Skip to content

Fix yarn berry hosted pin leaking npm auth (#404) #465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mikola Lysenko (mikolalysenko) merged 16 commits into from
Oct 2, 2026
Merged

Fix yarn berry hosted pin leaking npm auth (#404) #465

Changes from 1 commit
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
e26a1e8
Start fix for #404
claude Oct 1, 2026
e20d139
Stop yarn berry pins leaking npm auth tokens
claude Oct 1, 2026
5229052
Keep hosted berry pins in the lock inventory
claude Oct 1, 2026
0c461dc
Merge main into agent/fix-yarn-berry-hosted-auth-leak
claude Oct 1, 2026
4a47781
Pin yarn berry patches through resolutions
claude Oct 1, 2026
e0b225a
Cover the resolutions pin in goldens and docs
claude Oct 1, 2026
ac8c443
Merge main into agent/fix-yarn-berry-hosted-auth-leak
claude Oct 1, 2026
80e4752
Address review findings on berry pin
claude Oct 1, 2026
f44ebc6
Match berry lock keys on CRLF locks too
claude Oct 1, 2026
86bd246
Confirm berry pins only with manifest routing
claude Oct 2, 2026
0440962
Own berry deps only when the lock pins them
claude Oct 2, 2026
3bc0d7e
Merge main into agent/fix-yarn-berry-hosted-auth-leak
claude Oct 2, 2026
68547b1
Harden berry pin writes and refused locks
claude Oct 2, 2026
236d4f3
Merge main into agent/fix-yarn-berry-hosted-auth-leak
claude Oct 2, 2026
dc9330f
Clarify when the berry pin edits package.json
claude Oct 2, 2026
8d52ba6
Leave yarn berry fork aliases untouched
claude Oct 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Clarify when the berry pin edits package.json 
The npm lock rewriter now also reads the root package.json (#490), so
the contract says the berry pin is the one that edits it, not the only
reader.

Assisted-by: Claude Code:claude-opus-5-5
  • Loading branch information
@claude
claude committed Oct 2, 2026
commit dc9330f4c6371b209a9993a0a54a18dc51e3c764
Loading
Loading