mrkeyoor.com_
Sat 24 Oct 22:52 UTC
Dev Toolsevaluationupdated 23 Oct 2026

lerna review

Lerna manages and publishes JavaScript or TypeScript packages kept in one repository. Its release workflow handles package versions and npm publication while leaving dependency installation and linking to the package manager.

+0stars / 7d
Verdict

Our Lerna checkout built and tested successfully, and the installed development checkout occupied 726 MB. Npm audit reported 84 known vulnerabilities whose exposure remains unresolved in the supplied evidence. Consider Lerna when coordinating package versions and npm releases would replace recurring maintenance work you can name. Inspect the advisory details before dependency approval; check workspace configuration first if local package linking is your only problem.

We ran it

Lab card: what happened when we ran lernaScreenshot of lerna (lerna.js.org)
Install✓ · 76s1795 packages · 726 MB
Build✓ · 37s
Tests✓ · 90sran, no count parsed
Known vulns8418 critical · 33 high · 33 moderate · 0 low (npm audit)
Repo1507 files~64,083 lines of source · 7.7 MB · 7 CI workflows

Answers from our run

Does lerna build from source?

Dependencies installed in 76 seconds (1795 packages), and the build succeeded in 37 seconds. We cloned commit b00fa03 into a clean Debian container with 3 CPUs and no project-specific setup.

Do lerna's tests pass?

Yes. The project's own test command exited successfully in 90 seconds, although its output did not expose an individual test count.

Does lerna have known vulnerabilities in its dependencies?

npm audit flagged 84 known advisories in the dependency tree, including 18 critical at the time of our run.

Who should not use lerna?

Teams whose immediate problem is dependency installation or local package linking: the getting-started guide assigns that work to the package manager.

What are the alternatives to lerna?

Changesets, Turborepo. Our Lerna checkout built and tested successfully, and the installed development checkout occupied 726 MB.

SetupN/AThe checkout installed successfully, but raw runtime logs and an adoption trial in a supported environment were not supplied.
DocsN/AThe supplied guides explain initialization previews, versioning, Git side effects, and npm configuration. No scoring rubric supports the previous numerical documentation rating.
CommunityN/ARepository activity does not establish support quality, response reliability, or suitability for a numerical community rating.
MaturityN/ABuild and test steps succeeded, but advisory exposure and registry publication were not assessed. Those observations do not support the previous numerical maturity rating.

Discussed on

  1. hnLerna relicences to protest ICE143 points
  2. hnLerna restores unmodified MIT license51 points
  3. hnAutomated release process for (Lerna) monorepo17 points
  4. hnUsing Lerna to share React/Redux functionality across web applications13 points
  5. hnShow HN: Lerna: A tool for managing large JavaScript projects10 points

Who it’s for

Maintainers releasing related npm packages who need fixed or independent versioning.
Teams with working package-manager workspaces that need a repeatable release workflow.
Repositories with existing version scripts that could use Lerna's from-package publishing mode.

Who it’s NOT for

Teams whose immediate problem is dependency installation or local package linking: the getting-started guide assigns that work to the package manager.
Maintainers expecting a local version calculator without Git side effects: the documented version workflow commits, tags, and pushes changes.
Teams unable to configure npm publication, even when another package manager handles their workspace.
Organizations requiring resolved dependency approval before a pilot: the measured checkout had 84 audit findings, including 18 critical, without advisory details establishing exposure.

Setup reality

Our sandbox installed commit b00fa03 in 76 seconds, recording 1,795 dependencies. The installed development checkout occupied 726 MB. The build succeeded in 37 seconds, and the test step succeeded in 90 seconds. Npm audit reported 84 known vulnerabilities: 18 critical, 33 high, 33 moderate, and 0 low. No passing-test count was supplied.

Adoption needs workspace configuration and release decisions. The documented version workflow can commit, tag, and push Git changes. Publication needs npm configuration even when another package manager handles dependencies. Registry publication was not assessed by the supplied run.

The recorded sandbox configuration specified 3 CPUs, 8 GB RAM, and image label lab-node:22. Raw toolchain logs were not supplied to confirm runtime or operating-system versions. The 726 MB measurement covers the installed upstream development checkout, not isolated dependencies or the incremental cost of adding Lerna to another repository.

Releasing related npm packages means deciding which versions change, writing Git tags, and publishing the right packages. Lerna gives maintainers a workflow for those steps. This review asks whether that release work justifies adopting it alongside an existing package workspace.

Choose the release model first

The release guide describes fixed and independent versioning. Fixed mode uses a single version line, but it does not mean every package receives every release. The guide explains that unchanged packages can retain older versions and documents an option to force synchronized versions. Independent mode lets maintainers choose version bumps separately for changed packages.

For separately consumed components, independent versions may fit the release policy. A coordinated package family may suit fixed mode. These are workflow recommendations, not findings from the sandbox. Choose the model that matches your compatibility commitments before running commands that write versions and tags.

What happened when we ran it

The supplied sandbox run installed Lerna commit b00fa03 in 76 seconds, built it in 37 seconds, and completed the test step successfully in 90 seconds on October 15, 2026. It recorded 1,795 dependencies. The installed development checkout occupied 726 MB. No passing-test count was supplied.

The recorded configuration specified 3 CPUs, 8 GB RAM, and image label lab-node:22. The label does not establish the actual Node or operating-system version. These timings describe the upstream checkout in that sandbox; they do not measure an application's task graph, caching benefits, or registry publication.

Npm audit reported 84 known vulnerabilities: 18 critical, 33 high, 33 moderate, and 0 low. The summary does not identify affected packages, production exposure, or reachable exploit paths. Inspect the advisory details before dependency approval. The count alone does not establish exposure from installing the published CLI.

Before installation, the checkout contained 1,507 files, about 64,083 lines of source, and occupied 7.7 MB. The scan recorded 7 CI workflow files, monorepo workspaces, no Dockerfile, and no tests directory. The successful test step is a separate observation from the directory scan.

The 726 MB figure measures the installed development checkout. It does not isolate dependency size or measure the incremental cost of adopting Lerna in your repository.

Keep the package manager responsible for dependencies

The getting-started guide makes the boundary explicit: Lerna is not responsible for installing and linking dependencies. When package-manager workspaces are configured, Lerna defaults to their existing package patterns.

The guide documents npx lerna init --dryRun to preview initialization changes. That is a useful next step in a disposable branch: inspect the proposed changes and package selection before applying them. This command is a documentation example; the supplied sandbox result does not record executing it.

Check which packages should be published. The release guide demonstrates using "private": true to keep an application out of npm publication.

Versioning has Git side effects

The documented version workflow updates package versions, commits the change, creates a tag, and pushes the commit and tag. It does not publish packages to npm. The documented publish workflow adds registry publication.

Lerna always uses npm to publish packages. The guide says teams using another package manager still need appropriate publishing configuration in .npmrc. Plan registry authentication and Git permissions separately from repository build checks; the successful test step does not establish release readiness.

The from-package mode compares local package versions with those published to npm and publishes packages whose local versions are greater. It does not require those versions to have been calculated with Lerna. Teams with existing version scripts can therefore evaluate publication separately from version calculation.

Compare the missing workflow

Changesets lets contributors declare how their changes should be released. It handles package versions, changelogs, and publication from those declarations. Consider it when reviewable release intent is the missing part of your process. The supplied README identifies itself as the development branch for Changesets v3 and points v2 users to a maintenance branch; this review does not verify a released Changesets version.

Turborepo documents task scheduling and caching using existing package scripts and a turbo.json file. Consider it when repeated repository tasks are the immediate problem and releases already work. For this review's release-focused reader, evaluate Lerna against the package-release work it would replace. The sandbox provides no speed or footprint comparison between these tools.

Start with the initialization preview, choose fixed or independent versioning, and rehearse publication with disposable packages before using production credentials. If dependency linking is the only problem, start with the workspace configuration.

Alternatives

ProjectWhat it isPick it when
ChangesetsManages package versions, changelogs, and publishing from contributor-written release declarations.Consider Changesets when contributors should record release intent alongside their changes. The supplied README describes the development branch for v3, not a verified released version.
Turborepo gh↗Schedules repository tasks and caches results using existing package scripts.Consider Turborepo when repeated repository tasks are the immediate problem and your package-release workflow already works.

Sources

  1. Lerna getting started
  2. Lerna versioning and publishing
  3. Changesets development-branch README
  4. Turborepo documentation

More dev tools reviews

hallmark · ds-harness-remote · PCL · rpcs3 · shellcheck · mpv · the whole board →