fix: configure Yarn to always use yarn@1.22.22 #599
+148,057
−2
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
itsananderson
changed the title
itsananderson
changed the title
dsanders11
reviewed
Jun 7, 2024
| @@ -61,5 +61,6 @@ | |||
| "hooks": { | |||
| "pre-commit": "lint-staged" | |||
| } | |||
| } | |||
| }, | |||
| "packageManager": "yarn@1.22.22" | |||
There was a problem hiding this comment.
Suggested change
| "packageManager": "yarn@1.22.22" | |
| "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610" |
This matches how we have it set over in Forge.
There was a problem hiding this comment.
Hmm, is that meant to match the sha1 of the vendored Yarn file? I get something different locally, but perhaps I'm hashing the wrong thing?
shasum -a 1 .yarn/releases/yarn-1.22.22.cjs
870faaceb1604f213264cfa69f7db5b620d086b2 .yarn/releases/yarn-1.22.22.cjs
There was a problem hiding this comment.
The way we pulled it for Forge was using the output of npm show yarn@XYZ - not sure if a different approach is needed in this case with the file being vendored.
$ npm show yarn@1.22.22
yarn@1.22.22 | BSD-2-Clause | deps: none | versions: 120
📦🐈 Fast, reliable, and secure dependency management.
https://github.com/yarnpkg/yarn#readme
bin: yarn, yarnpkg
dist
.tarball: https://registry.npmjs.org/yarn/-/yarn-1.22.22.tgz
.shasum: ac34549e6aa8e7ead463a7407e1c7390f61a6610
.integrity: sha512-prL3kGtyG7o9Z9Sv8IPfBNrWTDmXB4Qbes8A9rEzt6wkJV8mUvoirjU0Mp3GGAU06Y0XQyA3/2/RQFVuK7MTfg==
.unpackedSize: 5.3 MB
maintainers:
- byk <ben@byk.im>
- bestander <bestander@gmail.com>
- daniel15 <npm@d.sb>
- arcanis <nison.mael@gmail.com>
- danbuild <build@dan.cx>
dist-tags:
berry: 2.4.3 latest: 1.22.22 legacy: 1.21.1 rc: 1.22.0
published 3 months ago by arcanis <nison.mael@gmail.com>
There was a problem hiding this comment.
In this case it might be unnecessary since we're vendoring the file itself.
A deprecation warning is noticed as well.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Several parts of
build-toolscall Yarn vianpx yarncalls. This code assumes that the globally installed Yarn version is 1.x, and some of the calls likenpx yarn --prodfail if you have a newer version of Yarn installed.Yarn has the ability to specify a desired Yarn version in your repo, and whatever
yarncommand you have on your path will act as a shim and call into the configured Yarn. This is configured by callingyarn set version, which I have done to generate this PR: https://yarnpkg.com/cli/set/versionFrom some basic testing, it seems that any version of Yarn >=1.18.0 understands this
yarn set versioncommand and mechanism.Since this PR effectively vendors a bunch of 3rd party code into the repo, it would probably be a good idea for someone with the commit bit to ensure that the vendored bits actually match the upstream url, or to simply run the
yarn set versioncommand yourself, similar to how only committers can generate a newyarn.lock.