Unpin the default Yarn version from 1.9.x

[jmorrell]

Now that 1.11.0 is released with yarnpkg/yarn#6413 merged, Heroku users should see fewer failed builds due to 500 responses from the registry.

[edmorley]

Hi! Until users update their committed yarn.lock files to include the new integrity field for each package (see yarnpkg/yarn#5042), yarn will do extra work when installing since it will fetch all of the packages to retrospectively work out their hash. (And adding the integrity field requires them to upgrade to yarn 1.10.0 or later locally, refresh the lockfile and commit the result, which many won't do for some time.)

Testing locally it seems the extra work even occurs when using --frozen-lockfile (like this buildpack does), which means that if I run yarn --frozen-lockfile twice in a row (as happens with subsequent buildpack deploys where no dependencies changed) the second operation takes significantly longer (for example 110s instead of 4s, for the first project I checked locally).

Possible workarounds might be:

• temporarily set unsafe-disable-integrity-migration true in .yarnrc (or via equivalent CLI param/environment variable, if that's possible) until more projects have updated their yarn.lock (or even make this conditional on whether the substring 'integrity sha' appears in their committed yarn.lock)
• add a buildpack warnings check saying "no integrity hash found, we recommend updating to the latest yarn and refreshing your lockfile"
• holding off merging this PR until more people are on yarn >=1.10.0 locally
• file an upstream yarn issue asking them to stop the redundant work being performed when using --frozen-lockfile

Thoughts?

Edit - upstream issues:

• Preserve "integrity" entries when using Yarn 1.9 yarnpkg/yarn#6440
• yarn 1.10.0 is really slow (compared to 1.9.4) yarnpkg/yarn#6430

[jmorrell]

@edmorley Thanks for putting this on my radar!

I'm fine holding off on this for a few days and seeing if the yarn team resolves the issue in a new version. From the conversation, it sounds like they understand the issue and are likely to fix it relatively soon.

If not, I like the idea of adding a warning.

[edmorley]

A PR is open to disable the auto-migration :-)
yarnpkg/yarn#6465

[arcanis]

1.12 is out - let me know if the issue is fixed for you, I'll soon move it to stable unless we get critical reports 🙂

[CaseyFaist]

Version change approved 👍