@6a68 will take a look

@g-k Do you know if there have been any similar checksum additions in latest npm 5 (which is bundled with recent Node 8)? http://blog.npmjs.org/post/161081169345/v500

I know npm 5 also includes a package-lock.json file (similar to the shrinkwrap.json), but wasn't sure if that offered the same functionality as Yarn.

From a recent blog post by the yarn team, it seems that the difference is somewhat academic:

npm 5 has stronger guarantees across versions and has a stronger deterministic lockfile, but Yarn only has those guarantees when you’re on the same version in favor of a lighter lockfile that is better for review.

Are there other compelling reasons to switch?

Yeah, this predates npm 5. After finding this I'm not sure yarn is necessarily an improvement. I'll do some testing and update this issue.

Presumably if we stick with npm we'd still want to generate a lockfile and check it in (which we aren't doing now).

@g-k we're going with the easier npm shrinkwrap option for now. feel free to reopen or file a new bug if the recommendation goes back to yarn

We never did npm shrinkwrap, and we've had a lot of problems with npm lockfiles. I think we should reconsider yarn.