build: upgrade to Lerna 9 and Yarn 4 by georgexu99 · Pull Request #4009 · electron/forge

georgexu99 · 2025-09-25T19:26:15Z

This PR upgrades Yarn to v4, and Lerna to v9.

This sets the stage for configuring trusted publishing on npm.

Yarn upgrades

Yarn Berry comes with a few important upgrades:

Disables lifecycle scripts to minimize chance of supply chain security attacks (with allowlist)
Adds cooldown time for dependencies to reduce chance of supply chain security attacks (set to 1 week)
Built-in yarn patch command means we can get rid of patch-package
Yarn version is now on a per-workspace basis instead of installed globally

Lerna v9

The versions of node supported by lerna are now ^20.19.0 || ^22.12.0 || >=24.0.0.
support OIDC trusted publishing (d51e344)

Workarounds

moved assetrelocator test to a temp directory to avoid yarn shenanigans

socket-security · 2025-09-25T19:27:10Z

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

georgexu99 · 2025-09-25T20:39:03Z

tests won't pass until lerna v9 reaches 7 day release maturity

package.json

packages/template/webpack-typescript/package.json

.yarnrc.yml

erickzhao · 2025-09-26T16:51:41Z

Also there seems to be a lockfile update required:

➤ YN0000: Yarn detected that the current workflow is executed from a public pull request. For safety the hardened mode has been enabled.
➤ YN0000: It will prevent malicious lockfile manipulations, in exchange for a slower install time. You can opt-out if necessary; check our documentation for more details.

➤ YN0000: · Yarn 4.10.2
➤ YN0000: ┌ Resolution step
Resolution step
➤ YN0000: └ Completed in 11s 677ms
➤ YN0000: ┌ Post-resolution validation
Post-resolution validation
➤ YN0028: -  resolution: "@electron-forge/template-fixture@file:./spec/fixture/electron-forge-template-fixture#./spec/fixture/electron-forge-template-fixture::hash=1aaf8d&locator=%40electron-forge%2Fcore%40workspace%3Apackages%2Fapi%2Fcore"
➤ YN0028: -  checksum: 10c0/1fe8a48bb01714be15ab86101675e52440d7dc6b55d7e3ecc0e7ffd790c64d03355afd452742cf1b89640ca0208cb4761a5c38bbbcb7965eb82953bffea48d1e
➤ YN0028: +  resolution: "@electron-forge/template-fixture@file:./spec/fixture/electron-forge-template-fixture#./spec/fixture/electron-forge-template-fixture::hash=3dc1fb&locator=%40electron-forge%2Fcore%40workspace%3Apackages%2Fapi%2Fcore"
➤ YN0028: -  resolution: "electron-forge-template-fixture-two@file:./spec/fixture/electron-forge-template-fixture#./spec/fixture/electron-forge-template-fixture::hash=b40bee&locator=%40electron-forge%2Fcore%40workspace%3Apackages%2Fapi%2Fcore"
➤ YN0028: -  checksum: 10c0/d54e6c7d5c0d060647043f9d704a1a2138248d324d4271b494b06d4ee9d403056b7c33f53065db78989744f7e157f51948c070ccdaf93f23117f1518e71ee08b
➤ YN0028: +  resolution: "electron-forge-template-fixture-two@file:./spec/fixture/electron-forge-template-fixture#./spec/fixture/electron-forge-template-fixture::hash=f3bac0&locator=%40electron-forge%2Fcore%40workspace%3Apackages%2Fapi%2Fcore"
➤ YN0028: The lockfile would have been modified by this install, which is explicitly forbidden.
➤ YN0000: └ Completed
➤ YN0000: · Failed with errors in 11s 806ms

.yarnrc.yml

package.json

georgexu99 · 2025-10-07T00:04:45Z

packages/api/core/src/api/init-scripts/init-link.ts

      '..',
-      '.links',
    );
+


to resolve linking issues, we must custom retrieve each workspace's path and link them with yarn 4 syntax

.github/workflows/ci.yml

erickzhao · 2025-10-07T19:28:46Z

packages/api/core/src/api/init-scripts/init-link.ts

-      '.links',
    );
+
+    const getWorkspacePath = (packageName: string): string => {


I hate how much extra work we have to do with Yarn 4 to make linking our packages is... but if it works, it works. 🤷

yep i hate this too

packages/external/create-electron-app/package.json

erickzhao · 2025-10-07T19:30:50Z

packages/plugin/webpack/spec/AssetRelocatorPatch.spec.ts

  const mainOut = path.join(appPath, '.webpack/main');

  beforeAll(async () => {
+    await fs.promises.mkdir(appPath, { recursive: true });


Can you explain a bit what the root cause of the test failures was that caused this refactor?

the assetrelocator patch test creates a webpack project and tests that webpack assets are in the right place once built- the test ran npm install inside a fixture directory inside the forge monorepo, which caused yarn to lock it down and fail the test as it required native module builds (native-hello-world).

This beforeAll moves the fixture to a temp directory outside the monorepo so it can run without yarn's configuration policies.

I don't love bypassing the yarn policies in yarnrc.yml, can we do the same lockfile trick here and use a pre-generated one? (Similar to what you did below)

.yarnrc.yml

.prettierignore

package.json

erickzhao · 2025-10-08T03:19:03Z

@SocketSecurity ignore npm/init-package-json@8.2.2

This is a package maintained by npm and there's no suspicious activity on the package itself.

MarshallOfSound · 2025-10-08T07:08:54Z

packages/template/vite-typescript/spec/ViteTypeScriptTemplate.slow.spec.ts

This is unsafe, we shouldn't do it

MarshallOfSound · 2025-10-08T07:08:58Z

packages/template/webpack-typescript/spec/WebpackTypeScript.slow.spec.ts

This is unsafe, we shouldn't do it

erickzhao · 2025-10-08T16:32:40Z

package.json

Does preversion still work in Yarn 4? I don't see it documented anymore: https://yarnpkg.com/cli/version

erickzhao · 2025-10-08T16:50:15Z

tools/regenerate-lockfile-fixtures.ts

Can we remove these flags now that the expectation is that the developer runs this update script locally?

- Remove unnecessary packages from npmPreapprovedPackages in .yarnrc.yml - Change node engine requirement from ^16.4.0 to >=16.4.0 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

- Add macos-alias to npmPreapprovedPackages to enable native volume.node compilation on macOS - Replace file: protocol with link: protocol for test fixtures to avoid platform-dependent hashes - This should fix DMG maker tests and eliminate hash mismatch errors in CI Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

The macos-alias package contains native modules that need to be rebuilt for the current Node.js version in CI. This was causing test failures on macOS runners when running tests that use the DMG maker.

…neration script The script is meant to be run locally by developers who don't have immutable installs enabled by default. Removing these overrides makes the script cleaner and doesn't disable security features unnecessarily.

MarshallOfSound

Looking solid, left some clean up notes, a neat trick, and one ask RE lockfile stuff

MarshallOfSound · 2025-10-09T05:43:32Z

packages/api/core/src/api/init-scripts/init-link.ts

-      '.links',
    );
+
+    const getWorkspacePath = (packageName: string): string => {


This whole thing can be replaced with a sick oneliner -->

yarn workspace @electron-forge/package-name exec pwd

packages/api/core/src/api/init-scripts/init-link.ts

MarshallOfSound · 2025-10-09T05:46:45Z

packages/plugin/webpack/spec/AssetRelocatorPatch.spec.ts

  const mainOut = path.join(appPath, '.webpack/main');

  beforeAll(async () => {
+    await fs.promises.mkdir(appPath, { recursive: true });


I don't love bypassing the yarn policies in yarnrc.yml, can we do the same lockfile trick here and use a pre-generated one? (Similar to what you did below)

package.json

MarshallOfSound · 2025-10-09T05:48:12Z

package.json

+    "@bitdisaster/exe-icon-extractor": {
+      "built": true
+    },
+    "electron-winstaller": {
+      "built": true
+    },


@erickzhao can we take action items somewhere to make these not require building. Seems strange to me

Yeah, I made of note of in Slack but I'll create a separate GitHub issue for it as well.

electron/windows-installer#564

georgexu99 · 2025-10-09T09:12:01Z

#4009 (comment)
@MarshallOfSound

I think the test specifically uses npm to test what we're recommending users to use in the forge docs (npm). I can meet you in the middle, how about we use npm ci rather than npm install so we're not generating a new lockfile.

yilihjy · 2025-10-10T03:32:58Z

@georgexu99 @MarshallOfSound @erickzhao hello , #4026 Some bad things have happened after this merge.

notion-workspace · 2025-10-11T02:19:42Z

forge

georgexu99 requested a review from a team as a code owner September 25, 2025 19:26

erickzhao requested changes Sep 26, 2025

View reviewed changes

erickzhao requested changes Sep 29, 2025

View reviewed changes

.yarnrc.yml Show resolved Hide resolved

erickzhao reviewed Sep 29, 2025

View reviewed changes

package.json Outdated Show resolved Hide resolved

georgexu99 commented Oct 7, 2025

View reviewed changes

georgexu99 requested a review from erickzhao October 7, 2025 18:25

erickzhao requested changes Oct 7, 2025

View reviewed changes

erickzhao changed the title ~~chore: add support for trusted oidc publishing~~ build: upgrade to Lerna 9 and Yarn 4 Oct 7, 2025

erickzhao approved these changes Oct 8, 2025

View reviewed changes

MarshallOfSound requested changes Oct 8, 2025

View reviewed changes

erickzhao reviewed Oct 8, 2025

View reviewed changes

package.json Outdated

Copy link

Member

erickzhao Oct 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does preversion still work in Yarn 4? I don't see it documented anymore: https://yarnpkg.com/cli/version

erickzhao reviewed Oct 8, 2025

View reviewed changes

georgexu99 force-pushed the gxu-yarn-upgrade branch 3 times, most recently from a77319b to ba56129 Compare October 8, 2025 22:56

georgexu99 and others added 11 commits October 8, 2025 16:16

init upgrade commit

8bfc0de

minimumage

624f1b3

immutable

2a32e98

chore: upgrade to v4

9cf15fb

don't need this yet

f388779

resolve issues

19c9e0d

chore: update yarn config and node engine requirement

634d479

- Remove unnecessary packages from npmPreapprovedPackages in .yarnrc.yml - Change node engine requirement from ^16.4.0 to >=16.4.0 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

add back link scripts

832b044

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

update dev dependencies

3cafb7c

fix links and tests

f43399a

georgexu99 added 11 commits October 8, 2025 16:18

use individual yarn link vs dynamically generating resolutions

f9838e2

fix: rebuild native modules for macos-alias in CI

0303914

The macos-alias package contains native modules that need to be rebuilt for the current Node.js version in CI. This was causing test failures on macOS runners when running tests that use the DMG maker.

attempt to fix other errors

3f9128b

yarn lock

fc63fae

copy out assetrelocator files to avoid yarn shenanigans

fba8bf0

temporarily allow scripts for native rebuilds in ci

89127c0

allow immutable installs on temporary test fixtures

7a2cb57

address change rquest

c3103cb

use pregenerated lockfile and add a regeneration script

ef6e8ca

update yarn.locks

976ca66

georgexu99 force-pushed the gxu-yarn-upgrade branch from ba56129 to 976ca66 Compare October 8, 2025 23:35

georgexu99 added 2 commits October 8, 2025 21:46

fix tests

7e304aa

Merge branch 'main' into gxu-yarn-upgrade

1274322

MarshallOfSound reviewed Oct 9, 2025

View reviewed changes

init-link: address comments

024ab13

use npm ci instead of npm install to avoid modifying the lockfile

51beeda

georgexu99 requested a review from MarshallOfSound October 9, 2025 18:10

MarshallOfSound approved these changes Oct 9, 2025

View reviewed changes

georgexu99 added this pull request to the merge queue Oct 9, 2025

Merged via the queue into main with commit 7b4a4c0 Oct 9, 2025
11 checks passed

georgexu99 deleted the gxu-yarn-upgrade branch October 9, 2025 19:06

erickzhao mentioned this pull request Oct 10, 2025

build: Yarn 4 CI hardening #4028

Merged

erickzhao mentioned this pull request Oct 21, 2025

feat(init): add --electron-version flag #4037

Merged

erickzhao mentioned this pull request Jan 6, 2026

test: use verdaccio in more init cases #4116

Merged

Uh oh!

Conversation

georgexu99 commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Yarn upgrades

Lerna v9

Workarounds

Uh oh!

socket-security bot commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

georgexu99 commented Sep 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

erickzhao commented Sep 26, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

erickzhao commented Oct 8, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

erickzhao Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

georgexu99 commented Oct 9, 2025

Uh oh!

Uh oh!

yilihjy commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

notion-workspace bot commented Oct 11, 2025

Uh oh!

Reviewers

Assignees

Labels

georgexu99 commented Sep 25, 2025 •

edited

Loading

socket-security bot commented Sep 25, 2025 •

edited

Loading

erickzhao Oct 8, 2025 •

edited

Loading

yilihjy commented Oct 10, 2025 •

edited

Loading