GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Fix hosted yarn classic with an offline mirror (#364) by mikolalysenko · Pull Request #839 · SocketDev/socket-patch

Conversation

@mikolalysenko

@mikolalysenko Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator

LLM Description written by Claude Code:claude-opus-5-5

Fixes #364

Summary

Hosted mode (scan --mode hosted / get --mode hosted) now refuses a yarn classic project that configures yarn-offline-mirror in its project .yarnrc or .npmrc. Before, the lock was rewired, every later install failed, and the scan reported success with a not_affected VEX statement. The lock is left byte-identical, and a redirect_yarn_classic_offline_mirror warning names the mirror and points to --mode vendored, which already works with a mirror. The dependency is not counted as redirected and is never attested, including through an earlier run's URL left in the lock.

Root cause

rewrite_yarn_classic (crates/socket-patch-core/src/patch/redirect/mod.rs) rewrote resolved / integrity without reading the yarn config. Yarn 1 stores and looks up offline-mirror tarballs by the basename of resolved. The hosted URL …/<uuid>/left-pad-1.3.0.tgz has the same basename as the upstream left-pad-1.3.0.tgz already in the mirror, so yarn installs the upstream bytes against the patched integrity (Integrity check failed). With --offline, it never gets the patched tarball at all.

I chose to fail closed rather than write the patched tarball into the mirror. Writing it would replace a committed upstream artifact that other branches and lockfiles depend on, and it would have to be undone on rollback. It's also what the issue lists first among acceptable outcomes, and it matches the existing berry compressionLevel refusal.

Changes

  • preflight_yarn_classic_hosted / yarn_classic_offline_mirror: parses .yarnrc (key value and key: value / key:value, quoted keys/values, # comments) and .npmrc (top-level ini key=value). As in yarn, .yarnrc wins over .npmrc, and an empty value or false means no mirror. Look-alike keys such as yarn-offline-mirror-pruning are not matched.
  • rewrite_yarn_classic: refuses only the deps the classic lock actually locks, and records them in a new refused_yarn_classic_uuids set. The hosted engine's confirmation probe never confirms a uuid in that set.
  • read_candidate_files: reads .yarnrc and .npmrc only beside a classic yarn.lock with an npm candidate, so npm, pnpm and berry projects are unaffected. In memory mode, a symlinked or unreadable config is refused rather than treated as absent, because it could hide a mirror. .yarnrc is added to the memory host's extra text files.
  • Vendored→hosted takeover (scan/hosted.rs): a vendored yarn-classic entry is checked against the mirror before its vendored wiring is reverted, like the bun, berry and vlt gates. Without this check it would end up patched in neither mode.
  • Docs: a yarn classic bullet in the docs/ecosystems.md hosted notes.
  • The pdm/poetry rewrite goldens hash format!("{:?}", RewriteResult), which now includes the empty new set, so they were re-blessed. I checked that with refused_yarn_classic_uuids: {}, stripped from the Debug text, the old goldens pass for every case. In the re-blessed files only output digests changed; case keys and input digests are identical.

Test evidence

Issue Regression test Without fix With fix
#364 hosted rewrite (unit; .yarnrc/.npmrc, quoted and unquoted forms, LF and CRLF locks) patch::redirect::tests::yarn_classic_offline_mirror_refuses_rewrite FAILED ok
#364 settings that must not trigger it (none, false, empty, -pruning, [section], .yarnrc false over .npmrc) yarn_classic_without_effective_offline_mirror_rewrites, yarn_classic_offline_mirror_preflight_scope ok (guards) ok
#364 end to end, real yarn 1.22.22 with a populated mirror e2e_redirect_yarn_classic_build::classic_offline_mirror_refuses_hosted_and_keeps_installs_working FAILED (redirected: 1, VEX statement written) ok on yarn 1.0.2, 1.6.0, 1.7.0, 1.22.22: lock untouched, no attestation; on 1.7+ a fresh yarn install --frozen-lockfile passes online and --offline (1.0–1.6 install nothing from a mirror even without socket-patch, as the issue's control shows)
#364 vendored→hosted takeover (.yarnrc and .npmrc, wet and --dry-run) in_process_vendor::classic_vendored_to_hosted_takeover_refuses_with_offline_mirror FAILED (takeover reverted the vendored wiring) ok

Commands run locally (Linux, as root):

  • cargo clippy --workspace --all-features -- -D warnings: clean.
  • cargo test -p socket-patch-core --lib: all pass except 4 tests that also fail on main here (relax_loop_must_not_traverse_symlinked_root, an_unremovable_hidden_lock_keeps_every_store_entry, wire_write_failure_maps_error_and_leaves_lock_untouched, wire_failure_rolls_back_already_written_files). They induce failures with file permissions, which root bypasses.
  • SOCKET_PATCH_YARN_E2E_REQUIRED=1 cargo test -p socket-patch-cli --all-features with --test e2e_redirect_yarn_classic_build (13/13), e2e_vendor_yarn_classic_build (11/11), hosted_memory_engine (28/28), hosted_memory_parity (31/31), in_process_get_hosted_ecosystems (8/8), in_process_redirect (104/107; the 3 failures are permission-induced write-failure tests that pass as non-root in CI), in_process_vendor and mode_migration_npm.
  • node --test npm/socket-patch/bin/socket-patch.test.mjs: 4/4. No wrapper changes were needed, since the wrappers only dispatch the binary.
  • I could not run the full cargo test --workspace locally because building every test binary exceeds this session's disk allowance, so CI covers the rest.
  • cargo fmt --all -- --check reports 498 diffs on unmodified main with the pinned 1.93.1 toolchain, and CI runs no fmt step, so I didn't reformat the touched files. That avoids unrelated churn.

CI on head 399b0b1: all 14 workflow runs succeeded (CI went green on attempt 3, after both earlier attempts had their yarn-classic 1.9.4 and yarn-berry 4.1.0 (ubuntu-latest) jobs cancelled in the queue). Bugbot reviewed 399b0b1 and found no issues. mergeable_state: clean.

Follow-ups

  • Only project-level .yarnrc / .npmrc are read. A mirror configured in ~/.yarnrc or a parent directory's config is not detected.

🤖 Generated with Claude Code

https://claude.ai/code/session_016uQyhodCtdJGrKaD7AAV1n

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@claude
Start fix for #364
83a5ec1 
Assisted-by: Claude Code:claude-opus-5-5
@mikolalysenko Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 5, 2026
Hosted yarn classic redirect breaks every install in projects with a yarn-offline-mirror: the mirror's upstream tarball shares the hosted URL's basename and fails the new integrity pin #364
Closed
Claude (claude) added 4 commits October 5, 2026 08:46
@claude
Refuse hosted yarn classic with an offline mirror
250a738 
A yarn classic project that sets yarn-offline-mirror (in .yarnrc or
.npmrc) had its lock rewired to the hosted tarball. Yarn looks mirror
tarballs up by file name, and the hosted one has the same name as the
upstream tarball already in the mirror, so every install got the
unpatched bytes and failed the integrity check (or, offline, never
found the patched tarball) while the scan reported success and VEX
attested the patch.

The hosted rewrite now leaves yarn.lock untouched in that case, warns
with redirect_yarn_classic_offline_mirror and points to vendored mode,
which works with a mirror. The dependency is not counted as redirected
or attested. Both config files are read only beside a classic lock.

Fixes #364

Assisted-by: Claude Code:claude-opus-5-5
@claude
Keep mirrored yarn classic vendored on takeover
a739b43 
A vendored-to-hosted takeover reverted the vendored yarn classic
wiring before the hosted rewrite refused the offline mirror, leaving
the package patched in neither mode. The takeover now checks the
mirror first and keeps the package vendored.

Adds a real-yarn e2e (yarn 1.22.22, populated mirror) showing the scan
refuses, writes no attestation, and fresh installs still work online
and offline.

Refs #364

Assisted-by: Claude Code:claude-opus-5-5
@claude
Document the yarn classic offline mirror refusal
f22c263 
Refs #364

Assisted-by: Claude Code:claude-opus-5-5
@claude
Re-bless pdm and poetry rewrite goldens
4a4549e 
These goldens hash the Debug text of the whole rewrite result, which
now carries the empty refused_yarn_classic_uuids set. With that field
stripped from the text, the old goldens still match every case, so
only the output digests change; case keys and inputs are identical.

Refs #364

Assisted-by: Claude Code:claude-opus-5-5
@mikolalysenko
Mikola Lysenko (mikolalysenko) marked this pull request as ready for review October 5, 2026 09:09
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

BugBot review

Generated by Claude Code
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Oct 5, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@claude
Fix mirror e2e on yarn releases before 1.7
7454424 
yarn 1.0 to 1.6 install nothing from an offline mirror even without
socket-patch, so the fresh-install leg of the new mirror e2e failed on
the yarn-classic 1.0.2 and 1.6.0 matrix legs. Those releases now pin
that known limitation; the hosted refusal is still checked on every
release.

Refs #364

Assisted-by: Claude Code:claude-opus-5-5
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

BugBot review

Generated by Claude Code
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Oct 5, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@claude
Merge origin/main into agent/fix-yarn-classic-offline-mirror
7a51bfe 
Resolve the e2e_redirect_yarn_classic_build.rs conflict with #710 by keeping both new tests (offline-mirror refusal and git-sourced block skip).

Co-Authored-By: Claude <[email protected]>
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

bugbot run

Generated by Claude Code
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 5, 2026
Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823
Closed
5 tasks
cursor[bot]
cursor Bot reviewed Oct 5, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@mikolalysenko Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 5, 2026
Spawn CLI test children through one hermetic Command builder (#823) #850
Merged
Tanmay182003
Tanmay Singla (Tanmay182003) reviewed Oct 5, 2026
View reviewed changes
Comment thread crates/socket-patch-core/src/patch/redirect/mod.rs Resolved

Uh oh!

There was an error while loading. Please reload this page.
@claude
Detect a .yarnrc offline mirror written with a colon
7fc90f9 
yarn 1's .yarnrc parser ends an unquoted key at ':', so
`yarn-offline-mirror: ./mirror` and `yarn-offline-mirror:./mirror`
configure the mirror just like `yarn-offline-mirror ./mirror`. The
mirror check only split on whitespace, so either spelling slipped
through and hosted mode still rewired the lock, reproducing #364.

Refs #364

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_016uQyhodCtdJGrKaD7AAV1n
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

BugBot review

Generated by Claude Code
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Oct 5, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator Author

coverage and test-release failed on 7fc90f9 in socket-patch-cli --lib: commands::vex_consumed::tests::hosted_expands_alias_only_copies and hosted_reuses_expanded_npm_copies_and_merges_alias_variants. This PR didn't cause it:

  • Both tests fail on main itself (reproduced locally at 6811b4e). It's the semantic merge conflict between Fix npm store copies missed by agent apply and vex (#601, #603) #605 and Fix agent mode skipping npm-aliased copies (#356) #738 that Fix vex alias tests broken by store-copy merge #851 describes. coverage has been red on main and on other branches since Fix npm store copies missed by agent apply and vex (#601, #603) #605 merged.
  • CI tests this PR merged with main, so the failure came in through the base. 7fc90f9 only changes the .yarnrc parser in socket-patch-core.

I ported #851's test update in 0a2ef31, on top of a merge of current main. cargo test -p socket-patch-cli --lib now passes locally (840/840). The port does nothing once #851 lands.

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Tanmay182003
Tanmay Singla (Tanmay182003) approved these changes Oct 5, 2026
View reviewed changes
Claude (claude) added 2 commits October 5, 2026 13:40
@claude
Merge remote-tracking branch 'origin/main' into agent/fix-yarn-classi…
57e1266 
…c-offline-mirror
@claude
Port vex alias test fix from #851
0a2ef31 
main has been red since #605 taught the name-keyed resolver to return
npm-aliased copies, which broke two vex_consumed tests added by #738.
Port #851's test update so this PR's CI goes green; it no-ops once
#851 lands on main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_016uQyhodCtdJGrKaD7AAV1n
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

bugbot run

Generated by Claude Code
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Oct 5, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@mikolalysenko Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 5, 2026
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

Burn-down agent: labeled Ready for review.

  • Head: 0a2ef31169fd51523f010ea607314e666638889c
  • CI: 491/491 check runs green (success/skipped) on this head; mergeable clean
  • Bugbot: reviewed 0a2ef31 (requested this run), no new issues; earlier thread resolved
  • Reviewer focus: hosted yarn classic with yarn-offline-mirror (Hosted yarn classic redirect breaks every install in projects with a yarn-offline-mirror: the mirror's upstream tarball shares the hosted URL's basename and fails the new integrity pin #364)

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko Mikola Lysenko (mikolalysenko) removed the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 5, 2026
@claude
Merge remote-tracking branch 'origin/main' into agent/fix-yarn-classi…
ad0db1f 
…c-offline-mirror

# Conflicts:
#	crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden
#	crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator Author

Four checks failed on ad0db1f for reasons outside this PR:

  • gradle 8.14.3 / jdk 21 / agent / ubuntu-latest and gradle 6.9.4 / jdk 11 / hosted / ubuntu-latest: the GitHub runner shut down mid-job ("The runner has received a shutdown signal"). In both jobs, every Gradle test that finished before then had passed. Gradle support came from main (Full Gradle support in agent, hosted and vendored modes #646), and this PR doesn't touch it.
  • native (macos-latest, 1.1.0) and native (macos-latest, 1.1.38) (Bun compatibility): hosted cases got HTTP Error 503: Service Unavailable from the patch service around 18:54 UTC. The same cases pass on every Ubuntu Bun job. Two hosted cases that failed on 1.1.0 (crlf, space-unicode) pass on 1.1.38. This PR only changes yarn classic.

I'll re-run each failed job once when its run finishes.

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@claude
Port Gradle digest-helper fix from #878
399b0b1 
main has been red since #865 added a check that production code
computes digests through utils::digest, while #646's Gradle code
still hashes inline. Port #878's change so this PR's coverage and
test-release go green; it no-ops once #878 lands on main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_016uQyhodCtdJGrKaD7AAV1n
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

coverage failed on ad0db1f in socket-patch-core --lib: utils::digest::tests::production_digests_go_through_the_helpers. This PR didn't cause it:

  • The test fails on main itself (reproduced locally at 9c43dfc). Compute sha256, sha1 and SRI digests through utils::digest (#706) #865 added the check, and Full Gradle support in agent, hosted and vendored modes #646's Gradle code (crawlers/gradle_cache.rs, patch/jvm_jar.rs, patch/sidecars/maven.rs) still computes digests inline. This PR touches none of those files.
  • Route Gradle digests through utils::digest #878 fixes it. I ported its commit in 399b0b1. The test passes locally, as do the CLI library tests (847/847), and clippy is clean. The port does nothing once Route Gradle digests through utils::digest #878 lands.

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator Author

Some checks on 399b0b1 were cancelled or failed for reasons outside this PR:

  • 11 jobs were cancelled while queued, before any test ran: 4 Windows Gradle jobs, install-proof jobs in the vlt workflow, and native (windows-latest, 1.2.0) / native (ubuntu-latest, 2.1.4). None left a log.
  • Later, composer 2.2.30 / php 8.3 / macos-latest and six Poetry native jobs (mostly macOS) were also cancelled after waiting a long time for runners, again with no test failure.
  • lock-diff (vlt) failed only because the cancelled native (windows-latest, 1.2.0) job produced no Windows locks: "no cross-OS lock set for 1.2.0 … locks from ['darwin', 'linux']". The 72 cells it could compare across OS all matched.

This PR only changes yarn classic. Once every run on this commit finishes, I'll re-run its failed and cancelled jobs once.

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

Every workflow on 399b0b1 is green except CI. CI is red only because yarn-classic 1.9.4 and yarn-berry 4.1.0 (ubuntu-latest) were cancelled in both attempts before a runner picked them up, so neither left a log. No test failed.

  • I ran the same yarn-classic 1.9.4 cell locally with scripts/yarn-classic-vex-matrix.sh 1.9.4: 65/65 PASS. e2e_redirect_yarn_classic_build (the default yarn) also passes 14/14.
  • yarn berry isn't affected by this PR.

CI has already used its one re-run, so I'm not re-running it again. If someone with Actions access re-runs those two jobs, the PR should go fully green.

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

BugBot review

Generated by Claude Code
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Oct 5, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 399b0b1. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Oct 5, 2026

Copy link
Copy Markdown
Collaborator Author

[agent] Head 399b0b1 is now fully green. I re-ran the two CI jobs that the queue had cancelled (yarn-classic 1.9.4 and yarn-berry 4.1.0 (ubuntu-latest)), and CI attempt 3 passed. All 14 workflow runs on this commit succeeded. Bugbot reviewed 399b0b1 and found no issues. No review threads are open, and the PR merges cleanly. The earlier approval was on 7fc90f9, so this needs a re-approval.

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 5, 2026
@mikolalysenko
Mikola Lysenko (mikolalysenko) merged commit 5392576 into main Oct 7, 2026
1013 of 1079 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko
Mikola Lysenko (mikolalysenko) deleted the agent/fix-yarn-classic-offline-mirror branch October 7, 2026 12:01
This was referenced Oct 7, 2026
Hosted yarn classic offline-mirror refusal (#364 fix) only reads the project's own .yarnrc/.npmrc, so a mirror set in ~/.yarnrc, yarn's user config or a parent dir still breaks every install #1013
Closed
Hosted yarn classic offline-mirror refusal misses a project .yarnrc or .npmrc saved with a UTF-8 BOM, so the scan pins anyway and every install fails #1078
Closed
Fix yarn classic offline-mirror config resolution (#1013, #1078) #1083
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments
@Tanmay182003 Tanmay Singla (Tanmay182003) Tanmay182003 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Hosted yarn classic redirect breaks every install in projects with a yarn-offline-mirror: the mirror's upstream tarball shares the hosted URL's basename and fails the new integrity pin

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@mikolalysenko @Tanmay182003 @claude
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.