Problem/Motivation

$ yarn outdated
Package                                Current Wanted Latest
[snipped]
glob                                   8.0.3   8.1.0  10.3.10
[snipped]

Steps to reproduce

Normally we would do

$ yarn add -D glob

fix the breaking changes in bumping the major two versions and be done with it...

...however:

The dependency jackspeak (GitHub) decide to fork its dependency cliui (GitHub) into @isaacs/cliui (GitHub).

This fork is done in a way that supports npm and yarn 3.x+, but _not_ yarn 1.x, which we are using. (See https://github.com/isaacs/jackspeak/issues/5 and https://github.com/yargs/cliui/pull/139)

This fork was introduced in jackspeak 2.1.2.

Proposed resolution

1) Pin glob to the exact latest working version on yarn 1.x, which is 10.3.5.
2) Since glob has an open version-restriction on jackspeak, we need to restrict this to the latest version that works with yarn 1.x, which is 2.1.1.
3) Change the uses of glob in our building JavaScripts to the new syntax.
Note: Weirdly/Interestingly the list of paths are now returned sorted alphabetically _descending_ (See output of https://git.drupalcode.org/issue/drupal-3398946/-/jobs/271322). Adding a sort() on the list makes them sorted alphabetically ascending as before.

1) and 2) result in two things that we normally wouldn't do in our core/package.json:
- An exact version for glob, instead of one preceded by a ^ or ~, to indicate this should not be updated without extreme caution. (Quite probable we need to go to yarn 3.x+ before we ever can bump, I don't see a fix for th now rather acient yarn 1.x ever landing).
This also prevents glob being accidentally updated when using $ yarn upgrade.
- An extra line in the "resolutions"-section, pinning the version of jackspeak.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Issue fork drupal-3398946

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

Spokje created an issue. See original summary.

spokje’s picture

Issue summary: View changes
spokje’s picture

Issue summary: View changes
spokje’s picture

Issue summary: View changes
spokje’s picture

Issue summary: View changes
spokje’s picture

Issue summary: View changes
spokje’s picture

Issue summary: View changes
spokje’s picture

Assigned: spokje » Unassigned
Status: Active » Needs review
spokje’s picture

Issue summary: View changes
spokje’s picture

Removed now outdated $ yarn-lock-diff -o yarn.old.lock -n yarn.lock output.

spokje’s picture

$ yarn-lock-diff -o yarn.old.lock -n yarn.lock
┌──────────────────────────────┬─────────────────────┬──────────────────────┐
│ package name                 │ old version(s)      │ new version(s)       │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ glob                         │ 8.1.0, 7.2.3, 7.2.0 │ 7.2.3, 7.2.0, 10.3.5 │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ lru-cache                    │ [...], 6.0.0        │ [..., 6.0.0], 10.0.1 │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ minimatch                    │ [...]               │ [..., 9.0.3]         │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ @pkgjs/parseargs             │ -                   │ 0.11.0               │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ foreground-child             │ -                   │ 3.1.1                │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ jackspeak                    │ -                   │ 2.1.1                │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ minipass                     │ -                   │ 7.0.4                │
├──────────────────────────────┼─────────────────────┼──────────────────────┤
│ path-scurry                  │ -                   │ 1.10.1               │
└──────────────────────────────┴─────────────────────┴──────────────────────┘

spokje’s picture

Issue summary: View changes
smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Applied the MR and searched for const glob = require('glob'); and seems all instances have been replaced.

Though did see a package in node_module nightwatch still uses it.

longwave’s picture

Version: 11.x-dev » 10.2.x-dev
Status: Reviewed & tested by the community » Fixed

Thanks for tracking down the fix, seems like until we are on yarn 3 or move to npm we are otherwise stuck here and this is the best solution.

Committed and pushed 4e0f2a2ec3 to 11.x and 9e0cd89258 to 10.2.x. Thanks!

  • longwave committed 9e0cd892 on 10.2.x
    Issue #3398946 by Spokje: Upgrade glob to latest possible version...

  • longwave committed 4e0f2a2e on 11.x
    Issue #3398946 by Spokje: Upgrade glob to latest possible version...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.