New images fail to install private modules with yarn

[razor-x]

Encountering a pretty serious regression that has broken all our CI builds with no clear workaround (other then updating all builds to install and use a local fixed version of yarn, which is far from ideal) . 😱 😓 On boron image.

Looks like the node docker images were all updated around 5 hours ago which is about when I started seeing this issue. Basically yarn will not install any private node modules even with a valid token in ~/.npmrc (gives 404 errors). I think the new images updated from yarn v0.22.0 to v0.23.2. Using 0.23.2 locally with npmrc without issue.

[chorrell]

The recent image update was for yarn v0.23.2. Maybe a regression or bug in yarn?

[razor-x]

Yea, I cross posted to their issue tracker (see above). My obviously bias opinion is to revert to 0.22.0 in the LTS images since this is a critical breaking issue.

[noherczeg]

@razor-x Were you using auth tokens or basic auth urls? Auth tokens never worked for me ever. On the other hand other have reported that url auth works/worked: yarnpkg/yarn#2541 (comment)

[razor-x]

@noherczeg Been using //registry.npmjs.org/:_authToken=foo (this is what is generated by npm login. This has worked with yarn locally and on the docker builds for several months now up until yesterday.

[razor-x]

@noherczeg I've tried registry=https://${NPM_USERNAME}:${NPM_PASSWORD}@registry.yarnpkg.com as you suggested. It worked locally but not in the docker build.

@chorrell Any hope of reverting to yarn 022.0 in the boron images? Unless you or someone can verify that installing private NPM packages is possible using the new image, I would say this is a serious regression and warrants a revet until a solution can be found.

[chorrell]

I'd like to get some input on the yarn team before we make a decision. If a new release is eminent that fixes this then we should update rather than revert back to v0.22.0.

[chorrell]

Huh, and there's this too: yarnpkg/yarn#3138

[chorrell]

And this: yarnpkg/yarn#3203

[chorrell]

So I'm leaning more toward reverting back to v0.22.0

Hey @nodejs/docker, what does everyone else think?

[chorrell]

v0.23.2 solved yarnpkg/yarn#2819, but compared to the other issues it doesn't seem as bad

[Starefossen]

Only yarnpkg/yarn#3203 remaining, right? In that case I vote on updating to v0.23.2. Yarn is already experimental and most people using it should know that. It won't become more stable unless people use it and test the latest versions.

[pesho]

Yarn is already experimental and most people using it should know that. It won't become more stable unless people use it and test the latest versions.

+1, this is also why I'm slightly in favor of not reverting. Although being upset is understandable when your build breaks.

It would be great if there was a clean way to not update Yarn (or NPM for that matter) in an already published tag. I.e. tags should be immutable w.r.t. the package versions included (except for updates to the base image).

[chorrell]

Only yarnpkg/yarn#3203 remaining, right?

Yah, I think so. So wait until v0.23.3 or v0.24.x ? Whichever is the next release...