fix(nm): prefer direct dependency binaries - #7216
Merged
Merged
Conversation
Constraint: Preserve stable traversal order while preventing transitive bin overwrites. Confidence: high Scope-risk: narrow Tested: node-modules acceptance tests; yarn test:lint; yarn typecheck:all; yarn constraints; yarn version check Not-tested: Windows-specific shim execution locally
Contributor
Author
|
Thanks for the review! |
|
Hello, Many thanks to @ychampion for the fix! Any plans to make a release anytime soon? I'm pretty sure that the issue is currently blocking many Yarn users from being able to use TypeScript 7 with TS6 API bridge. CC @larixer |
larixer
enabled auto-merge
July 17, 2026 05:01
Member
|
@AndrewMax I don't have power to make Yarn releases, I can only review and merge PRs if they pass required tests. |
6 tasks
2 tasks
arcanis
added a commit
to yarnpkg/zpm
that referenced
this pull request
Aug 15, 2026
## What's the problem this PR addresses? A review of recent Berry PRs identified several fixes and regression tests that also apply to zpm. This PR backports them in one batch. ## How did I fix it? **Bug fixes (the ported regression tests reproduced each of these before the fix):** - yarnpkg/berry#7205 — `*` now resolves to prereleases when a package has no stable version. The fallback only applies to a literal `*` range (not the internal `>=0.0.0-0` any-range), and `--check-resolutions` accepts the resulting prerelease pins. - yarnpkg/berry#7216 — the nm linker now prefers direct dependency binaries over transitively-hoisted aliases when two packages expose the same bin name, instead of resolving collisions by ident order. - yarnpkg/berry#7209 — commands that need an npm OTP now fail with a `--otp` hint when not attached to an interactive terminal, instead of blocking forever on a prompt. - yarnpkg/berry#7255 — `yarn npm audit --recursive --environment production` no longer reports advisories only reachable through a nested workspace's devDependencies. - yarnpkg/berry#7253 — `yarn info --virtuals` now reports base descriptors alongside virtual locators (zpm had the mirror image of Berry's bug: correct locators, virtualized descriptors). - yarnpkg/berry#7206 — a failed Algolia auto-types lookup no longer aborts `yarn add`; it degrades to a warning (with the `enableAutoTypes` escape hatch) and the lookup is bounded by a 10s per-request timeout. **Feature:** - yarnpkg/berry#7243 — `supportedArchitectures` additionally accepts a list of explicit os/cpu/libc combinations (matched per-entry, no cross-product), with the same config syntax as Berry. **Tests only (zpm's behavior was already correct):** - yarnpkg/berry#7250 / yarnpkg/berry#7257 — gate bypass for packages without release-time metadata, plus the `no-time-deps` fixture and registry-mock support. - yarnpkg/berry#7214 — scoped-gate inheritance tests, adapted to zpm's `packageRules`/`sourceRules` model (zpm's Option-based overrides make Berry's default-shadowing bug structurally impossible). **Artifact sync:** - Re-ran `scripts/import-artifacts.mjs` against Berry master, picking up yarnpkg/berry#7232 and the extensions hunk of yarnpkg/berry#7228 (8 new package extensions: 5 Volar `typescript` peers, `vite-plugin-vue-devtools`, 2 Parcel entries) along with forward-only PnP hook/patch updates. ## Checklist - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing). - [x] I have checked that all the impacted tests pass: the touched acceptance suites (npmMinimalAgeGate, prunedNativeDeps, protocols/npm, npm/audit, info, publish, node-modules, packageExtensions, checkResolutions, add) pass 215/218 (3 skipped), plus `cargo test` for zpm-config (7) and zpm-semver (108). The only remaining local failures reproduce identically on a pristine `main` build (venv/Python environment, one live-Algolia-data test, `path_iterators` and two lazyInstalls focus-coverage tests). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches core install resolution, architecture filtering, and audit traversal; behavior changes are intentional but affect many installs and multi-arch fetches. > > **Overview** > Backports a batch of Berry fixes and tests into zpm, covering install resolution, CLI behavior, configuration, and artifact sync. > > **Resolution & install:** Literal `*` ranges can resolve to prereleases when no stable versions exist, with matching `--check-resolutions` acceptance. Algolia auto-`@types` lookup is capped at 10s, warns instead of failing `yarn add`, and respects `enableAutoTypes`. HTTP requests gain a per-request `.timeout()` bounded by `httpTimeout`. > > **Commands & linkers:** `npm publish` errors with a `--otp` hint when not on an interactive TTY. Recursive production `npm audit` skips nested workspaces’ devDependencies. `yarn info --virtuals` shows physical descriptors with virtual locators. Node-modules bin symlinks prefer direct dependencies over hoisted aliases. > > **`supportedArchitectures`:** Schema becomes a `oneOrMany` list of entries with `ArchitectureFilter` fields (`null` = any). Legacy single-object YAML still works; project config replaces (not merges) user entries. Matching uses `SystemSet` / `supported_systems()` with per-entry validation instead of a flat cross-product of all systems. > > **Artifacts:** `builtin-extensions.json` gains Volar, Vite devtools, and Parcel peer entries; package manager pin updated. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4aaf6a1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's the problem this PR addresses?
Closes #7215.
With the node-modules linker, packages that export the same binary currently overwrite each other in traversal order. A transitive alias can therefore replace a direct dependency binary, as in the TypeScript 6/7 setup where
.bin/tscpoints to@typescript/old.How did you fix it?
Bin collection now keeps the first target for a name, preserving the direct dependency encountered before its transitive dependency.
The regression uses aliased fixture packages and checks both the persisted root bin target and the generated
.binexecutable.Validation
corepack yarn build:clicorepack yarn workspace acceptance-tests test:integration --runTestsByPath "$PWD/packages/acceptance-tests/pkg-tests-specs/sources/node-modules.test.ts" --runInBand(63 passed, 2 platform-specific skipped)corepack yarn test:lintcorepack yarn typecheck:allcorepack yarn constraintscorepack yarn version checkChecklist