fix: Filter orphaned Yarn packageExtensions entries during lockfile pruning#12084
Merged
Conversation
…runing Previously, `turbo prune` unconditionally included all Yarn packageExtensions (plugin-compat) resolution entries in the pruned lockfile. When pruning to a workspace that doesn't depend on the package that triggered the extensions, this left orphaned entries that caused `yarn install --immutable` to fail. Now we check whether any package in the pruned transitive closure depends on a package matching the extension's ident before including it. For @types/X extensions, we check if X is a dependency name in the closure. This correctly excludes orphaned extensions while preserving needed ones. Closes #11744
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Coverage Report
|
github-actions Bot
added a commit
that referenced
this pull request
Mar 2, 2026
## Release v2.8.13-canary.9 Versioned docs: https://v2-8-13-canary-9.turborepo.dev ### Changes - fix: Treat `npm: alias` dependencies as external, not workspace references (#12061) (`b179cb8`) - test: Port 18 more prysk tests to Rust (other/ + lockfile-aware-caching/) (#12062) (`7887af2`) - release(turborepo): 2.8.13-canary.8 (#12063) (`2a5522a`) - fix: Preserve file: protocol entries in pruned yarn v1 lockfile (#12064) (`ae5c1a1`) - perf: Use stack-allocated OidHash in FileHashes and skip expanded hashes on normal runs (#12065) (`677b248`) - test: Port all 8 find-turbo prysk tests to Rust (#12066) (`f827fca`) - fix: Support pnpm per-workspace lockfiles in turbo prune (#12067) (`23d047d`) - test: Port final 2 prysk tests to Rust (100% complete) (#12068) (`6d7e057`) - fix: Resolve Berry prune failure when resolutions contain patch overrides (#12069) (`6fe3c5e`) - test: Add lockfile fixture for yarn berry resolution pruning (issue #2791) (#12071) (`6cc1654`) - chore: Remove prysk test framework entirely (#12070) (`ed2d05a`) - refactor: Clean up test infrastructure and eliminate duplication (#12072) (`338911d`) - fix: Retain injected workspace package entries during pnpm lockfile pruning (#12073) (`acbe869`) - ci: Exclude turborepo-lsp and turborepo-schema-gen from test builds (#12075) (`4ce12e2`) - refactor: Clean up test infrastructure + improve test quality (#12074) (`4571f2b`) - ci: Remove redundant cargo build from coverage job (#12077) (`3c9bbe2`) - perf: Speed up lockfile test suite (#12078) (`20024df`) - ci: Remove integration test serialization (#12079) (`24d7c02`) - fix: Preserve `file:` and `link:` protocol entries in pruned bun lockfile (#12076) (`2635d9a`) - fix: Stop running unnecessary npm install in engines tests (#12081) (`24e4905`) - test: Add lockfile fixture for pnpm v9 injected workspace deps (issue #8243) (#12082) (`4d4929b`) - fix: Filter orphaned Yarn packageExtensions entries during lockfile pruning (#12084) (`68eb223`) - fix: Align experimentalObservability on object maps rather than arrays (#12089) (`9b9d1e4`) - examples: Upgrade with-react-native-web example to use latest versions (#12085) (`980ca43`) - fix: duplicate /signup? in Vercel URL (#12088) (`e865b51`) - ci: Deduplicate Rust test compilation with nextest archive (#12083) (`962cf39`) - fix: Prevent yarn integration tests from hanging on corepack prompts (#12090) (`29b0da7`) - fix: Prevent turbo dev from hanging when daemon file watching fails (#12091) (`b0d2f62`) - ci: Skip pnpm install for Rust test jobs (#12092) (`ebd137f`) - perf: Optimize npm lockfile parser (#12093) (`e4b4a66`) - chore: Trim unused dependency features for faster compilation (#12094) (`03b79e0`) - fix: Prevent lockfile-aware yarn test from hanging on corepack downloads (#12095) (`bf516e4`) - fix: Exclude turborepo-repository from JS smoke test in release workflow (#12097) (`fecc400`) --------- Co-authored-by: Turbobot <turbobot@vercel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
turbo pruneleaving orphaned lockfile entries from Yarn's built-inpackageExtensions(plugin-compat), which causedyarn install --immutableto fail on the pruned outputCloses #11744
Background
Yarn's plugin-compat transparently injects dependencies into certain packages (e.g.,
@types/keyvand@types/responselikeintogot@<11). These injected deps appear as resolution entries inyarn.lockbut are NOT recorded in the package's explicit dependency list.Previously,
subgraph()in the Berry lockfile pruner unconditionally included all these "extension" resolution entries. When pruning to a workspace that doesn't transitively depend on the package that triggered the extensions, the entries were left orphaned — Yarn would try to remove them duringyarn install --immutable, causing a failure.Fix
Instead of unconditionally including all extensions, we now collect all dependency names from the pruned transitive closure and only include an extension if a related package name appears as a dependency. For
@types/Xextensions, we check ifXis a dependency name in the closure. When an extension is included, its own transitive dependencies are also added.Testing
Verified with
check-lockfiles --pm yarn-berry— all 52 berry fixture tests pass (including the 2 new ones for this issue).