Global mode never finds yarn 1.0.x global packages: `yarn global dir` doesn't exist before yarn 1.1.0, and there's no fallback

未关闭

#437 创建于 2026年10月1日 1 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 68/100

Issue 类型: 缺陷
描述清晰度: 描述清楚
活跃度: 活跃
技术栈: rust
领域: cli, tooling

调研方向

Start in crates/socket-patch-core/src/crawlers/npm_crawler.rs at lines 514 and 1151, then review the existing global-mode tests and yarn-classic-matrix coverage. Reproduce the yarn 1.0.2 case from the issue and compare it with yarn 1.1.0. Done means supported yarn 1.0.x global packages are found or the scan warns instead of reporting a clean success, without regressing the existing matrix.

由索引模型根据 Issue 内容生成。

描述

agent:triaged bug bughunt pm:yarn-classic priority:p1

[agent] Found by the scheduled Yarn classic (1.x) bug-hunt routine (ledger #304).

Summary

scan -g, scan -g --mode agent, get -g, rollback -g and vex -g find yarn's global packages only by running yarn global dir. That subcommand doesn't exist in yarn 1.0.0–1.0.2: it prints error Invalid subcommand. Try "add, bin, ls, list, remove, upgrade, upgrade-interactive" and exits 1. The lookup then returns None, nothing else probes yarn's global folder, and every package installed with yarn global add is silently left out. Every command exits 0 with status: success.

Yarn 1.1.0 added yarn global dir. I bisected through corepack: 1.0.2 exits 1, while 1.1.0, 1.2.1, 1.3.2, 1.4.0, 1.5.1 and 1.6.0 print the folder. The folder itself (~/.config/yarn/global, or /usr/local/share/.config/yarn/global for root, %LOCALAPPDATA%\Yarn\Data\global on Windows) hasn't moved between 1.0 and 1.1.

Impact

It's a silent miss. On a machine with yarn 1.0.x, scan -g reports no patchable yarn-global tools, and scan -g --mode agent exits 0 with applied: 0 while the global copy stays vulnerable. The routine's version range (and CI's yarn-classic-matrix, which starts at 1.0.2) treats 1.0.x as supported, and docs/ecosystems.md doesn't mention this limitation. Yarn 1.0.x is old (2017), so this is low priority, but the result is a false all-clear rather than a refusal.

Repro (Linux sandbox, main `2463257`)

corepack [email protected] global add [email protected]   # lands in /usr/local/share/.config/yarn/global/node_modules (root)
corepack [email protected] global dir                    # error Invalid subcommand …   (exit 1)
# with `yarn` on PATH = yarn 1.0.2, mock patch API serving pkg:npm/[email protected]:
socket-patch scan -g $API --json                  # status success, packages []           <- miss
socket-patch scan -g --mode agent $API --json     # status success, apply.applied 0, exit 0
head -1 /usr/local/share/.config/yarn/global/node_modules/is-number/index.js   # still upstream
# same machine, same global folder, `yarn` = 1.1.0:
socket-patch scan -g $API --json                  # packages ["pkg:npm/[email protected]"]  <- found

Expected vs actual

Expected: CLI_CONTRACT.md documents --global as "Operate on globally-installed packages", with --global-prefix defaulting to "(auto)". The global-mode checklist (ledger #304) requires scan -g to find every globally installed package, with none missing. When yarn is on PATH but yarn global dir fails, socket-patch should fall back to yarn's default global folder (or yarn global bin's sibling, or .yarnrc global-folder). Failing that, it should warn that yarn's global folder couldn't be determined, rather than report a clean scan.
Actual: yarn-global packages are invisible, with exit 0.

OS × yarn matrix (probe run, plus the Linux sandbox)

OS	yarn 1.0.2	yarn 1.10.1	yarn 1.22.22
Linux (sandbox + ubuntu-latest)	miss (`scan_report`, `agent_apply`, `vex` fail)	pass	pass
macOS (macos-latest)	miss	pass	pass
Windows (windows-latest)	miss (also #434)	miss, see #434	miss, see #434

On Windows every yarn version misses, for a separate reason: the bare yarn spawn never resolves yarn.cmd, which is tracked in #434. 1.0.x would still miss after that fix.

Suspect code

crates/socket-patch-core/src/crawlers/npm_crawler.rs:514: get_yarn_global_prefix_with runs only yarn global dir. None (non-zero exit) is final.
crates/socket-patch-core/src/crawlers/npm_crawler.rs:1151: get_global_node_modules_paths has no yarn fallback. The only fallbacks are the macOS-only npm ones.

Probe run: https://github.com/SocketDev/socket-patch/actions/runs/36827174726 (jobs global * yarn 1.0.2 print global dir: yarn global v1.0.2 … /node_modules and scan_report … result=FAIL).

主要语言: Rust
星标: 8
派生: 0
平均合并: 19 小时 44 分钟
30 天内合并 PR: 450

环境准备

没有 Dockerfile 或 Docker Compose 文件
没有 Pull Request 模板
阅读贡献指南

从这里开始

先读完整个 Issue，再读项目的贡献指南。
在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
Fork 仓库，在一个分支上完成修改。
提交 Pull Request，并在描述里引用这个 Issue 编号。

SocketDev/socket-patch 的其他 Issue

vendor --revert with a lost vendor ledger tells you to "run socket-patch repair to re-adopt them into the ledger", but repair refuses because it never rebuilds the ledger, so the advice loops and the vendored npm packages can't be reverted
未关闭
- 哪里不对？
agent:triaged bug bughunt pm:npm priority:p3

难度 2/5 1-3 小时新手友好度 75/100

SocketDev/socket-patch#1072 · 1 条评论 · 2026年10月7日创建

维护者通常 1 天内回复
Gem `BUNDLE_GEMFILE` check compares paths lexically, so a symlinked spelling of the project's own Gemfile (e.g. macOS `/tmp/app/Gemfile`) is refused, and `vex` / `rollback` reject the hosted patch Bundler is loading
未关闭
- 哪里不对？
agent:triaged bug bughunt pm:bundler priority:p1

难度 2/5 1-3 小时新手友好度 85/100

SocketDev/socket-patch#896 · 1 条评论 · 2026年10月5日创建

维护者通常 1 天内回复
Vendored yarn berry misses a parent-scoped user `resolutions` entry (`pkg-a/left-pad`), reports success, and every `yarn install --immutable` fails YN0028
未关闭
- 哪里不对？
agent:triaged bug bughunt pm:yarn-berry priority:p1

难度 2/5 1-3 小时新手友好度 73/100

SocketDev/socket-patch#783 · 1 条评论 · 2026年10月4日创建

维护者通常 1 天内回复
Vendored cargo warns cargo_multi_version_old_cargo ("declares no rust-version") when the root package inherits rust-version from [workspace.package]
未关闭
- 哪里不对？
agent:triaged bug bughunt pm:cargo priority:p2

难度 2/5 1-3 小时新手友好度 84/100

SocketDev/socket-patch#651 · 3 条评论 · 2026年10月3日创建

维护者通常 1 天内回复
CI perf: e2e-build-windows — full Windows test build is the merge-queue critical path in 27/30 runs (~2.5 min off every merge)
可能已有人在做 @mikolalysenko 今天认领。未关闭
- 哪里不对？
agent:claimed agent:triaged ci-perf priority:p3

难度 3/5 1-2 天新手友好度 30/100

SocketDev/socket-patch#1385 · 2 条评论 · 2026年10月11日创建

维护者通常 1 天内回复

查看 SocketDev/socket-patch 的全部 Issue

相似的 Issue

perf(hstr): inline Atom::as_str for cross-crate string access
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 76/100

swc-project/swc#12516 · 2026年10月12日创建

维护者通常 1 天内回复
mls-rs-crypto-awslc: exact aws-lc-rs =1.16.3 pin blocks rustls security update
可能已有人在做 @muscariello 今天认领。未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 65/100

awslabs/mls-rs#397 · 2026年10月12日创建
[work-item] adam-adae-worsening-emergence: conform spec.yaml to the specification style contract (REQ-1280)
可能已有人在做 @muse-yamaa-bot 今天认领。未关闭
- 哪里不对？
work-item

难度 1/5 1-3 小时新手友好度 82/100

elong0527/yamaa#2054 · 2026年10月12日创建

维护者通常 1 天内回复
[Bug]:设置的关于页面，“系统信息”部分排版异常
未关闭
- 哪里不对？
bug

难度 2/5 1-3 小时新手友好度 63/100

metasequoiaime/msime#7328 · 2026年10月12日创建

维护者通常 1 天内回复
[Bug] ECU-SIM does not use the recordNumber in the client request for DTC Read requests
未关闭
- 哪里不对？
bug

难度 2/5 1-3 小时新手友好度 72/100

eclipse-opensovd/classic-diagnostic-adapter#616 · 2026年10月12日创建

维护者通常 2 天内回复

更多 Rust Issue

Global mode never finds yarn 1.0.x global packages: `yarn global dir` doesn't exist before yarn 1.1.0, and there's no fallback

哪里不对？

评估

调研方向

描述

Summary

Impact

Repro (Linux sandbox, main 2463257)

Expected vs actual

OS × yarn matrix (probe run, plus the Linux sandbox)

Suspect code

环境准备

从这里开始

SocketDev/socket-patch 的其他 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

相似的 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

把新 issue 发到你的邮箱

Repro (Linux sandbox, main `2463257`)