Question. Every repository's yarn.lock is in yarn 1's format, and the newest Debian and Ubuntu package yarn 4. Which yarn do we stay on?
The ruling at #146 (comment) says a runtime that is too old means a newer distribution. Here the newest distributions are too new for our lockfiles:
Debian 13 and Ubuntu 26.04 package yarn 4.1. It refuses a yarn 1 yarn.lock with --frozen-lockfile. Without that flag it rewrites the file in its own format, with its own hashes.
Alpine 3.22 to 3.24, Ubuntu 24.04 (the CI runner image) and Debian 12 package yarn 1.
Alpine packages no yarn 4 in the releases I checked (3.22 and 3.23).
#148 stays on yarn 1. script/bootstrap stops with a one-line message when a tree with yarn.lock meets another major version. A fresh Debian 13 or Ubuntu 26.04 host therefore cannot bootstrap such a repository from its own packages.
Options.
A. Stay on yarn 1, as that PR builds it. Hosts and CI need a distribution that packages yarn 1. This has to be looked at again when the CI runner image leaves Ubuntu 24.04.
B. Move every repository to npm (package-lock.json, npm ci). The distributions I checked all package it, and packages stay pinned by their integrity hash. This reverses "Use yarn, not npm", and every repository changes at its next re-vendor.
C. Move to yarn 4 lockfiles. Alpine stages would stop working from Alpine's own packages, so those stages would move to Debian.
Recommendation. A for now, because it is built and nothing breaks today. B is the way out when a host or the runner needs the newer distributions.
This does not hold up that PR.
Model: opus-5-5
**Question.** Every repository's `yarn.lock` is in yarn 1's format, and the newest Debian and Ubuntu package yarn 4. Which yarn do we stay on?
The ruling at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033 says a runtime that is too old means a newer distribution. Here the newest distributions are too new for our lockfiles:
- Debian 13 and Ubuntu 26.04 package yarn 4.1. It refuses a yarn 1 `yarn.lock` with `--frozen-lockfile`. Without that flag it rewrites the file in its own format, with its own hashes.
- Alpine 3.22 to 3.24, Ubuntu 24.04 (the CI runner image) and Debian 12 package yarn 1.
- Alpine packages no yarn 4 in the releases I checked (3.22 and 3.23).
https://git.eeqj.de/sneak/prompts/pulls/148 stays on yarn 1. `script/bootstrap` stops with a one-line message when a tree with `yarn.lock` meets another major version. A fresh Debian 13 or Ubuntu 26.04 host therefore cannot bootstrap such a repository from its own packages.
**Options.**
- **A. Stay on yarn 1**, as that PR builds it. Hosts and CI need a distribution that packages yarn 1. This has to be looked at again when the CI runner image leaves Ubuntu 24.04.
- **B. Move every repository to npm** (`package-lock.json`, `npm ci`). The distributions I checked all package it, and packages stay pinned by their integrity hash. This reverses "Use `yarn`, not `npm`", and every repository changes at its next re-vendor.
- **C. Move to yarn 4 lockfiles.** Alpine stages would stop working from Alpine's own packages, so those stages would move to Debian.
**Recommendation.** A for now, because it is built and nothing breaks today. B is the way out when a host or the runner needs the newer distributions.
This does not hold up that PR.
Model: opus-5-5
sneak
was assigned by clawbot2026-11-04 08:17:05 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Question. Every repository's
yarn.lockis in yarn 1's format, and the newest Debian and Ubuntu package yarn 4. Which yarn do we stay on?The ruling at #146 (comment) says a runtime that is too old means a newer distribution. Here the newest distributions are too new for our lockfiles:
yarn.lockwith--frozen-lockfile. Without that flag it rewrites the file in its own format, with its own hashes.#148 stays on yarn 1.
script/bootstrapstops with a one-line message when a tree withyarn.lockmeets another major version. A fresh Debian 13 or Ubuntu 26.04 host therefore cannot bootstrap such a repository from its own packages.Options.
package-lock.json,npm ci). The distributions I checked all package it, and packages stay pinned by their integrity hash. This reverses "Useyarn, notnpm", and every repository changes at its next re-vendor.Recommendation. A for now, because it is built and nothing breaks today. B is the way out when a host or the runner needs the newer distributions.
This does not hold up that PR.
Model: opus-5-5