Merge branch 'master' into fix-workspace-confilct

yarnpkg · Nov 18, 2019 · ce6c231 · ce6c231
2 parents 71ab421 + 1ec3190
commit ce6c231
Show file tree

Hide file tree

Showing 96 changed files with 1,510 additions and 336 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -7,7 +7,7 @@ docker_defaults: &docker_defaults
 
 macos_defaults: &macos_defaults
   macos:
-    xcode: "9.0"
+    xcode: "11.0"
   working_directory: ~/project/yarn
 
 attach_workspace: &attach_workspace
@@ -122,6 +122,16 @@ jobs:
           root: ~/project
           paths:
             - yarn
+  test-pkg-tests-linux-node13:
+    <<: *docker_defaults
+    docker:
+      - image: node:13
+    <<: *pkg_tests
+  test-pkg-tests-linux-node12:
+    <<: *docker_defaults
+    docker:
+      - image: node:12
+    <<: *pkg_tests
   test-pkg-tests-linux-node10:
     <<: *docker_defaults
     docker:
@@ -130,8 +140,20 @@ jobs:
   test-pkg-tests-linux-node8:
     <<: *docker_defaults
     <<: *pkg_tests
+  test-linux-node13:
+    <<: *docker_defaults
+    docker:
+      - image: node:13
+    <<: *test_steps
+  test-linux-node12:
+    <<: *docker_defaults
+    docker:
+      - image: node:12
+    <<: *test_steps
   test-linux-node10:
     <<: *docker_defaults
+    docker:
+      - image: node:10
     <<: *test_steps
   test-linux-node8:
     <<: *docker_defaults
@@ -155,7 +177,6 @@ jobs:
           name: Install Node 10
           command: |
             brew uninstall --ignore-dependencies node
-            brew update
             HOMEBREW_NO_AUTO_UPDATE=1 brew install node@10
             brew link --overwrite --force node@10
             [[ $(node --version) =~ ^v10\. ]]
@@ -177,6 +198,8 @@ jobs:
       - *test_run
   test-macos-node6:
     <<: *macos_defaults
+    macos:
+      xcode: "9.0"
     steps:
       - run:
           name: Install Node 6
@@ -248,6 +271,14 @@ workflows:
           filters: *default_filters
           requires:
             - install
+      - test-pkg-tests-linux-node13:
+          filters: *default_filters
+          requires:
+            - install
+      - test-pkg-tests-linux-node12:
+          filters: *default_filters
+          requires:
+            - install
       - test-pkg-tests-linux-node10:
           filters: *default_filters
           requires:
@@ -256,6 +287,14 @@ workflows:
           filters: *default_filters
           requires:
             - install
+      - test-linux-node13:
+          filters: *default_filters
+          requires:
+            - install
+      - test-linux-node12:
+          filters: *default_filters
+          requires:
+            - install
       - test-linux-node10:
           filters: *default_filters
           requires:
@@ -294,8 +333,12 @@ workflows:
             branches:
               ignore: /.*/
           requires:
+            - test-pkg-tests-linux-node13
+            - test-pkg-tests-linux-node12
             - test-pkg-tests-linux-node10
             - test-pkg-tests-linux-node8
+            - test-linux-node13
+            - test-linux-node12
             - test-linux-node10
             - test-linux-node8
             - test-linux-node6

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,14 +4,103 @@ Please add one entry in this file for each change in Yarn's behavior. Use the sa
 
 ## Master
 
-- Correctly install workspace child dependencies when workspace child not symlinked to root.
+- Correctly installs workspace child dependencies when workspace child not symlinked to root.
 
   [#7289](https://github.com/yarnpkg/yarn/pull/7289) - [**Daniel Tschinder**](https://github.com/danez)
 
+- Makes running scripts with Plug'n Play possible on node 13
+
+  [#7650](https://github.com/yarnpkg/yarn/pull/7650) - [**Sander Verweij**](https://github.com/sverweij)
+
+- Changes the `run` command to check cwd/node_modules/.bin for commands. Fixes `run` in workspaces.
+
+  [#7151](https://github.com/yarnpkg/yarn/pull/7151) - [**Jeff Valore**](https://twitter.com/codingwithspike)
+
+
+## 1.19.1
+
+**Important:** This release contains a cache bump. It will cause the very first install following the upgrade to take slightly more time, especially if you don't use the [Offline Mirror](https://yarnpkg.com/blog/2016/11/24/offline-mirror/) feature. After that everything will be back to normal.
+
+- Computes the `--modules-folder` & friends paths based on the cwd.
+
+  [#7607](https://github.com/yarnpkg/yarn/pull/7607) - [**mbpreble**](https://github.com/mbpreble)
+
+- Stores the sha512 in the cache even when not provided by the server.
+
+  [#7591](https://github.com/yarnpkg/yarn/pull/7591) - [**Maël Nison**](https://twitter.com/arcanis) / [#7595](https://github.com/yarnpkg/yarn/pull/7595) - [**Michael**](https://github.com/Blasz)
+
+- Uses the right Node binary when using `yarn-path`.
+
+  [#7592](https://github.com/yarnpkg/yarn/pull/7592) - [**Maël Nison**](https://twitter.com/arcanis)
+
+## 1.19.0
+
+**Important:** This release contains a cache bump. It will cause the very first install following the upgrade to take slightly more time, especially if you don't use the [Offline Mirror](https://yarnpkg.com/blog/2016/11/24/offline-mirror/) feature. After that everything will be back to normal.
+
+- Fixes a potential vulnerability regarding how the build artifacts are stored
+
+  Reported by [**ChALkeR**](https://github.com/ChALkeR), fixed by [**Maël Nison**](https://twitter.com/arcanis)
+
+## 1.18.0
+
+- Suggests using the Yarn 2 development trunk on PnP-enabled projects
+
+  [#7512](https://github.com/yarnpkg/yarn/pull/7512) - [**Maël Nison**](https://twitter.com/arcanis)
+
+- Preserves linked packages when calling `yarn create`
+
+  [#7543](https://github.com/yarnpkg/yarn/pull/7543) - [**Nick McCurdy**](https://github.com/nickmccurdy)
+
+- Fixes the offline mirror filenames when using Verdaccio
+
+  [#7499](https://github.com/yarnpkg/yarn/pull/7499) - [**xv2**](https://github.com/xv2)
+
+- Fixes using `link:.` to refer to the package folder
+
+  [#7512](https://github.com/yarnpkg/yarn/pull/7512) - [**Maël Nison**](https://twitter.com/arcanis)
+
+- Runs the `prepare` lifecycle of git dependencies even if `NODE_ENV` is set to `production`.
+
+  [#7398](https://github.com/yarnpkg/yarn/pull/7398) - [**John Firebaugh**](https://github.com/jfirebaugh)
+
+- Fixes the `postversion` lifecycle method not being called when using `--no-git-tag-version`.
+
+  [#7154](https://github.com/yarnpkg/yarn/pull/7154) - [**Hampus Tågerud**](https://github.com/hampustagerud)
+
+- Ignores potentially large vscode keys in package.json to avoid E2BIG errors.
+
+  [#7419](https://github.com/yarnpkg/yarn/pull/7419) - [**Eric Amodio**](https://twitter.com/eamodio)
+
+- Enforces https for the Yarn and npm registries.
+
+  [#7393](https://github.com/yarnpkg/yarn/pull/7393) - [**Maël Nison**](https://twitter.com/arcanis)
+
+- Adds support for reading `yarnPath` from v2-produced `.yarnrc.yml` files.
+
+  [#7350](https://github.com/yarnpkg/yarn/pull/7350) - [**Maël Nison**](https://twitter.com/arcanis)
+
+## 1.17.0
+
+- Adds prereleases flags and prerelease identifier to `yarn version`.
+
+  [#7336](https://github.com/yarnpkg/yarn/pull/7336) - [**Daniel Seijo**](https://github.com/daniseijo)
+
+- Fixes audits when used with `yarn add` & `yarn upgrade`
+
+  [#7326](https://github.com/yarnpkg/yarn/pull/7326) - [**David Sanders**](https://github.com/dsanders11)
+
+- Adds support for the `--offline` flag to `yarn global add`
+
+  [#7330](https://github.com/yarnpkg/yarn/pull/7330) - [**Francis Crick**](https://guthub.com/fcrick)
+
 - Yarn will tolerate Yaml at parse time. Full support isn't ready yet and will only come at the next major.
 
   [#7300](https://github.com/yarnpkg/yarn/pull/7300) - [**Maël Nison**](https://twitter.com/arcanis)
 
+- Fixes a bug when using the `link:` protocol with a folder that doesn't contain a `package.json`
+
+  [#7337](https://github.com/yarnpkg/yarn/pull/7337) - [**Maël Nison**](https://twitter.com/arcanis)
+
 ## 1.16.0
 
 - Retries downloading a package on `yarn install` when we get a ETIMEDOUT error.

diff --git a/__tests__/commands/install/integration.js b/__tests__/commands/install/integration.js
@@ -632,6 +632,11 @@ test('install should be idempotent', () =>
     null,
   ));
 
+test('install should fail to authenticate integrity with incorrect hash and correct sha512', () =>
+  expect(runInstall({}, 'invalid-checksum-good-integrity')).rejects.toMatchObject({
+    message: expect.stringContaining("computed integrity doesn't match our records"),
+  }));
+
 test('install should authenticate integrity field with sha1 checksums', () =>
   runInstall({}, 'install-update-auth-sha1', async config => {
     const lockFileContent = await fs.readFile(path.join(config.cwd, 'yarn.lock'));
@@ -1160,3 +1165,102 @@ test('install skips the scripts if the yarnrc specifies skip-scripts true', () =
     const ignoredScriptsMessage = reporter.lang('ignoredScripts');
     expect(stdout).toMatch(ignoredScriptsMessage);
   }));
+
+describe('Cache', () => {
+  test('install should cache package without integrity prefix if no integrity field present', () =>
+    runInstall({}, 'install-update-auth-no-integrity-field', async config => {
+      const pkgCacheDir = path.join(
+        config.cwd,
+        '.yarn-cache',
+        `v${constants.CACHE_VERSION}`,
+        'npm-safe-buffer-5.1.1-893312af69b2123def71f57889001671eeb2c853',
+      );
+
+      expect(await fs.exists(pkgCacheDir)).toEqual(true);
+    }));
+
+  test('install should cache package with integrity suffix if integrity field present', () =>
+    runInstall({}, 'install-update-auth-sha512', async config => {
+      const pkgCacheDir = path.join(
+        config.cwd,
+        '.yarn-cache',
+        `v${constants.CACHE_VERSION}`,
+        'npm-safe-buffer-5.1.1-893312af69b2123def71f57889001671eeb2c853-integrity',
+      );
+
+      expect(await fs.exists(pkgCacheDir)).toEqual(true);
+    }));
+
+  test('install should store cached sha1 + sha512 integrity when lockfile has sha1 integrity field', () =>
+    runInstall({}, 'install-update-auth-sha1-safebuffer', async config => {
+      const pkgCacheDir = path.join(
+        config.cwd,
+        '.yarn-cache',
+        `v${constants.CACHE_VERSION}`,
+        'npm-safe-buffer-5.1.1-893312af69b2123def71f57889001671eeb2c853-integrity',
+      );
+      const pkgCacheMetaData = JSON.parse(
+        await fs.readFile(path.join(pkgCacheDir, 'node_modules', 'safe-buffer', constants.METADATA_FILENAME)),
+      );
+      expect(pkgCacheMetaData.remote.cacheIntegrity).toBe(
+        // eslint-disable-next-line max-len
+        'sha512-kKvNJn6Mm93gAczWVJg7wH+wGYWNrDHdWvpUmHyEsgCtIwwo3bqPtV4tR5tuPaUhTOo/kvhVwd8XwwOllGYkbg== sha1-iTMSr2myEj3vcfV4iQAWce6yyFM=',
+      );
+    }));
+
+  test('install should store cached sha1 + sha512 integrity when lockfile has sha512 integrity field', () =>
+    runInstall({}, 'install-update-auth-sha512', async config => {
+      const pkgCacheDir = path.join(
+        config.cwd,
+        '.yarn-cache',
+        `v${constants.CACHE_VERSION}`,
+        'npm-safe-buffer-5.1.1-893312af69b2123def71f57889001671eeb2c853-integrity',
+      );
+      const pkgCacheMetaData = JSON.parse(
+        await fs.readFile(path.join(pkgCacheDir, 'node_modules', 'safe-buffer', constants.METADATA_FILENAME)),
+      );
+      expect(pkgCacheMetaData.remote.cacheIntegrity).toBe(
+        // eslint-disable-next-line max-len
+        'sha512-kKvNJn6Mm93gAczWVJg7wH+wGYWNrDHdWvpUmHyEsgCtIwwo3bqPtV4tR5tuPaUhTOo/kvhVwd8XwwOllGYkbg== sha1-iTMSr2myEj3vcfV4iQAWce6yyFM=',
+      );
+    }));
+
+  test('install should store cached sha1 + sha512 integrity when lockfile has no integrity field', () =>
+    runInstall({}, 'install-update-auth-no-integrity-field', async config => {
+      const pkgCacheDir = path.join(
+        config.cwd,
+        '.yarn-cache',
+        `v${constants.CACHE_VERSION}`,
+        'npm-safe-buffer-5.1.1-893312af69b2123def71f57889001671eeb2c853',
+      );
+      const pkgCacheMetaData = JSON.parse(
+        await fs.readFile(path.join(pkgCacheDir, 'node_modules', 'safe-buffer', constants.METADATA_FILENAME)),
+      );
+
+      expect(pkgCacheMetaData.remote.cacheIntegrity).toBe(
+        // eslint-disable-next-line max-len
+        'sha512-kKvNJn6Mm93gAczWVJg7wH+wGYWNrDHdWvpUmHyEsgCtIwwo3bqPtV4tR5tuPaUhTOo/kvhVwd8XwwOllGYkbg== sha1-iTMSr2myEj3vcfV4iQAWce6yyFM=',
+      );
+    }));
+
+  test('install should fail when cached package integrity does not match lockfile integrity field', () =>
+    expect(runInstall({}, 'install-update-auth-invalid-cache-integrity')).rejects.toThrow(
+      // eslint-disable-next-line max-len
+      'Incorrect integrity when fetching from the cache for "safe-buffer". Cache has "sha512-foo sha1-bar" and remote has "sha1-iTMSr2myEj3vcfV4iQAWce6yyFM="',
+    ));
+
+  test('install should fail when cached package hash does not match remote hash', () =>
+    expect(runInstall({}, 'install-update-auth-invalid-cache-hash')).rejects.toThrow(
+      // eslint-disable-next-line max-len
+      'Incorrect hash when fetching from the cache for "safe-buffer". Cache has "bad-hash" and remote has "893312af69b2123def71f57889001671eeb2c853"',
+    ));
+
+  test('install should not fail cache integrity validation when lockfile has sha1 integrity field', () =>
+    expect(runInstall({}, 'install-update-auth-sha1-with-cache')).resolves.toBeUndefined());
+
+  test('install should not fail cache integrity validation when lockfile has sha512 integrity field', () =>
+    expect(runInstall({}, 'install-update-auth-sha512-with-cache')).resolves.toBeUndefined());
+
+  test('install should not fail cache integrity validation when lockfile has no integrity field', () =>
+    expect(runInstall({}, 'install-update-auth-no-integrity-field-with-cache')).resolves.toBeUndefined());
+});
diff --git a/__tests__/commands/install/resolutions.js b/__tests__/commands/install/resolutions.js
@@ -46,6 +46,12 @@ test.concurrent('install with --frozen-lockfile with resolutions', async (): Pro
   }
 });
 
+test.concurrent('install with resolutions on optional dependencies should not resolve', (): Promise<void> => {
+  return runInstall({ignoreOptional: true}, {source: 'resolutions', cwd: 'optional-deps'}, async config => {
+    expect(await isPackagePresent(config, 'left-pad')).toEqual(false);
+  });
+});
+
 test.concurrent('install with exotic resolutions should override versions', (): Promise<void> => {
   return runInstall({}, {source: 'resolutions', cwd: 'exotic-version'}, async config => {
     expect(await getPackageVersion(config, 'left-pad')).toEqual('1.1.1');

diff --git a/__tests__/commands/run.js b/__tests__/commands/run.js
@@ -207,6 +207,16 @@ test('adds workspace root node_modules/.bin to path when in a workspace', (): Pr
     expect(envPaths).toContain(path.join(config.cwd, 'packages', 'pkg1', 'node_modules', '.bin'));
   }));
 
+test('adds cwd node_modules/.bin to path when in a workspace usig nohoist', (): Promise<void> =>
+  runRunInWorkspacePackage('packages/pkg1', ['env'], {}, 'nohoist-workspace', (config, reporter): ?Promise<void> => {
+    const logEntry = reporter.getBuffer().find(entry => entry.type === 'log');
+    const parsedLogData = JSON.parse(logEntry ? logEntry.data.toString() : '{}');
+    const envPaths = (parsedLogData.PATH || parsedLogData.Path).split(path.delimiter);
+
+    expect(envPaths).toContain(path.join(config.cwd, 'node_modules', '.bin'));
+    expect(envPaths).toContain(path.join(config.cwd, 'packages', 'pkg1', 'node_modules', '.bin'));
+  }));
+
 test('runs script with custom script-shell', (): Promise<void> =>
   runRunWithCustomShell('/usr/bin/dummy', ['start'], {}, 'script-shell', async (config): ?Promise<void> => {
     const pkg = await fs.readJson(path.join(config.cwd, 'package.json'));