Repository navigation
Upgrade yarn to 4.18.0 - #90
Merged
Merged
Conversation
`yarn set version` writes explicit opt-outs for the supply-chain gates added between 4.13 and 4.18, so the upgrade preserves old behaviour rather than adopting the new defaults. Two of those three are dropped here: - approvedGitRepositories: "**" — removed. The lockfile has no git dependencies, so this only pre-approves ones nobody has vetted yet. - npmMinimalAgeGate: 0 — removed, taking the 1-day default. Newly published versions are quarantined before they can be installed. Verified a clean install still resolves with the gate active. - enableScripts: true — kept. Four packages need build scripts, and simple-git-hooks installs the pre-commit hook from `prepare`. Lockfile churn is 5 lines; no dependency resolutions change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JJ2weaFu4jhu2XirMkbWe
Patch release; no lockfile churn and no dependency resolutions change. `yarn set version` leaves .yarnrc.yml alone this time: it only writes the supply-chain opt-outs when crossing the 4.13-4.18 threshold, so the deliberate choices here (enableScripts kept, npmMinimalAgeGate and approvedGitRepositories dropped) survive untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014JJ2weaFu4jhu2XirMkbWe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
yarn set versionwrites by default.Why
approvedGitRepositories: "**"is dropped because the lockfile has no git dependencies, so it would only pre-approve ones nobody has vetted.npmMinimalAgeGate: 0is dropped to take the 1-day default, quarantining newly published versions; a clean install still resolves with the gate active.enableScripts: trueis kept: four packages need build scripts, and simple-git-hooks installs the pre-commit hook fromprepare.Review Notes
.yarn/releasesbinary swap.