Could lockfile reinstall performance be improved?

[aaronadamsCA]

I am comparing the speed of npm ci to yarn install --immutable when run in our medium-sized monorepo. These tests were run under identical conditions (same Docker container, same dependency tree, clean cache).

NPM v7.15.1

===> multitime results
1: npm ci
            Mean        Std.Dev.    Min         Median      Max
real        50.285      24.593      36.298      38.221      99.405
user        44.203      16.881      34.654      35.211      77.865
sys         37.394      2.539       33.285      37.914      40.199

Yarn v2.4.2

===> multitime results
1: yarn install --immutable
            Mean        Std.Dev.    Min         Median      Max
real        28.359      48.255      4.204       4.219       124.869
user        32.214      52.919      5.604       5.755       138.052
sys         7.264       12.666      0.785       1.007       32.595

Results:

• npm ci is faster on first run. 🎉
• npm ci is about 10x slower on subsequent runs. 😨

A project lockfile can change often; yarn install --immutable is cheap enough to run automatically on checkout, but npm ci is not.

My question: Is there a worthwhile feature request to address this?

I lack adequate understanding of NPM internals to understand the difference in speed. I'm sure there are good reasons for it. At the same time, bridging this gap could make a big difference as projects consider migrating to NPM workspaces.

• Could npm ci performance be improved by 10x? I'm guessing no.
• Could npm install add a flag to install from the lockfile? Compared to regular npm install, this could verify the lockfile matches current project dependencies, instead of recalculating the entire tree; compared to npm ci, this could update node_modules/ in place, instead of rebuilding it from scratch. Maybe this could become the fastest way to reinstall dependencies?
• Could projects just use npm install as-is? This is still 2x slower than yarn install --immutable, and adds the new concern of inadvertently changing the lockfile, but maybe it's good enough anyway?

[targos]

I agree that it would be useful to have a command with both the immutability guarantees of npm ci and the speed of npm install on an already installed tree.