fix(plugin-typescript): add a timeout to the Algolia auto-types lookup - #7206
Open
sebdanielsson wants to merge 2 commits into
Open
fix(plugin-typescript): add a timeout to the Algolia auto-types lookup#7206sebdanielsson wants to merge 2 commits into
sebdanielsson wants to merge 2 commits into
Conversation
Author
|
CI failures seem to be pre-existing. |
sebdanielsson
force-pushed
the
claude/berry-7111-fix-8doaul
branch
from
July 1, 2026 17:04
2ac69a6 to
0749d72
Compare
There was a problem hiding this comment.
Pull request overview
This PR addresses yarn add hanging in network-restricted environments by bounding the optional Algolia lookup used by @yarnpkg/plugin-typescript to decide whether to add a matching @types/* dependency, and by improving resilience to connection errors.
Changes:
- Add a 10s timeout wrapper around the Algolia
npm-searchlookup and warn (then continue) on timeout/network failure. - Harden the Algolia requester error path to avoid throwing when
error.responseis missing. - Add a versioning file to release
@yarnpkg/plugin-typescriptas a patch.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| packages/plugin-typescript/sources/typescriptUtils.ts | Adds a timeout + warning path for the Algolia auto-types lookup and guards requester error handling. |
| .yarn/versions/7111fix0.yml | Declares a patch release for @yarnpkg/plugin-typescript. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
sebdanielsson
force-pushed
the
claude/berry-7111-fix-8doaul
branch
from
July 18, 2026 16:04
0749d72 to
a9c7b69
Compare
sebdanielsson
force-pushed
the
claude/berry-7111-fix-8doaul
branch
from
July 29, 2026 13:44
a9c7b69 to
6ecd751
Compare
Author
|
@clemyan What do you think about this change? |
Bound the optional Algolia auto-types lookup to 10 seconds and cancel the underlying Yarn HTTP request when the deadline expires, including active proxy tunnels. This releases the network concurrency slot and prevents Algolia from retrying fallback hosts after the command has already continued. Warn clearly on timeout or network failure, continue without the matching @types package, and harden transport errors that have no response. Add deterministic cancellation and warning coverage. Closes yarnpkg#7111 Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NS1JKnVAz9uPwdyUhfub2g Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
sebdanielsson
force-pushed
the
claude/berry-7111-fix-8doaul
branch
from
July 30, 2026 10:13
6ecd751 to
99d459a
Compare
clemyan
requested changes
Aug 3, 2026
clemyan
left a comment
clemyan
left a comment
Member
There was a problem hiding this comment.
The behavioral side of the fix is good. Left a few comments regarding the tests and complexity.
However, I am still unsure whether this is the correct approach. On one hand, it is a small, cotained change that is unlikely to adversely affect other things. On the other, being stuck on socket connection can happen to any HTTP requests, so I wonder if we should just apply httpTimeout end-to-end for all HTTP requests using the same method.
@arcanis wdyt?
The `afterWorkspaceDependencyAddition` and `afterWorkspaceDependencyReplacement` hooks were triggered outside of any report, so warnings they emitted (such as the new plugin-typescript one) were printed as raw Node.js process warnings instead of regular Yarn messages. Also addresses the review feedback on yarnpkg#7206: - drops the `Promise.race` in `hasDefinitelyTyped` in favour of checking `signal.aborted` in the `catch` clause - rewrites the httpUtils cancellation tests around `events.once`, `server.closeAllConnections()`, and `setTimeout` from `timers/promises` - adds an acceptance test covering an unreachable Algolia index - releases `@yarnpkg/cli` and `@yarnpkg/plugin-essentials` Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0158RapNp7NHWhFqHp3gKNxm
2 tasks
arcanis
added a commit
to yarnpkg/zpm
that referenced
this pull request
Aug 15, 2026
## What's the problem this PR addresses? A review of recent Berry PRs identified several fixes and regression tests that also apply to zpm. This PR backports them in one batch. ## How did I fix it? **Bug fixes (the ported regression tests reproduced each of these before the fix):** - yarnpkg/berry#7205 — `*` now resolves to prereleases when a package has no stable version. The fallback only applies to a literal `*` range (not the internal `>=0.0.0-0` any-range), and `--check-resolutions` accepts the resulting prerelease pins. - yarnpkg/berry#7216 — the nm linker now prefers direct dependency binaries over transitively-hoisted aliases when two packages expose the same bin name, instead of resolving collisions by ident order. - yarnpkg/berry#7209 — commands that need an npm OTP now fail with a `--otp` hint when not attached to an interactive terminal, instead of blocking forever on a prompt. - yarnpkg/berry#7255 — `yarn npm audit --recursive --environment production` no longer reports advisories only reachable through a nested workspace's devDependencies. - yarnpkg/berry#7253 — `yarn info --virtuals` now reports base descriptors alongside virtual locators (zpm had the mirror image of Berry's bug: correct locators, virtualized descriptors). - yarnpkg/berry#7206 — a failed Algolia auto-types lookup no longer aborts `yarn add`; it degrades to a warning (with the `enableAutoTypes` escape hatch) and the lookup is bounded by a 10s per-request timeout. **Feature:** - yarnpkg/berry#7243 — `supportedArchitectures` additionally accepts a list of explicit os/cpu/libc combinations (matched per-entry, no cross-product), with the same config syntax as Berry. **Tests only (zpm's behavior was already correct):** - yarnpkg/berry#7250 / yarnpkg/berry#7257 — gate bypass for packages without release-time metadata, plus the `no-time-deps` fixture and registry-mock support. - yarnpkg/berry#7214 — scoped-gate inheritance tests, adapted to zpm's `packageRules`/`sourceRules` model (zpm's Option-based overrides make Berry's default-shadowing bug structurally impossible). **Artifact sync:** - Re-ran `scripts/import-artifacts.mjs` against Berry master, picking up yarnpkg/berry#7232 and the extensions hunk of yarnpkg/berry#7228 (8 new package extensions: 5 Volar `typescript` peers, `vite-plugin-vue-devtools`, 2 Parcel entries) along with forward-only PnP hook/patch updates. ## Checklist - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing). - [x] I have checked that all the impacted tests pass: the touched acceptance suites (npmMinimalAgeGate, prunedNativeDeps, protocols/npm, npm/audit, info, publish, node-modules, packageExtensions, checkResolutions, add) pass 215/218 (3 skipped), plus `cargo test` for zpm-config (7) and zpm-semver (108). The only remaining local failures reproduce identically on a pristine `main` build (venv/Python environment, one live-Algolia-data test, `path_iterators` and two lazyInstalls focus-coverage tests). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches core install resolution, architecture filtering, and audit traversal; behavior changes are intentional but affect many installs and multi-arch fetches. > > **Overview** > Backports a batch of Berry fixes and tests into zpm, covering install resolution, CLI behavior, configuration, and artifact sync. > > **Resolution & install:** Literal `*` ranges can resolve to prereleases when no stable versions exist, with matching `--check-resolutions` acceptance. Algolia auto-`@types` lookup is capped at 10s, warns instead of failing `yarn add`, and respects `enableAutoTypes`. HTTP requests gain a per-request `.timeout()` bounded by `httpTimeout`. > > **Commands & linkers:** `npm publish` errors with a `--otp` hint when not on an interactive TTY. Recursive production `npm audit` skips nested workspaces’ devDependencies. `yarn info --virtuals` shows physical descriptors with virtual locators. Node-modules bin symlinks prefer direct dependencies over hoisted aliases. > > **`supportedArchitectures`:** Schema becomes a `oneOrMany` list of entries with `ArchitectureFilter` fields (`null` = any). Legacy single-object YAML still works; project config replaces (not merges) user entries. Matching uses `SystemSet` / `supported_systems()` with per-entry validation instead of a flat cross-product of all systems. > > **Artifacts:** `builtin-extensions.json` gains Volar, Vite devtools, and Parcel peer entries; package manager pin updated. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4aaf6a1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's the problem this PR addresses?
Closes #7111
yarn addqueries Algolia'snpm-searchindex to detect whether the added package needs a matching@typespackage. In our corporate network, all egress traffic traverses our HTTP proxy. If this is set globally usingHTTPS_PROXY,HTTP_PROXY, andNO_PROXY, but not explicitly with Yarn's HTTP proxy config, this query will not go through the proxy but will instead try to make a direct connection. In our case, this means the firewall silently drops the connection.httpTimeoutis not what's bounding a single attempt. I dropped it from 15s to 10s and got an identical ~135s per attempt. The wait is the Linux kernel's TCP SYN-retry exhaustion (default tcp_syn_retries=6, ~127–135s in my tests). Because the TCP socket never establishes, got's timeout.socket (which is socket-inactivity-after-connect) never starts. Got then retries httpRetry times, which multiplies the dead time.My tests:
httpTimeout=10s httpRetry=0httpTimeout=10s httpRetry=1httpTimeout=15s httpRetry=1httpTimeout=1m httpRetry=3)How did you fix it?
This caps the lookup at 10s and, on timeout or network failure, warns the user (pointing at the
tsEnableAutoTypes: false/YARN_TS_ENABLE_AUTO_TYPES="false"escape hatch) before letting the install proceed without the@typespackage. It also hardens the Algolia requester so a connection error without aresponseno longer throws an unrelatedTypeError.Future fixes
My last comment in the linked issue proposes additional fixes to make this more stable, but I wanted to keep this PR small and easy to review. A future enhancement would be to have the Algolia lookup respect the global HTTP environments, just like the installation does today.
Checklist