Hi
For the past couple for years, I've been the main maintainer of yarnpkg.
This is the legacy yarn 1.x package, not yarn berry. While some distros
have packaged yarn berry in some way or the other, there is no official
way to do so [1], and modern projects should install yarn on a
per-project basis via corepack. For packaging projects which use yarn,
see here [2] for an example of how to build a vendored tarball with yarn
berry.
I personally have no use for yarn 1.x anymore, and there are more and
more CVEs getting filed against yarn (resp its bundled dependencies)
which are often impossible to fix without forking yarn 1.x and porting
the code to newer dependencies.
So I'd like to propose to retire the package. If anyone still finds some
use for it and wants to pick it up, feel free to let me know and I can
add him/her to the package. Otherwise I'll proceed by orphaning the
package by the end of the next week, in which case people can still pick
it up until it gets retired automatically.
CCing @Neal Gompa as the other package admin.
Thanks
Sandro
[1] github.com/yarnpkg/berry/discussions/5629
[2] https://src.fedoraproject.org/rpms/qgis/blob/rawhide/f/prepare_vendor.sh
[3]
https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&classification=Fedora&component=yarnpkg
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
