple. I’ve seen some of my colleagues use
npm interchangeably in their projects.
Bower is created solely for the front-end and is optimized with that in mind. The biggest difference is that npm does nested dependency tree (size heavy) while Bower requires a flat dependency tree (puts the burden of dependency resolution on the user).
A nested dependency tree means that your dependencies can have their own dependencies which can have their own, and so on. This is really great on the server where you don’t have to care much about space and latency. It lets you not have to care about dependency conflicts as all your dependencies use e.g. their own version of Underscore. This obviously doesn’t work that well on the front-end. Imagine a site having to download three copies of jQuery.
The reason many projects use both is that they use Bower for front-end packages and npm for developer tools like Yeoman, Grunt, Gulp, JSHint, CoffeeScript, etc.
All package managers have many downsides. You just have to pick which you can live with.
- Nested Dependencies – Insight into why node_modules works the way it does
This answer is an addition to the answer of Sindre Sorhus. The major difference between npm and Bower is the way they treat recursive dependencies. Note that they can be used together in a single project.
On the npm FAQ:
It is much harder to avoid dependency conflicts without nesting
dependencies. This is fundamental to the way that npm works, and has
proven to be an extremely successful approach.
On Bower homepage:
Bower is optimized for the front-end. Bower uses a flat dependency
tree, requiring only one version for each package, reducing page load
to a minimum.
In short, npm aims for stability. Bower aims for minimal resource load. If you draw out the dependency structure, you will see this:
project root [node_modules] // default directory for dependencies -> dependency A -> dependency B [node_modules] -> dependency A -> dependency C [node_modules] -> dependency B [node_modules] -> dependency A -> dependency D
As you can see it installs some dependencies recursively. Dependency A has three installed instances!
project root [bower_components] // default directory for dependencies -> dependency A -> dependency B // needs A -> dependency C // needs B and D -> dependency D
Here you see that all unique dependencies are on the same level.
So, why bother using npm?
Maybe dependency B requires a different version of dependency A than dependency C. npm installs both versions of this dependency so it will work anyway, but Bower will give you a conflict because it does not like duplication (because loading the same resource on a webpage is very inefficient and costly, also it can give some serious errors). You will have to manually pick which version you want to install. This can have the effect that one of the dependencies will break, but that is something that you will need to fix anyway.
So, the common usage is Bower for the packages that you want to publish on your webpages (e.g. runtime, where you avoid duplication), and use npm for other stuff, like testing, building, optimizing, checking, etc. (e.g. development time, where duplication is of less concern).
Update for npm 3:
npm 3 still does things differently compared to Bower. It will install the dependencies globally, but only for the first version it encounters. The other versions are installed in the tree (the parent module, then node_modules).
- dep A v1.0
- dep B v1.0
dep A v1.0(uses root version)
- dep C v1.0
- dep A v2.0 (this version is different from the root version, so it will be an nested installation)
For more information, I suggest reading the docs of npm 3
TL;DR: The biggest difference in everyday use isn’t nested dependencies… it’s the difference between modules and globals.
I think the previous posters have covered well some of the basic distinctions. (npm’s use of nested dependencies is indeed very helpful in managing large, complex applications, though I don’t think it’s the most important distinction.)
I’m surprised, however, that nobody has explicitly explained one of the most fundamental distinctions between Bower and npm. If you read the answers above, you’ll see the word ‘modules’ used often in the context of npm. But it’s mentioned casually, as if it might even just be a syntax difference.
The Bower Approach: Global Resources, Like
At root, Bower is about loading plain-old script files. Whatever those script files contain, Bower will load them. Which basically means that Bower is just like including all your scripts in plain-old
<script>‘s in the
<head> of your HTML.
So, same basic approach you’re used to, but you get some nice automation conveniences:
- You used to need to include JS dependencies in your project repo (while developing), or get them via CDN. Now, you can skip that extra download weight in the repo, and somebody can do a quick
bower installand instantly have what they need, locally.
- If a Bower dependency then specifies its own dependencies in its
bower.json, those’ll be downloaded for you as well.
The npm Approach: Common JS Modules, Explicit Dependency Injection
All code in Node land (and thus all code loaded via npm) is structured as modules (specifically, as an implementation of the CommonJS module format, or now, as an ES6 module). So, if you use NPM to handle browser-side dependencies (via Browserify or something else that does the same job), you’ll structure your code the same way Node does.
Smarter people than I have tackled the question of ‘Why modules?’, but here’s a capsule summary:
- Anything inside a module is effectively namespaced, meaning it’s not a global variable any more, and you can’t accidentally reference it without intending to.
- Anything inside a module must be intentionally injected into a particular context (usually another module) in order to make use of it
- This means you can have multiple versions of the same external dependency (lodash, let’s say) in various parts of your application, and they won’t collide/conflict. (This happens surprisingly often, because your own code wants to use one version of a dependency, but one of your external dependencies specifies another that conflicts. Or you’ve got two external dependencies that each want a different version.)
- Because all dependencies are manually injected into a particular module, it’s very easy to reason about them. You know for a fact: “The only code I need to consider when working on this is what I have intentionally chosen to inject here”.
- Because even the content of injected modules is encapsulated behind the variable you assign it to, and all code executes inside a limited scope, surprises and collisions become very improbable. It’s much, much less likely that something from one of your dependencies will accidentally redefine a global variable without you realizing it, or that you will do so. (It can happen, but you usually have to go out of your way to do it, with something like
window.variable. The one accident that still tends to occur is assigning
this.variable, not realizing that
windowin the current context.)
- When you want to test an individual module, you’re able to very easily know: exactly what else (dependencies) is affecting the code that runs inside the module? And, because you’re explicitly injecting everything, you can easily mock those dependencies.
To me, the use of modules for front-end code boils down to: working in a much narrower context that’s easier to reason about and test, and having greater certainty about what’s going on.
It only takes about 30 seconds to learn how to use the CommonJS/Node module syntax. Inside a given JS file, which is going to be a module, you first declare any outside dependencies you want to use, like this:
var React = require('react');
Inside the file/module, you do whatever you normally would, and create some object or function that you’ll want to expose to outside users, calling it perhaps
At the end of a file, you export whatever you want to share with the world, like this:
module.exports = myModule;
Then, to use a CommonJS-based workflow in the browser, you’ll use tools like Browserify to grab all those individual module files, encapsulate their contents at runtime, and inject them into each other as needed.
AND, since ES6 modules (which you’ll likely transpile to ES5 with Babel or similar) are gaining wide acceptance, and work both in the browser or in Node 4.0, we should mention a good overview of those as well.
More about patterns for working with modules in this deck.
EDIT (Feb 2017): Facebook’s Yarn is a very important potential replacement/supplement for npm these days: fast, deterministic, offline package-management that builds on what npm gives you. It’s worth a look for any JS project, particularly since it’s so easy to swap it in/out.
Bower has finally been deprecated. End of story.
In almost all cases, it’s more appropriate to use Browserify and npm over Bower. It is simply a better packaging solution for front-end apps than Bower is. At Spotify, we use npm to package entire web modules (html, css, js) and it works very well.
Bower brands itself as the package manager for the web. It would be awesome if this was true – a package manager that made my life better as a front-end developer would be awesome. The problem is that Bower offers no specialized tooling for the purpose. It offers NO tooling that I know of that npm doesn’t, and especially none that is specifically useful for front-end developers. There is simply no benefit for a front-end developer to use Bower over npm.
We should stop using bower and consolidate around npm. Thankfully, that is what is happening:
With browserify or webpack, it becomes super-easy to concatenate all your modules into big minified files, which is awesome for performance, especially for mobile devices. Not so with Bower, which will require significantly more labor to get the same effect.
npm also offers you the ability to use multiple versions of modules simultaneously. If you have not done much application development, this might initially strike you as a bad thing, but once you’ve gone through a few bouts of Dependency hell you will realize that having the ability to have multiple versions of one module is a pretty darn great feature. Note that npm includes a very handy dedupe tool that automatically makes sure that you only use two versions of a module if you actually have to – if two modules both can use the same version of one module, they will. But if they can’t, you have a very handy out.
Bower maintains a single version of modules, it only tries to help you select the correct/best one for you.
NPM is better for node modules because there is a module system and you’re working locally.
Bower is good for the browser because currently there is only the global scope, and you want to be very selective about the version you work with.
My team moved away from Bower and migrated to npm because:
- Programmatic usage was painful
- Bower’s interface kept changing
- Some features, like the url shorthand, are entirely broken
- Using both Bower and npm in the same project is painful
- Keeping bower.json version field in sync with git tags is painful
- Source control != package management
- CommonJS support is not straightforward
For more details, see “Why my team uses npm instead of bower”.
Found this useful explanation from http://ng-learn.org/2013/11/Bower-vs-npm/
On one hand npm was created to install modules used in a node.js environment, or development tools built using node.js such Karma, lint, minifiers and so on. npm can install modules locally in a project ( by default in node_modules ) or globally to be used by multiple projects. In large projects the way to specify dependencies is by creating a file called package.json which contains a list of dependencies. That list is recognized by npm when you run npm install, which then downloads and installs them for you.
On the other hand bower was created to manage your frontend dependencies. Libraries like jQuery, AngularJS, underscore, etc. Similar to npm it has a file in which you can specify a list of dependencies called bower.json. In this case your frontend dependencies are installed by running bower install which by default installs them in a folder called bower_components.
As you can see, although they perform a similar task they are targeted to a very different set of libraries.
Bower is created solely for the front-end development. It uses flat dependency tree, requiring only one version for each package, reducing the page load. It mainly aims for minimal resource load. It has less contributors and so development process is slow.
Bower has a configuration file called bower.json. In this file we can maintain the configuration for Bower like which dependencies we need and license details, description, name and so on. Bower is suitable for front-end packages like jquery, angular, react, ember, knockout, backbone and so on.
Npm is most commonly used for managing Node.js modules, but it works for the front-end too. It uses nested dependency tree as well as flat dependency tree. It is popular and has a lot of contributors. So its new version always comes up with exciting features.
Npm has a configuration file called package.json. In this file we can maintain the configuration for Npm like which dependencies we need and license details, description, name and so on. Npm provides Dependencies and DevDependencies. Dependencies will download and maintain the front-end files like Jquery, Angular and so on. DevDependencies will download and maintain development tools like Grunt, Gulp, JSHint and so on.
This obviously doesn’t work that well on the front-end, because we need jQuery in our projects. We need only one copy of jQuery, but when another package requires jQuery, then it will download again one more copy of jQuery. This is one of the main drawbacks of Npm.
Key Note : The reason many projects use both is that they use Bower for front-end packages and Npm for developer tools. Multiplying package manager in your project make your workflow harder. Npm 3 coupled with browserify or webpack is the way to go now.