1605231 - update Yarn to 1.21.1 to close package.json file overwrite vulnerability

Status: RESOLVED FIXED

(DevTools :: General, defect)

Description

[Dan Mosedale (:dmosedale, :dmose)]

The top-level package.json has yarn at version "^1.16.0". This has been fixed in yarn 1.21.1, and should be upgraded.

At the various least, this fix should pin the new version to 1.21.1, rather than using a non-pinned semantic version starting with a ^. This might also be a good time to move yarn from a dependency to a devDependency as per bug 1598445.

Comment 1

[Jason Laster [:jlast]]

Attachment: Bug 1605231 - update Yarn to 1.21.1. r=dmose

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/00af692eccde
update Yarn to 1.21.1. r=dmose

Comment 3

[Razvan Maries]

Backed out for Lint failure.

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedJob=281994537&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=linting%2Copt%2Cjavascript%2Cchecks%2Csource-test-mozlint-eslint%2Cjs%28es%29&revision=00af692eccde6f626f399d2708e15d4fc705fdbc

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=281994537&repo=autoland

Backout: https://hg.mozilla.org/integration/autoland/rev/d26936e3f756d28a3f480d902f3fb8af7283835e

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3c3fc5f3f7e7
update Yarn to 1.21.1. r=dmose

Comment 5

[Dan Mosedale (:dmosedale, :dmose)]

Mark, I'm guessing this is going to need to have the tarballs updated for the testers?

Comment 6

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/3c3fc5f3f7e7

Comment 7

[Mark Banner (:standard8)]

(In reply to Dan Mosedale (:dmose, :dmosedale) from comment #5)

Mark, I'm guessing this is going to need to have the tarballs updated for the testers?

Yes, ideally that should happen before the patch lands (to avoid the builders pulling from npm repos), but I'll do that now.

Comment 8

[Mark Banner (:standard8)]

So typically, I need new upload credentials, I've requested, will try and get it moved forward...

Comment 9

[Dan Mosedale (:dmosedale, :dmose)]

Thanks; sorry for not realizing sooner that this would be needed.

Comment 10

[Mark Banner (:standard8)]

Attachment: Bug 1605231 - Update bundled node_modules for the builders to sync with the yarn update. r?Mossop

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ece588f50535
Update bundled node_modules for the builders to sync with the yarn update. r=dmose

Comment 12

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/ece588f50535