Add packageDateLimit option to only-install package version that have release date before the specified one

.circleci/config.yml

@@ -130,7 +130,7 @@ jobs:
   test-pkg-tests-linux-node12:
     <<: *docker_defaults
     docker:
-      - image: node:12
+      - image: node:12.18.2
     <<: *pkg_tests
   test-pkg-tests-linux-node10:
     <<: *docker_defaults

__tests__/commands/_helpers.js

@@ -98,6 +98,7 @@ export function makeConfigFromDirectory(cwd: string, reporter: Reporter, flags:
       enableDefaultRc: !flags.noDefaultRc,
       extraneousYarnrcFiles: flags.useYarnrc,
       modulesFolder: flags.modulesFolder ? path.join(cwd, flags.modulesFolder) : undefined,
+      packageDateLimit: flags.packageDateLimit,
     },
     reporter,
   );

__tests__/commands/info.js

@@ -44,7 +44,7 @@ const expectedKeys = [
 ];
 
 // yarn now ships as built, single JS files so it has no dependencies and no scripts
-const unexpectedKeys = ['dependencies', 'devDependencies', 'scripts'];
+const unexpectedKeys = ['dependencies', 'devDependencies']; // 'scripts' removed from v1.23
 
 beforeEach(() => {
   // the mocked requests have stripped metadata, don't use it in the following tests

__tests__/commands/install/package-date-limit.js

@@ -0,0 +1,17 @@
+/* @flow */
+
+import {getPackageVersion, runInstall} from '../_helpers.js';
+
+jasmine.DEFAULT_TIMEOUT_INTERVAL = 120000;
+
+test.concurrent('installing with --package-date-limit should install the specified version of a package', () => {
+  return runInstall({packageDateLimit: '2018-05-01T00:00:00.000Z'}, 'install-by-package-date-limit', async config => {
+    expect(await getPackageVersion(config, 'trough')).toEqual('1.0.2');
+  });
+});
+
+test.concurrent('installing without --package-date-limit should install the latest version of a package', () => {
+  return runInstall({}, 'install-by-package-date-limit', async config => {
+    expect(await getPackageVersion(config, 'trough')).toEqual('1.0.4');
+  });
+});

__tests__/fixtures/install/install-by-package-date-limit/package.json

@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "trough": ">1.0.0 <1.0.5"
+  }
+}

__tests__/index.js

@@ -16,7 +16,7 @@ const semver = require('semver');
 let ver = process.versions.node;
 ver = ver.split('-')[0];
 
-jasmine.DEFAULT_TIMEOUT_INTERVAL = 60000;
+jasmine.DEFAULT_TIMEOUT_INTERVAL = 90000;
 
 if (!existsSync(path.resolve(__dirname, '../lib'))) {
   throw new Error('These tests require `yarn build` to have been run first.');

__tests__/integration.js

@@ -70,7 +70,11 @@ addTest('https://github.com/bestander/chrome-app-livereload.git'); // no package
 addTest('bestander/chrome-app-livereload'); // no package.json, github, tarball
 
 if (process.platform !== 'win32') {
-  addTest('https://github.com/yarnpkg/yarn/releases/download/v0.18.1/yarn-v0.18.1.tar.gz'); // tarball
+  addTest(
+    'https://github.com/yarnpkg/yarn/releases/download/v0.18.1/yarn-v0.18.1.tar.gz', // tarball
+    {strictPeers: false},
+    ['--no-node-version-check', '--ignore-engines'],
+  );
   addTest('react-scripts@1.0.13', {strictPeers: true}, ['--no-node-version-check', '--ignore-engines']); // many peer dependencies, there shouldn't be any peerDep warnings
 }
 

packages/pkg-tests/package.json

@@ -27,6 +27,9 @@
     "jest": {
         "modulePathIgnorePatterns": [
             "<rootDir>/pkg-tests-fixtures/packages/"
+        ],
+        "transformIgnorePatterns": [
+            "<rootDir>/node_modules/(?!pkg-tests-)"
         ]
     }
 }

packages/pkg-tests/pkg-tests-specs/sources/pnp.js

@@ -1438,7 +1438,7 @@ module.exports = makeTemporaryEnv => {
       makeTemporaryEnv(
         {
           dependencies: {
-            [`resolve`]: `https://github.com/browserify/resolve.git`,
+            [`resolve`]: `https://github.com/browserify/resolve.git#v1.16.1`,
           },
           resolutions: {
             [`path-parse`]: `https://registry.yarnpkg.com/path-parse/-/path-parse-1.0.6.tgz`,

src/cli/commands/config.js

@@ -38,6 +38,7 @@ const CONFIG_KEYS = [
   'cacheFolder',
   'tempFolder',
   'production',
+  'packageDateLimit',
 ];
 
 export function hasWrapper(flags: Object, args: Array<string>): boolean {

src/cli/index.js

@@ -135,6 +135,7 @@ export async function main({
   commander.option('--no-node-version-check', 'do not warn when using a potentially unsupported Node version');
   commander.option('--focus', 'Focus on a single workspace by installing remote copies of its sibling workspaces.');
   commander.option('--otp <otpcode>', 'one-time password for two factor authentication');
+  commander.option('--package-date-limit <time>', 'only install package version that have release date before this');
 
   // if -v is the first command, then always exit after returning the version
   if (args[0] === '-v') {
@@ -554,6 +555,7 @@ export async function main({
       updateChecksums: commander.updateChecksums,
       focus: commander.focus,
       otp: commander.otp,
+      packageDateLimit: commander.packageDateLimit,
     })
     .then(() => {
       // lockfile check must happen after config.init sets lockfileFolder

src/config.js

@@ -70,6 +70,7 @@ export type ConfigOptions = {
   focus?: boolean,
 
   otp?: string,
+  packageDateLimit?: ?string,
 };
 
 type PackageMetadata = {
@@ -205,6 +206,7 @@ export default class Config {
   autoAddIntegrity: boolean;
 
   otp: ?string;
+  packageDateLimit: ?string;
 
   /**
    * Execute a promise produced by factory if it doesn't exist in our cache with
@@ -344,6 +346,8 @@ export default class Config {
       networkTimeout: this.networkTimeout,
     });
 
+    this.packageDateLimit = opts.packageDateLimit || String(this.getOption('package-date-limit') || '') || null;
+
     this.globalFolder = opts.globalFolder || String(this.getOption('global-folder', true));
     if (this.globalFolder === 'undefined') {
       this.globalFolder = constants.GLOBAL_MODULE_DIRECTORY;

src/resolvers/registries/npm-resolver.js

@@ -24,6 +24,7 @@ type RegistryResponse = {
   name: string,
   versions: {[key: string]: Manifest},
   'dist-tags': {[key: string]: string},
+  time?: ?{[key: string]: ?string},
 };
 
 export default class NpmResolver extends RegistryResolver {
@@ -48,6 +49,25 @@ export default class NpmResolver extends RegistryResolver {
       range = body['dist-tags'][range];
     }
 
+    // Only install package version that have release date before a specified one.
+    // That date string must match JSON format, e.g. 2020-08-14T04:47:38.210Z
+    if (config.packageDateLimit && body.time) {
+      const releaseDates = body.time;
+      let closestVersion = null;
+      (semver: Object).rsort(Object.keys(body.versions)).some(v => {
+        if (releaseDates[v] && semver.satisfies(v, range)) {
+          closestVersion = v;
+          if (releaseDates[v] < config.packageDateLimit) {
+            return true;
+          }
+        }
+        return false;
+      });
+      if (closestVersion) {
+        return body.versions[closestVersion];
+      }
+    }
+
     // If the latest tag in the registry satisfies the requested range, then use that.
     // Otherwise we will fall back to semver maxSatisfying.
     // This mimics logic in NPM. See issue #3560
@@ -94,7 +114,7 @@ export default class NpmResolver extends RegistryResolver {
 
     const escapedName = NpmRegistry.escapeName(this.name);
     const desiredRange = desiredVersion || this.range;
-    const body = await this.config.registries.npm.request(escapedName);
+    const body = await this.config.registries.npm.request(escapedName, {unfiltered: !!this.config.packageDateLimit});
 
     if (body) {
       return NpmResolver.findVersionInRegistryResponse(this.config, escapedName, desiredRange, body, this.request);