feat(vendor): warn when a wired classic yarn.lock is one berry install from silent de-patching#133
Open
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
Open
Conversation
…l from silent de-patching
Proven end-to-end on a real monorepo (2026-07): yarn 2+ (berry)
migrates a classic (v1) yarn.lock to its own format on install and
re-resolves every entry from the registry — the vendored
`file:./.socket/vendor/…` resolutions are dropped with NO warning and
every package installs unpatched.
New state-based core probe `yarn_classic_berry_migration_risk`
(vendor/mod.rs): fires when yarn.lock is classic AND carries vendored
wiring AND package.json does not pin yarn classic via
`packageManager: yarn@1…` (a corepack pin makes stray berry installs
refuse instead of migrate; major is parsed, so yarn@10 does not
string-match yarn@1). Reads on-disk state, not run events, so callers
invoke it unconditionally at envelope-finalize: unwired projects,
yarn@1-pinned projects, and fully-reverted runs stay silent.
Surfaced as a new run-level `warnings` array on the JSON envelope
(`{code, detail}`, omitted when empty so existing consumers see
byte-identical output) plus a stderr line in human mode — wired into
the `vendor` command and both scan vendor flows (shared
run_scan_vendor_step).
Tests: 5 probe unit tests (pin suppression, yarn@4/yarn@10/pnpm pins
still warn, unwired/berry/missing locks silent, malformed package.json
fails toward warning); the yarn-classic capstone e2e now asserts the
advisory appears on first vendor AND on in-sync re-runs, disappears
under a yarn@1.22.22 packageManager pin (and the empty array is omitted
from JSON), and falls silent after --revert.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mikola Lysenko (mikolalysenko)
enabled auto-merge (squash)
July 24, 2026 20:06
Wenxin Jiang (Wenxin-Jiang)
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Proven end-to-end during the strapi clean-run session: yarn 2+ (berry) migrates a classic (v1)
yarn.lockon install and silently drops every vendoredfile:./.socket/vendor/…resolution — zero references survive the migration and all packages install unpatched from the registry, with no error or warning from yarn. A team with a classic-wired repo is one strayyarn@2+ installaway from silently losing its patches.What
vendor::yarn_classic_berry_migration_risk(project_root)— fires whenyarn.lockis classic and carries vendored wiring andpackage.jsonlacks apackageManager: yarn@1…pin (a corepack pin makes stray berry installs refuse instead of migrate). The major version is parsed, soyarn@10doesn't string-matchyarn@1. State-based (reads the on-disk lockfile, not run events), so callers invoke it unconditionally at envelope-finalize: unwired projects, pinned projects, and fully-reverted runs stay silent.warningsarray on the JSON envelope ({code, detail}) for advisories about the project rather than any single package — omitted when empty, so existing consumers see byte-identical output. Human mode gets a stderr line.vendorcommand and both scan vendor flows (sharedrun_scan_vendor_step), emittingyarn_classic_berry_migration_riskwith the pin remediation in the message.Tests
yarn@1.22.22pin suppresses;yarn@4/yarn@10/pnpmpins still warn (theyarn@10case RED-guards the prefix-match bug); unwired/berry/missing lockfiles silent; malformedpackage.jsonfails toward warning.packageManager: yarn@1.22.22pin (with the empty array omitted from JSON entirely); silent again after--revert.Scope note
The hosted (redirect) classic wiring has the same berry-migration exposure — its warning belongs in the rewrite-warnings channel that flow already surfaces; left as a follow-up.
🤖 Generated with Claude Code