Repository navigation
Conversation
…rn yarn Modern yarn (`yarn npm info`) silently falls back to the `latest` version with exit code 0 not only when a requested SemVer version or range is unmet, but also when a requested dist-tag does not exist. Previously, `getRegistryManifest` only checked valid SemVer ranges, allowing unknown dist-tags to resolve to `latest`. Include `dist-tags` in modern yarn's requested `--fields` and add `parseYarnModernManifest` to verify that non-range version specifiers exist in `dist-tags` and resolve to the returned manifest version before stripping `dist-tags` from the result. Move the SemVer range validation inside `#fetchAndParse`'s parser callback so rejected fallback manifests are cached directly as `null` rather than storing the mismatched manifest object, and scope `includePrerelease` to wildcard (`*`) specifiers so unmet major or x-ranges do not accept prerelease `latest` fallbacks.
… keys The resolved-version manifest cache entry was stored using an unquoted `name@version` key while lookups on hosts that require shell quoting used a quoted key, so the entry was never reused. Both keys are now derived from the unquoted specifier.
clydin
marked this pull request as ready for review
November 2, 2026 22:23
There was a problem hiding this comment.
Code Review
This pull request improves package manifest retrieval and caching, specifically addressing modern Yarn's behavior of silently falling back to the latest version when a requested version, range, or dist-tag does not exist. It introduces a new parseYarnModernManifest parser to validate dist-tags and strip them from the returned manifest, updates PackageManager.getRegistryManifest to validate version ranges, and implements a stable cache key generator (#getManifestCacheKey) to handle environments requiring shell quoting. Comprehensive unit tests have been added to verify these changes. There are no review comments to assess, and I have no additional feedback to provide.
alan-agius4
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Modern yarn (
yarn npm info) silently falls back to thelatestversion with exit code 0 notonly when a requested SemVer version or range is unmet, but also when a requested dist-tag does
not exist. Previously,
getRegistryManifestonly checked valid SemVer ranges, allowing unknowndist-tags to resolve to
latest.Include
dist-tagsin modern yarn's requested--fieldsand addparseYarnModernManifesttoverify that non-range version specifiers exist in
dist-tagsand resolve to the returnedmanifest version before stripping
dist-tagsfrom the result.Move the SemVer range validation inside
#fetchAndParse's parser callback so rejected fallbackmanifests are cached directly as
nullrather than storing the mismatched manifest object, andscope
includePrereleaseto wildcard (*) specifiers so unmet major or x-ranges do not acceptprerelease
latestfallbacks.