All of our npm dependencies are locked via the yarn.lock file for the following reasons:

• our project has lots of dependencies which update at unpredictable times, so it's important that we update them explicitly once in a while rather than implicitly when any of us runs yarn install
• locked dependencies allow us to reuse yarn cache on CircleCI, significantly speeding up our builds (by 5 minutes or more)
• locked dependencies allow us to detect when node_modules folder is out of date after a branch switch which allows us to build the project with the correct dependencies every time

Before changing a dependency, do the following:

• make sure you are in sync with upstream/master: git fetch upstream && git rebase upstream/master
• ensure that your node_modules directory is not stale by running yarn install

To add a new dependency do the following: yarn add <packagename> --dev

To update an existing dependency do the following: run yarn upgrade <packagename>@<version|latest> --dev or yarn upgrade <packagename> --dev to update to the latest version that matches version constraint in package.json

To Remove an existing dependency do the following: run yarn remove <packagename>

Once you've changed the dependency, commit the changes to package.json & yarn.lock, and you are done.