Conversation
2 tasks
arcanis
added a commit
to yarnpkg/zpm
that referenced
this pull request
Aug 15, 2026
## What's the problem this PR addresses? A review of recent Berry PRs identified several fixes and regression tests that also apply to zpm. This PR backports them in one batch. ## How did I fix it? **Bug fixes (the ported regression tests reproduced each of these before the fix):** - yarnpkg/berry#7205 — `*` now resolves to prereleases when a package has no stable version. The fallback only applies to a literal `*` range (not the internal `>=0.0.0-0` any-range), and `--check-resolutions` accepts the resulting prerelease pins. - yarnpkg/berry#7216 — the nm linker now prefers direct dependency binaries over transitively-hoisted aliases when two packages expose the same bin name, instead of resolving collisions by ident order. - yarnpkg/berry#7209 — commands that need an npm OTP now fail with a `--otp` hint when not attached to an interactive terminal, instead of blocking forever on a prompt. - yarnpkg/berry#7255 — `yarn npm audit --recursive --environment production` no longer reports advisories only reachable through a nested workspace's devDependencies. - yarnpkg/berry#7253 — `yarn info --virtuals` now reports base descriptors alongside virtual locators (zpm had the mirror image of Berry's bug: correct locators, virtualized descriptors). - yarnpkg/berry#7206 — a failed Algolia auto-types lookup no longer aborts `yarn add`; it degrades to a warning (with the `enableAutoTypes` escape hatch) and the lookup is bounded by a 10s per-request timeout. **Feature:** - yarnpkg/berry#7243 — `supportedArchitectures` additionally accepts a list of explicit os/cpu/libc combinations (matched per-entry, no cross-product), with the same config syntax as Berry. **Tests only (zpm's behavior was already correct):** - yarnpkg/berry#7250 / yarnpkg/berry#7257 — gate bypass for packages without release-time metadata, plus the `no-time-deps` fixture and registry-mock support. - yarnpkg/berry#7214 — scoped-gate inheritance tests, adapted to zpm's `packageRules`/`sourceRules` model (zpm's Option-based overrides make Berry's default-shadowing bug structurally impossible). **Artifact sync:** - Re-ran `scripts/import-artifacts.mjs` against Berry master, picking up yarnpkg/berry#7232 and the extensions hunk of yarnpkg/berry#7228 (8 new package extensions: 5 Volar `typescript` peers, `vite-plugin-vue-devtools`, 2 Parcel entries) along with forward-only PnP hook/patch updates. ## Checklist - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing). - [x] I have checked that all the impacted tests pass: the touched acceptance suites (npmMinimalAgeGate, prunedNativeDeps, protocols/npm, npm/audit, info, publish, node-modules, packageExtensions, checkResolutions, add) pass 215/218 (3 skipped), plus `cargo test` for zpm-config (7) and zpm-semver (108). The only remaining local failures reproduce identically on a pristine `main` build (venv/Python environment, one live-Algolia-data test, `path_iterators` and two lazyInstalls focus-coverage tests). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches core install resolution, architecture filtering, and audit traversal; behavior changes are intentional but affect many installs and multi-arch fetches. > > **Overview** > Backports a batch of Berry fixes and tests into zpm, covering install resolution, CLI behavior, configuration, and artifact sync. > > **Resolution & install:** Literal `*` ranges can resolve to prereleases when no stable versions exist, with matching `--check-resolutions` acceptance. Algolia auto-`@types` lookup is capped at 10s, warns instead of failing `yarn add`, and respects `enableAutoTypes`. HTTP requests gain a per-request `.timeout()` bounded by `httpTimeout`. > > **Commands & linkers:** `npm publish` errors with a `--otp` hint when not on an interactive TTY. Recursive production `npm audit` skips nested workspaces’ devDependencies. `yarn info --virtuals` shows physical descriptors with virtual locators. Node-modules bin symlinks prefer direct dependencies over hoisted aliases. > > **`supportedArchitectures`:** Schema becomes a `oneOrMany` list of entries with `ArchitectureFilter` fields (`null` = any). Legacy single-object YAML still works; project config replaces (not merges) user entries. Matching uses `SystemSet` / `supported_systems()` with per-entry validation instead of a flat cross-product of all systems. > > **Artifacts:** `builtin-extensions.json` gains Volar, Vite devtools, and Parcel peer entries; package manager pin updated. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4aaf6a1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
clemyan
requested changes
Aug 21, 2026
Comment on lines
+360
to
+378
| if (pkg.dependencies.size > 0 && !isVirtual) { | ||
| registerData(`Dependencies`, [...pkg.dependencies.values()].map(dependency => { | ||
| const dependencies = new Map([...pkg.dependencies.values()].map(dependency => { | ||
| const resolutionHash = project.storedResolutions.get(dependency.descriptorHash); | ||
|
|
||
| const resolution = typeof resolutionHash !== `undefined` | ||
| ? project.storedPackages.get(resolutionHash) ?? null | ||
| : null; | ||
|
|
||
| return formatUtils.tuple(formatUtils.Type.RESOLUTION, { | ||
| return [dependency.identHash, { | ||
| descriptor: dependency, | ||
| locator: resolution, | ||
| }); | ||
| }] as const; | ||
| })); | ||
|
|
||
| dependencyData.set(pkg.locatorHash, dependencies); | ||
| registerData(`Dependencies`, [...dependencies.values()].map(dependency => { | ||
| return formatUtils.tuple(formatUtils.Type.RESOLUTION, dependency); | ||
| })); | ||
| } |
Member
There was a problem hiding this comment.
I think here you can simply pull one of the virtuals from allInstances (if one exists) and build the dependency list using the virtual instead of the base packages? That would require no other changes and make the data flow much clearer
Author
There was a problem hiding this comment.
I now use the first instance from allInstances when resolving dependency locators, while retaining the base package's descriptors for display. The virtual-package acceptance test passes.
Author
|
The three failing jobs are the Windows Node 27 nightly shards. They fail before assertions with ERR_OSSL_ENTROPY_SOURCE_STRENGTH_TOO_WEAK from crypto.getRandomValues() inside esbuild-wasm; all other Node shards, build, chores, and the acceptance-test matrix pass. This looks unrelated to the change—could the nightly failures be retried or treated as infrastructure? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's the problem this PR addresses?
yarn info --virtualsprints regular dependencies on a package's non-virtualbase record. Those entries keep base locators even when the resolved dependency
is a virtual package, so the output cannot represent the actual resolved
dependency graph.
Closes #3990.
How did you fix it?
The info traversal now guarantees that each base package is processed before
its virtual instances. It retains the dependency data registered for the base
record and updates its locators from the matching virtual instance.
An acceptance test covers a virtual package whose dependency is itself virtual.
Checklist