chore: Update build-tools to Yarn 4 #761

itsananderson · 2025-10-06T18:32:02Z

This PR updates build-tools to use Yarn 4, following the instructions from @MarshallOfSound

Since the build-tools repo is a bit different from others in the Electron ecosystem, testing these changes is slightly more challenging.

I pushed a separate yarn-4-auto-update branch to my fork, which modified the auto-update functionality to pull from that same yarn-4-auto-update branch. That way I could test the auto-update functionality and make sure yarn --immutable is invoked correctly.

Testing the initial installation flow w/ npm i -g @electron/build-tools is more tricky, since that package automatically pulls the main branch. If anyone has ideas about how to test this, I'd be happy to do that additional testing.

socket-security · 2025-10-06T18:32:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
husky@9.1.6 ⏵ 9.1.7
vitest@3.0.6 ⏵ 3.0.9			⁺²
ajv@8.11.0 ⏵ 8.17.1	⁺¹
yaml@2.5.1 ⏵ 2.8.1	⁺¹
debug@4.3.7 ⏵ 4.3.1
vscode-uri@3.0.7 ⏵ 3.1.0
prettier@3.3.3 ⏵ 3.6.2	⁺¹
semver@7.6.0 ⏵ 7.7.3	⁺¹	⁺¹
node-gyp@10.0.1 ⏵ 10.3.1		⁺¹
commander@12.1.0 ⏵ 9.5.0
lint-staged@15.2.10 ⏵ 15.5.2		⁺¹	^-1
inquirer@8.2.4 ⏵ 8.2.7

View full report

src/e-backport.js

src/e-rcv.js

package.json

MarshallOfSound · 2025-10-06T18:38:39Z

src/e-auto-update.js

+      console.log(color.childExec('npx', ['yarn', '--immutable'], execOpts));
+      cp.execSync('npx yarn --immutable', execOpts);


npx is unsafe and now we have the yarn cjs file we can just do node .yarn/releases/yarn-4.10.3.cjs instead.

I'm also fairly sure this will fail on the first run through because yarn --prod will run from the old script while having the new code locally

Ah, ya I was wondering about this.. node .yarn/releases/yarn-4.10.3.cjs sounds like a good alternative.

Let me think about the yarn --prod issue.. maybe I need to send a separate PR to prepare for this migration, and then wait a little bit before merging this PR 🤔

You could do something truly nasty and bit a yarn binary in this folder so that npx runs it instead of global yarn 😨 But hey that's the voice inside my head talking

Does npx pick up arbitrary binaries out of a local repo? I wasn't aware of that behavior.

We could maybe write a shim file to node_modules/.bin/yarn which npx would pick up.. and I guess we could have that wrapper detect and handle the --prod flag to give a graceful transition... but it'd definitely be a bit hacky.

In the interest of moving this forward, here are some other options:

Land the change as-is, and post one-time instructions for people to run after build-tools updates and fails to run yarn --prod

Update build-tools to look for a gitignored sentinal file for all e commands, and if it's not present, run yarn install --immutable before running the actual command, then touch the sentinal file. This way even if people get an error when yarn --prod runs, build-tools would "self-heal" when the next e command is run

I don't have a strong opinion about how to solve this, though since there's a limited user base, it seems like a simpler solution + some manual upgrade instructions might be the right balance of effort.

I think we should be OK to just Let This Happen.

We can post in #pineapple internally that this will happen, it will auto-fix on the next update. People won't be broken, they'll get an error once and then it will fix on the next e command they run

notion-workspace · 2025-10-14T18:55:53Z

build-tools

src/e-auto-update.js

codebytere · 2025-11-05T13:26:06Z

@itsananderson could you rebase?

socket-security · 2025-11-05T18:23:53Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		High CVE: npm `minimatch` ReDoS vulnerability CVE: GHSA-f8q6-p94x-37v3 minimatch ReDoS vulnerability (HIGH) Affected versions: < 3.0.5 Patched version: 3.0.5 From: `?` → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `semver` vulnerable to Regular Expression Denial of Service CVE: GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service (HIGH) Affected versions: >= 7.0.0 < 7.5.2; >= 6.0.0 < 6.3.1; < 5.7.2 Patched version: 6.3.1 From: `?` → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `debug` Reason: Debug versions >=3.2.0 <3.2.7 \|\| >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/debug-js/debug/issues/797) From: `?` → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

…PATH Co-authored-by: Samuel Attard <[email protected]>

itsananderson · 2025-11-05T19:12:52Z

I've rebased. I'm struggling to reproduce the test timeout errors that are happening in CI, though 🤔

itsananderson · 2025-11-05T19:14:28Z

Also, do we care about the ReDoS warnings for this repo? It seems unlikely that those could be exploited in build-tools, but I'm happy to try to address those if needed.

itsananderson · 2025-11-05T19:30:15Z

Ah, so regenerating the yarn.lock file bumped vitest from 3.0.6 to 3.2.4, and according to this vitest discussion this was a regression introduced somewhere between 3.0.9 and 3.1.3, which the maintainers aren't interested in backporting to vitest 3.

From those details, it sounds like the best options are probably to either:

Upgrade to vitest 4 to get the fix
Pin vitest to 3.0.6 so that this Yarn upgrade doesn't introduce the regression

…or version

itsananderson · 2025-11-05T19:47:26Z

Ok, pinning to only accept patch versions of vitest@~3.0.6 fixed the CI errors. That seems preferable since presumably a vitest@4 upgrade would require more significant changes.

dsanders11 · 2025-11-06T04:01:32Z

That seems preferable since presumably a vitest@4 upgrade would require more significant changes.

I'm good with pinning it, but I've test migrated a couple of repos to Vitest v4 and so far it's been a pretty painless migration.

itsananderson requested review from a team and ckerr as code owners October 6, 2025 18:32

MarshallOfSound reviewed Oct 6, 2025

View reviewed changes

MarshallOfSound reviewed Oct 18, 2025

View reviewed changes

src/e-auto-update.js Outdated Show resolved Hide resolved

itsananderson added 10 commits November 5, 2025 10:22

chore: Update build-tools to Yarn 4

60372c9

Remove unsupported --prod flag

4f6111a

Group yarn gitignore rules together

a42ab0b

Make gh action yarn installs immutable

ca908f4

Run corepack up again

ba169d4

Directly invoke yarn instead of using npx

ed1d393

Undo e-backport change to --immutable

97aaa8b

Undo changes to e-recv

1a1701b

Actually undo changes to e-recv

c8d0ac6

Actually undo changes to e-backport

3008e37

itsananderson force-pushed the yarn-4 branch from 331969c to 3008e37 Compare November 5, 2025 18:22

fix: use process.execPath rather than relying on 'node' being on the …

2ab1671

…PATH Co-authored-by: Samuel Attard <[email protected]>

Pin vitest to latest 3.0.x patch version rather than latest 3.x.y min…

7cad409

…or version

dsanders11 approved these changes Nov 6, 2025

View reviewed changes

codebytere approved these changes Nov 9, 2025

View reviewed changes

codebytere merged commit 7da221c into electron:main Nov 9, 2025
10 checks passed

itsananderson mentioned this pull request Nov 10, 2025

ERROR Error: Command failed: npx yarn --prod #775

Open

		console.log(color.childExec('npx', ['yarn', '--immutable'], execOpts));
		cp.execSync('npx yarn --immutable', execOpts);

chore: Update build-tools to Yarn 4 #761

chore: Update build-tools to Yarn 4 #761

Uh oh!

Conversation

itsananderson commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MarshallOfSound Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

itsananderson Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

itsananderson Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

itsananderson Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

notion-workspace bot commented Oct 14, 2025

Uh oh!

Uh oh!

codebytere commented Nov 5, 2025

Uh oh!

socket-security bot commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

itsananderson commented Nov 5, 2025

Uh oh!

itsananderson commented Nov 5, 2025

Uh oh!

itsananderson commented Nov 5, 2025

Uh oh!

itsananderson commented Nov 5, 2025

Uh oh!

dsanders11 commented Nov 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

socket-security bot commented Oct 6, 2025 •

edited

Loading

socket-security bot commented Nov 5, 2025 •

edited

Loading