Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
@yarnpkg/plugin-git
Advanced tools
@yarnpkg/plugin-git
This plugin adds support for cloning packages from Git repositories.
This plugin is included by default in Yarn.
3.1.0
yarn workspaces list
and yarn workspaces foreach
commands now both support a new --since
option that lets you filter the workspace list by changes (only workspaces that changed since the specified commit will be iterated on). This feature is still a little experimental, especially when used with -R,--recursive
.yarn workspaces foreach
command now handles the fact that a script containing :
only becomes global if it exists in exactly one workspace.yarn workspaces foreach
command now supports --jobs 1
and --jobs unlimited
.yarn init -2
command will now add the packageManager
field to your project manifest.pattern
matcher from logFilters
will now match any part of the log entry.nodeLinker: pnpm
mode will let you install packages using the pnpm install strategy, where packages are stored flat and referenced by each others through symlinks. This mode is still a little experimental, so please send our way bugs you might find.supportedArchitectures
field to manually enforce the presence of specific architectures.nmMode: hardlinks-global
setting will now be automatically downgraded to nmMode: hardlinks-local
when global caches and install folders are kept on different devices, thus letting the install continue normally. A warning will still be produced explaining this behaviour.node_modules
linker maximizes chances to end-up with only one top-level node_modules in the case of using workspacesnmSelfReferences
setting has been added to the nm linker to control whether workspaces are allowed to require themselves - results in creation of self-referencing symlinks. yarn workspaces focus
will not create self-referencing symlinks for excluded workspaces anymore.node_modules
installs.workspace:^
and workspace:~
. When published, those markers will turn into the actual version (just like what used to happen with workspace:*
), except that they'll be prefixed with the relevant semver prefix (respectively ^
and ~
).npmAuditRegistry
setting will let you define which registry to use when running audits. If unset, we'll fallback to the currently configured publish registry (we'll likely change this behavior in Yarn 4 to rather use the fetch registry).node_modules
installs will now be given priority during hoisting, preventing cases when indirect regular dependencies would block the way for direct portal dependencies.pnpify
binary can now be used from inside directories containing spaces.--version
string.node-modules
linker.node-modules
linker, since they cannot be used from the code anyway.fs
module, allowing users to patch it.require.resolve('pnpapi')
will be handled correctly even when using exports
.yarn run
immediately after adding or removing dependencies inside large monorepos.@types
version. This matches the behaviour for peer dependencies.pnpEnableEsmLoader
.resolve
will no longer resolve missing modules to a file with the same name that would happen to be located next to the issuer.FAQs
Unknown package
We found that @yarnpkg/plugin-git demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.