[Bug] yarn up fails with aliased package

[simnalamburt]

• I'd be willing to implement a fix

Describe the bug

yarn up fails with aliased packages. Yarn should have queried package's real name to the registry, but it queries the aliased name instead.

To Reproduce

Run this on empty directory:

cat <<'EOF' > package.json
{
  "dependencies": {
    "k8e318T": "npm:left-pad@^1.3.0"
  }
}
EOF

yarn up '*'

Reproduction with Sherlock

// Sherlock reproduction
await packageJsonAndInstall({
  dependencies: {
    ['k8e318T']: 'npm:left-pad@^1.3.0'
  }
});

await expect(yarn('up', '*')).rejects.not.toThrow()

 

Screenshots

➤ YN0027: k8e318T@npm:left-pad@^1.3.0 can't be resolved to a satisfying range

HTTPError: Response code 404 (Not Found)
    at o.<anonymous> (/home/simnalamburt/workspace/a/.yarn/releases/yarn-2.3.3.cjs:23:12912)
    at processTicksAndRejections (internal/process/task_queues.js:93:5)

➤ Errors happened when preparing the environment required to run this command.

Environment if relevant (please complete the following information):

• OS: Debian GNU/Linux 10
• Node version: v14.13.0
• Yarn version: 2.3.3

 

Additional context

Found during using cometkim/yarn-plugin-bump. See cometkim/yarn-plugin-bump#13 for short previous history.

[arcanis]

Registry returned invalid data - missing "dist-tags" field

The error is pretty self-explanatory 😃

[simnalamburt]

Oops.. I didn't know that yarnbot was being executed everytime I edited the issue. 😅

[simnalamburt]

Registry returned invalid data - missing "dist-tags" field

The error is pretty self-explanatory 😃

Sorry this was litte bit misleading since package yoyoyoyo does exist in the registry. I've updated the issue to more random name.

[yarnbot]

This issue reproduces on master:

Error: expect(received).rejects.not.toThrow()

Error name:    "Error"
Error message: "Command failed: /usr/bin/node /github/workspace/scripts/actions/../run-yarn.js up *

➤ YN0027: k8e318T@npm:left-pad@^1.3.0 can't be resolved to a satisfying range

HTTPError: Response code 404 (Not Found)
    at Request.<anonymous> (/github/workspace/.yarn/cache/got-npm-11.7.0-cacb9b44fc-780b4b1d33.zip/node_modules/got/dist/source/as-promise/index.js:117:42)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)

➤ Errors happened when preparing the environment required to run this command.
"

      at Request.<anonymous> (../../github/workspace/.yarn/cache/got-npm-11.7.0-cacb9b44fc-780b4b1d33.zip/node_modules/got/dist/source/as-promise/index.js:117:42)
      ➤ Errors happened when preparing the environment required to run this command.
    at Object.toThrow (/github/workspace/.yarn/cache/expect-npm-24.8.0-8c7640c562-0ac41999f0.zip/node_modules/expect/build/index.js:242:20)
    at module.exports (evalmachine.<anonymous>:9:43)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)
    at async /github/workspace/.yarn/cache/@arcanis-sherlock-npm-1.0.38-d4f5e2dbf3-63f998598d.zip/node_modules/@arcanis/sherlock/lib/executeRepro.js:56:13
    at async executeInTempDirectory (/github/workspace/.yarn/cache/@arcanis-sherlock-npm-1.0.38-d4f5e2dbf3-63f998598d.zip/node_modules/@arcanis/sherlock/lib/executeRepro.js:17:16)
    at async Object.executeRepro (/github/workspace/.yarn/cache/@arcanis-sherlock-npm-1.0.38-d4f5e2dbf3-63f998598d.zip/node_modules/@arcanis/sherlock/lib/executeRepro.js:24:12)
    at async ExecCommand.execute (/github/workspace/.yarn/cache/@arcanis-sherlock-npm-1.0.38-d4f5e2dbf3-63f998598d.zip/node_modules/@arcanis/sherlock/lib/commands/exec.js:25:38)
    at async ExecCommand.validateAndExecute (/github/workspace/.yarn/cache/clipanion-npm-2.0.0-rc.16-b9444aaf89-a57989414f.zip/node_modules/clipanion/lib/advanced/Command.js:161:26)
    at async Cli.run (/github/workspace/.yarn/cache/clipanion-npm-2.0.0-rc.16-b9444aaf89-a57989414f.zip/node_modules/clipanion/lib/advanced/Cli.js:74:24)
    at async Cli.runExit (/github/workspace/.yarn/cache/clipanion-npm-2.0.0-rc.16-b9444aaf89-a57989414f.zip/node_modules/clipanion/lib/advanced/Cli.js:83:28)

[paul-soporan]

Duplicate of #1492 (which should actually be called yarn up does not properly update non-npm dependencies).

Also see dependabot/dependabot-core#1297 (comment) for more context.

TL;DR: yarn up <ident>@<range> works similarily to yarn add <ident>@<range> except that it updates existing dependencies across all workspaces (rather than adding a dependency to a single workspace) - it updates the <ident> to have the range <range> inside the Manifest. If the range is not specified, it is considered unknown, which causes Yarn to fetch the latest tag of <ident> from the npm registry and use its versions prefixed with the semver modifier, no matter what the original range is. This means that Yarn discards all aliased/git/patch/... dependencies and resolves them from the latest tag from the npm registry.

The fix would be to make yarn up take the original range into account, but it's quite tricky in the case of remapped npm dependencies, as you probably expect it to update the range of npm:left-pad@^1.3.0, rather than the resolution of k8e318T inside the lockfile.