⭐ Yarn Migration

Full detail: todo.md's "Yarn migration" section. This page is the short version.

The source repo is pnpm-native, and several of its mechanisms have no Yarn equivalent — each one needed a real decision, not a find-and-replace:

pnpm mechanism	Yarn replacement	Note
catalog: protocol (331-entry shared version table, 673 references across 40 files)	.yarnrc.yml's own catalog: block, referenced the same way	Corrected — see below, this row previously (wrongly) said Yarn has no equivalent
pnpm.overrides (7 entries)	Yarn resolutions, nesting syntax translated (> → /)	Confirmed via a real yarn install
pnpm run '/^build:.*/' regex script filter (4 packages)	Explicit script lists; 2 packages (extensions, utils) needed the new concurrently dependency for true parallel watch-mode builds	Not in the original catalog — a real new dependency
pnpm deploy --legacy --prod	Custom scripts/deploy-production.mjs on yarn workspaces focus	Corrected to non-destructive — see below, an earlier version pruned the root install in place
pnpm fetch (Docker cache pre-warming)	Dropped — one COPY . . then yarn install	Real Docker build-cache regression, accepted deliberately
onlyBuiltDependencies allowlist	enableScripts: true (permissive)	Real security-posture downgrade, documented
@pnpm/workspace.* internals (imported directly by release-notes-generator's source)	Dependency dropped from package.json; source rewrite still owed	See Known Gaps

Verified, not assumed: yarn workspaces foreach/focus and yarn npm publish are core Yarn 4.18.0 commands — checked directly against the installed binary's --help output. No @yarnpkg/plugin-workspace-tools import needed, despite that being a real requirement in older Berry versions.

vitest bumped 3.2.7 → 4.1.10 (latest) across all 32 consuming packages — deliberate, not inherited from source. Compatibility against real config is unverified — see Known Gaps.

🏁 isolated-vm@5.0.3 → 7.0.1, a real bug not a toolchain issue. The source repo's pinned version failed to compile on both Windows and the GitHub Actions Ubuntu runner — real compiler output (gh run view --log-failed) showed the native addon calling V8 APIs Node 26 has since removed (Template::SetAccessor, Object::GetIsolate/GetPrototype, internal-field accessor signatures). Bumped to latest (engines.node: ">=24.0.0"), confirmed fixed with a real yarn install. See Known Gaps.

🏁 Correction: Yarn does have a catalog feature. "No shared-catalog mechanism in Yarn at all" (this page and todo.md both said it) was wrong — yarn config -v's full settings dump (not yarn help, which doesn't mention it) lists real catalog/catalogs config keys. Verified in a scratch project before touching this repo: .yarnrc.yml's catalog: { lodash: 4.17.21 } plus "lodash": "catalog:" resolved correctly, workspace:* works as a catalog value too. Fixed properly: .yarnrc.yml now carries a 326-entry catalog (331 minus 5 dead entries — the 3 @pnpm/* internals, 2 @directus/* indirections nothing used), folding in the vitest/isolated-vm bumps above so the catalog reflects this fork's real pins, not stale upstream ones. 671 of 673 references converted back via script, every diff reviewed before committing.

🏁 deploy-production.mjs corrected to non-destructive. An initial version pruned the repo's own root node_modules in place — a real regression from pnpm's original behavior, not an oversight left standing. Rewritten to run the focus/copy steps inside a disposable git worktree checked out from HEAD instead, so the live working tree's node_modules is never touched. Verified end-to-end: dist/ came out with a working node_modules and a correct package.json.