Vendored yarn berry misses a parent-scoped user `resolutions` entry (`pkg-a/left-pad`), reports success, and every `yarn install --immutable` fails YN0028
Maintainer antworten meist innerhalb von 1 Tag
Dieses Issue hat noch niemand übernommen.
Bewertung
- Schwierigkeit
- 2/5
- Geschätzter Aufwand
- 1-3 Stunden
- Anfängerfreundlichkeit
- 73/100
Rechercherichtung
Beginne in crates/socket-patch-core/src/vendor/yarn_berry_lock.rs bei resolutions_gate und vergleiche die Behandlung von Selektoren mit resolution_selector_target() in derselben Datei. Prüfe, wie das Gate einen auf ein übergeordnetes Paket beschränkten Selektor wie pkg-a/left-pad behandelt. Fertig ist es, wenn der Vendoring-Modus bei diesem Fall mit vendor_override_conflict ablehnt und nichts schreibt.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Beschreibung
[agent] Found by the scheduled Yarn Berry (2+) bug-hunt routine (ledger #305).
Summary
Vendored mode's user-override gate only recognizes resolutions selectors whose descriptor name is the target (left-pad, left-pad@^1.3.0, left-pad@npm:1.3.0). A parent-scoped selector such as "pkg-a/left-pad": "1.3.0" (or "pkg-a/left-pad@^1.3.0", or "<root-name>/left-pad") is not recognized. Vendored mode then adds its own bare "left-pad": "file:./.socket/vendor/…" pin next to the user's entry, rewrites the lock entry to the file: locator, and reports success.
Yarn applies the more specific parent-scoped resolution first, so it resolves left-pad@npm:1.3.0 for that parent, and the lock socket-patch wrote no longer matches. Every fresh yarn install --immutable fails with YN0028. A plain yarn install silently drops the vendored entry and installs the unpatched registry bytes. vex then correctly attests nothing, but scan had already reported success.
Hosted mode handles the same project correctly: it refuses with redirect_yarn_berry_resolutions_conflict and writes nothing, because it uses resolution_selector_target().
Impact
A monorepo that pins a dependency for one workspace (a common use of yarn's parent/name resolutions) gets a vendored "success" that breaks CI (--immutable), or installs unpatched code on a mutable install.
Repro (yarn 4.18.1, node-modules linker, Linux)
mkdir -p proj/packages/pkg-a && cd proj
echo '{"name":"root","private":true,"workspaces":["packages/*"],"resolutions":{"pkg-a/left-pad":"1.3.0"}}' > package.json
echo '{"name":"pkg-a","version":"1.0.0","dependencies":{"left-pad":"^1.3.0"}}' > packages/pkg-a/package.json
printf 'nodeLinker: node-modules\n' > .yarnrc.yml
yarn install # lock: "left-pad@npm:1.3.0"; package.json keeps "pkg-a/left-pad"
socket-patch scan --mode vendored --json --yes --cwd . # a [email protected] patch is available
# -> status "success", vendor.summary.applied 1
cat package.json
# "resolutions": { "pkg-a/left-pad": "1.3.0",
# "left-pad": "file:./.socket/vendor/npm/<uuid>/left-pad-1.3.0.tgz" }
rm -rf node_modules .yarn/install-state.gz && yarn install --immutable
# ➤ YN0028: -"left-pad@file:./.socket/vendor/npm/<uuid>/left-pad-1.3.0.tgz::locator=root%40workspace%3A.":
# ➤ YN0028: +"left-pad@npm:1.3.0":
# ➤ YN0028: The lockfile would have been modified by this install, which is explicitly forbidden.
yarn install && head -c 60 node_modules/left-pad/index.js # unpatched registry bytes
The patch data came from a local mock of the patch API (/v0/orgs/<org>/patches/{batch,by-package,view,package} plus the tarball route), using a patched left-pad 1.3.0 tarball with a marker prepended to index.js. It reproduced on every attempt (more than 10 runs across the cells below).
Expected vs actual
- Expected: refused with
vendor_override_conflictand nothing written. CLI_CONTRACT.md: "vendor_override_conflict… vendor (pnpm/yarn-berry): a user-authored override/resolution for the package already exists." The gate's own doc comment says "Anything else same-name still refuses". Hosted mode refuses the same selector shapes ("bare, ranged or nested", docs/testing/yarn-berry-compatibility.md). - Actual:
success. The user's entry is kept, a second conflicting pin is added, and the lock is left in a state yarn rejects.
Matrix (Linux; the Windows and macOS probes are blocked, see ledger #305)
| user selector | yarn 4.0.2 | yarn 4.12.0 | yarn 4.18.1 |
|---|---|---|---|
pkg-a/left-pad |
fail (YN0028) | fail | fail |
pkg-a/left-pad@^1.3.0 |
fail | fail | fail |
<root-name>/left-pad (app/left-pad) |
n/t | n/t | fail |
left-pad, left-pad@^1.3.0, left-pad@npm:1.3.0 |
refused (correct) | — | refused (correct) |
| hosted mode, any of the above | — | — | refused redirect_yarn_berry_resolutions_conflict (correct) |
(**/left-pad: "1.3.0" isn't a useful control: yarn 4 drops that entry from package.json on its own yarn install, before socket-patch runs.)
First bad version: not a regression. Release 4.0.0 (npm @socketsecurity/[email protected]) behaves the same way. Tested on main 045d7ec.
Suspect code
crates/socket-patch-core/src/vendor/yarn_berry_lock.rs:524-528 (resolutions_gate) derives the selector's name with split_pattern(selector), which returns the whole string pkg-a/left-pad (≠ left-pad), so the continue skips it. resolution_selector_target() in the same file (:1471), which hosted (patch/redirect/mod.rs:4058) and vex discovery already use, returns left-pad for parent/left-pad, @scope/parent/left-pad and so on. Using it here would refuse the parent-scoped forms, keeping the bare exact-version takeover (selector == name) as it is.
- Vorherrschende Sprache
- Rust
- Sterne
- 8
- Forks
- 0
- Ø Merge
- 1 T. 7 Min.
- Gemergte PRs (30 T.)
- 178
Entwicklungsumgebung
- Kein Dockerfile und keine Docker-Compose-Datei
- Keine Pull-Request-Vorlage
- Beitragsleitfaden lesen
Erste Schritte
- Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
- Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
- Forken Sie das Repository und arbeiten Sie in einem Branch.
- Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.
Mehr aus SocketDev/socket-patch
-
Hosted yarn classic pins give no berry-migration warning, so a yarn 2+ install silently drops them (vendored warns about the same trap)Evtl. vergeben @mikolalysenko hat das heute übernommen. Offenagent:claimed agent:triaged bug bughunt pm:yarn-classic priority:p1
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 85/100
SocketDev/socket-patch#907 · 2 Kommentare ·
Maintainer antworten meist innerhalb von 1 Tag
-
agent:triaged bug bughunt pm:npm priority:p1
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 75/100
SocketDev/socket-patch#900 ·
Maintainer antworten meist innerhalb von 1 Tag
-
agent:triaged bug bughunt pm:bundler priority:p1
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 85/100
SocketDev/socket-patch#896 · 1 Kommentar ·
Maintainer antworten meist innerhalb von 1 Tag
-
agent:triaged bug bughunt pm:pipenv priority:p1
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 83/100
SocketDev/socket-patch#744 · 1 Kommentar ·
Maintainer antworten meist innerhalb von 1 Tag
-
agent:triaged bug bughunt pm:cargo priority:p2
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 84/100
SocketDev/socket-patch#651 · 3 Kommentare ·
Maintainer antworten meist innerhalb von 1 Tag
Alle Issues in SocketDev/socket-patch
Ähnliche Issues
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 75/100
Maintainer antworten meist innerhalb von 1 Tag
-
check: a failed re-read of the model file before binding is labelled E_THETA_LEVEL_BINDING on [parameters]Evtl. vergeben @TeunP hat das heute übernommen. Offen
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 65/100
Maintainer antworten meist innerhalb von 1 Tag
-
Schwierigkeit 1/5 Unter einer Stunde Anfängerfreundlichkeit 80/100
Devolutions/picky-rs#546 · 1 Kommentar ·
Maintainer antworten meist innerhalb von 3 Tagen
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 76/100
Maintainer antworten meist innerhalb von 1 Tag
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 74/100
Maintainer antworten meist innerhalb von 1 Tag