We tend to stick to npm, yarn is only a fancy alternative, not 10x better. Using a self -hosted private repository (via sinopia/npm-mirror) make package locking (mostly) pointless.