fix(npm-audit): exclude nested workspace dev dependencies in production - #7255
Open
tianrking wants to merge 1 commit into
Open
fix(npm-audit): exclude nested workspace dev dependencies in production#7255tianrking wants to merge 1 commit into
tianrking wants to merge 1 commit into
Conversation
2 tasks
arcanis
added a commit
to yarnpkg/zpm
that referenced
this pull request
Aug 15, 2026
## What's the problem this PR addresses? A review of recent Berry PRs identified several fixes and regression tests that also apply to zpm. This PR backports them in one batch. ## How did I fix it? **Bug fixes (the ported regression tests reproduced each of these before the fix):** - yarnpkg/berry#7205 — `*` now resolves to prereleases when a package has no stable version. The fallback only applies to a literal `*` range (not the internal `>=0.0.0-0` any-range), and `--check-resolutions` accepts the resulting prerelease pins. - yarnpkg/berry#7216 — the nm linker now prefers direct dependency binaries over transitively-hoisted aliases when two packages expose the same bin name, instead of resolving collisions by ident order. - yarnpkg/berry#7209 — commands that need an npm OTP now fail with a `--otp` hint when not attached to an interactive terminal, instead of blocking forever on a prompt. - yarnpkg/berry#7255 — `yarn npm audit --recursive --environment production` no longer reports advisories only reachable through a nested workspace's devDependencies. - yarnpkg/berry#7253 — `yarn info --virtuals` now reports base descriptors alongside virtual locators (zpm had the mirror image of Berry's bug: correct locators, virtualized descriptors). - yarnpkg/berry#7206 — a failed Algolia auto-types lookup no longer aborts `yarn add`; it degrades to a warning (with the `enableAutoTypes` escape hatch) and the lookup is bounded by a 10s per-request timeout. **Feature:** - yarnpkg/berry#7243 — `supportedArchitectures` additionally accepts a list of explicit os/cpu/libc combinations (matched per-entry, no cross-product), with the same config syntax as Berry. **Tests only (zpm's behavior was already correct):** - yarnpkg/berry#7250 / yarnpkg/berry#7257 — gate bypass for packages without release-time metadata, plus the `no-time-deps` fixture and registry-mock support. - yarnpkg/berry#7214 — scoped-gate inheritance tests, adapted to zpm's `packageRules`/`sourceRules` model (zpm's Option-based overrides make Berry's default-shadowing bug structurally impossible). **Artifact sync:** - Re-ran `scripts/import-artifacts.mjs` against Berry master, picking up yarnpkg/berry#7232 and the extensions hunk of yarnpkg/berry#7228 (8 new package extensions: 5 Volar `typescript` peers, `vite-plugin-vue-devtools`, 2 Parcel entries) along with forward-only PnP hook/patch updates. ## Checklist - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing). - [x] I have checked that all the impacted tests pass: the touched acceptance suites (npmMinimalAgeGate, prunedNativeDeps, protocols/npm, npm/audit, info, publish, node-modules, packageExtensions, checkResolutions, add) pass 215/218 (3 skipped), plus `cargo test` for zpm-config (7) and zpm-semver (108). The only remaining local failures reproduce identically on a pristine `main` build (venv/Python environment, one live-Algolia-data test, `path_iterators` and two lazyInstalls focus-coverage tests). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches core install resolution, architecture filtering, and audit traversal; behavior changes are intentional but affect many installs and multi-arch fetches. > > **Overview** > Backports a batch of Berry fixes and tests into zpm, covering install resolution, CLI behavior, configuration, and artifact sync. > > **Resolution & install:** Literal `*` ranges can resolve to prereleases when no stable versions exist, with matching `--check-resolutions` acceptance. Algolia auto-`@types` lookup is capped at 10s, warns instead of failing `yarn add`, and respects `enableAutoTypes`. HTTP requests gain a per-request `.timeout()` bounded by `httpTimeout`. > > **Commands & linkers:** `npm publish` errors with a `--otp` hint when not on an interactive TTY. Recursive production `npm audit` skips nested workspaces’ devDependencies. `yarn info --virtuals` shows physical descriptors with virtual locators. Node-modules bin symlinks prefer direct dependencies over hoisted aliases. > > **`supportedArchitectures`:** Schema becomes a `oneOrMany` list of entries with `ArchitectureFilter` fields (`null` = any). Legacy single-object YAML still works; project config replaces (not merges) user entries. Matching uses `SystemSet` / `supported_systems()` with per-entry validation instead of a flat cross-product of all systems. > > **Artifacts:** `builtin-extensions.json` gains Volar, Vite devtools, and Parcel peer entries; package manager pin updated. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4aaf6a1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's the problem this PR addresses?
yarn npm audit --recursive --environment productionfollows the merged dependency map of nested workspace packages. That map includes each workspace's development dependencies, so advisories reachable only through those development dependencies are incorrectly reported as production vulnerabilities.Closes #6222.
How did you fix it?
The audit traversal now receives the selected environment. When recursively visiting a workspace package in the production environment, it skips descriptors declared in that workspace's
devDependencies; the default audit environment continues to include them.The regression creates a root workspace with a production dependency on another workspace whose only vulnerable package is a development dependency. It verifies that production recursive audit succeeds while the default recursive audit still reports the advisory.
Validated with:
yarn workspace acceptance-tests test:integration pkg-tests-specs/sources/commands/npm/audit.test.ts -t 'development dependencies of nested workspaces in production' --runInBandyarn eslint --max-warnings 0 packages/plugin-npm-cli/sources/npmAuditUtils.ts packages/plugin-npm-cli/sources/commands/npm/audit.ts packages/acceptance-tests/pkg-tests-specs/sources/commands/npm/audit.test.tsyarn build:cliyarn version checkyarn constraintsChecklist