Problem/Motivation
$ yarn outdated
Package Current Wanted Latest
[snipped]
glob 8.0.3 8.1.0 10.3.10
[snipped]
Steps to reproduce
Normally we would do
$ yarn add -D glob
fix the breaking changes in bumping the major two versions and be done with it...
...however:
The dependency jackspeak (GitHub) decide to fork its dependency cliui (GitHub) into @isaacs/cliui (GitHub).
This fork is done in a way that supports npm and yarn 3.x+, but _not_ yarn 1.x, which we are using. (See https://github.com/isaacs/jackspeak/issues/5 and https://github.com/yargs/cliui/pull/139)
This fork was introduced in jackspeak 2.1.2.
Proposed resolution
1) Pin glob to the exact latest working version on yarn 1.x, which is 10.3.5.
2) Since glob has an open version-restriction on jackspeak, we need to restrict this to the latest version that works with yarn 1.x, which is 2.1.1.
3) Change the uses of glob in our building JavaScripts to the new syntax.
Note: Weirdly/Interestingly the list of paths are now returned sorted alphabetically _descending_ (See output of https://git.drupalcode.org/issue/drupal-3398946/-/jobs/271322). Adding a sort() on the list makes them sorted alphabetically ascending as before.
1) and 2) result in two things that we normally wouldn't do in our core/package.json:
- An exact version for glob, instead of one preceded by a ^ or ~, to indicate this should not be updated without extreme caution. (Quite probable we need to go to yarn 3.x+ before we ever can bump, I don't see a fix for th now rather acient yarn 1.x ever landing).
This also prevents glob being accidentally updated when using $ yarn upgrade.
- An extra line in the "resolutions"-section, pinning the version of jackspeak.
Remaining tasks
User interface changes
API changes
Data model changes
Release notes snippet
Issue fork drupal-3398946
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3398946-upgrade-glob
changes, plain diff MR !5289
- 3398946-upgrade-glob-to
changes, plain diff MR !5237
Comments
Comment #3
spokjeComment #4
spokjeComment #5
spokjeComment #6
spokjeComment #7
spokjeComment #8
spokjeComment #9
spokjeComment #10
spokjeComment #11
spokjeRemoved now outdated
$ yarn-lock-diff -o yarn.old.lock -n yarn.lockoutput.Comment #13
spokjeComment #15
spokjeComment #16
smustgrave commentedApplied the MR and searched for const glob = require('glob'); and seems all instances have been replaced.
Though did see a package in node_module nightwatch still uses it.
Comment #17
longwaveThanks for tracking down the fix, seems like until we are on yarn 3 or move to npm we are otherwise stuck here and this is the best solution.
Committed and pushed 4e0f2a2ec3 to 11.x and 9e0cd89258 to 10.2.x. Thanks!