#`yarn outdated` flags dev tag as outdated — Page 1

grave hazel Jul 30, 2021, 4:53 PM

Hey @inner flare (I think you're the one in charge of npm packages -- correct me if I'm wrong). I use yarn outdated in my CI script to check for outdated deps, and I noticed that it's reporting the @dev version as outdated for some reason. Any idea why this is?
https://asciinema.org/a/ul1muK7UmyepN2HXUk8484wFD

inner flare Jul 30, 2021, 4:54 PM

Looks more like yarn being yarn than anything else

Or it reads from the package.json

grave hazel Jul 30, 2021, 4:55 PM

Maybe if the version format was switched to 13.0.0-dev.{timestamp}.{commit} it would be ordered?

inner flare Jul 30, 2021, 4:55 PM

Either way, yarn add discord.js@dev should always install latest

grave hazel Jul 30, 2021, 4:55 PM

I think it might be because it's not sequential

inner flare Jul 30, 2021, 4:55 PM

The reason it's timestamp after commit IS so its ordered

grave hazel Jul 30, 2021, 4:55 PM

Thonk but commit is random

inner flare Jul 30, 2021, 4:55 PM

Since timestamps are sequential after all

grave hazel Jul 30, 2021, 4:55 PM

the commit sha makes it unordered

inner flare Jul 30, 2021, 4:55 PM

Yet the timestamp makes it ordered

and fixed several tools with that issue

grave hazel Jul 30, 2021, 4:56 PM

No, because the commit comes first?

inner flare Jul 30, 2021, 4:56 PM

It fixed dependabot not recognizing changes

grave hazel Jul 30, 2021, 4:56 PM

13.0.0-dev-1234567.0000000001 < 13.0.0-dev-abcdef1.0000000002

inner flare Jul 30, 2021, 4:56 PM

thats not how its checked

grave hazel Jul 30, 2021, 4:56 PM

even though 1234567 might be made after a...

It seems like that's how yarn outdated checks it

How does dependabot check it?

inner flare Jul 30, 2021, 4:57 PM

npm works fine

yarn doesn't

so its a yarn issue

grave hazel Jul 30, 2021, 4:58 PM

Shouldn't it not be displaying in npm at all?

if it's truly latest

inner flare Jul 30, 2021, 4:58 PM

??

well, it's probably getting confused because its a tagged release

grave hazel Jul 30, 2021, 4:59 PM

I thought outdated returned no output if everything is up to date

inner flare Jul 30, 2021, 4:59 PM

its not "latest"

its "dev"

grave hazel Jul 30, 2021, 4:59 PM

Hmm, okay

inner flare Jul 30, 2021, 4:59 PM

Best shot is setting discord.js to dev in package.json

grave hazel Jul 30, 2021, 5:00 PM

Won't that make my local install inconsistent with the CI then?

Like, the actual version installed locally could be a totally different @dev release than the one the CI gets

inner flare Jul 30, 2021, 5:01 PM

thats why caches exist

grave hazel Jul 30, 2021, 5:02 PM

hm alright

inner flare Jul 30, 2021, 5:03 PM

Also, technically I'm not the one in charge of npm, thats more of a Crol question

Pat

grave hazel Jul 30, 2021, 5:18 PM

Ah, gotcha TohruThumbsUp

grave hazel Jul 30, 2021, 10:06 PM

grave hazel Maybe if the version format was switched to `13.0.0-dev.{timestamp}.{commit}` it...

just btw @hushed rampart do you know if the version format can be changed to be sequential? (i.e. timestamp-commitsha instead of commitsha-timestamp)?

hushed rampart Jul 30, 2021, 10:11 PM

I don't see how this will prevent anything

🤔

but if you want, flip it

idc

grave hazel Jul 30, 2021, 10:11 PM

I think it's because yarn is checking for sequentially newer packages

hushed rampart Jul 30, 2021, 10:12 PM

yarn is dumb

I dont want to cater to it

inner flare Jul 30, 2021, 10:33 PM

grave hazel I think it's because yarn is checking for sequentially newer packages

Commits aren't inheritedly sequential lmao

grave hazel Jul 30, 2021, 10:34 PM

that's why I think timestamp needs to be first??

rn commit is first which makes no sense

inner flare Jul 30, 2021, 10:34 PM

Its a build of a commit at that timestamp

grave hazel Jul 30, 2021, 10:35 PM

but shouldn't the latest published version be the largest sequential version number, per semver?

inner flare Jul 30, 2021, 10:35 PM

No matter if you order it as number.commit or commit.number, you'll have the same issue

This is strictly a yarn issue

grave hazel Jul 30, 2021, 10:37 PM

cornthonk I guess I don't see how that wouldn't make a difference... The build with the largest timestamp is the latest build, so putting the timestamp first would make it sort as the largest, right?

Sorry if I'm just missing something here, I hope this isn't naive

inner flare Jul 30, 2021, 10:38 PM

Well find out. Take two of the dev releases, compare them, then inverse the values and see id they return the same

grave hazel Jul 30, 2021, 10:40 PM

> older_release = '13.0.0-dev.fe6cc0c.1625227356'
'13.0.0-dev.fe6cc0c.1625227356'
> newer_release = '13.0.0-dev.2675b08.1627646567'
'13.0.0-dev.2675b08.1627646567'
> newer_release > older_release
false
> older_release > newer_release
true

inner flare Jul 30, 2021, 10:40 PM

Not inverse like that

Inverse commit and timestamp

grave hazel Jul 30, 2021, 10:42 PM

 older_release = '13.0.0-dev.fe6cc0c.1625227356'
> newer_release = '13.0.0-dev.2675b08.1627646567'
> newer_release > older_release
false
> older_release > newer_release
true

> older_release_2 = '13.0.0-dev.1625227356.fe6cc0c'
> newer_release_2 = '13.0.0-dev.1627646567.2675b08'
> newer_release_2 > older_release_2
true
> older_release_2 > newer_release_2
false
>

with timestamp first they sort correctly

because timestamps always increment

inner flare Jul 30, 2021, 10:42 PM

Yeah but i doubt that's how npm and probably pnpm sort

grave hazel Jul 30, 2021, 10:43 PM

How else would they sort? If they sort by publish time then there wouldn't be an issue

But there is an issue

inner flare Jul 30, 2021, 10:43 PM

Its an issue on yarn

grave hazel Jul 30, 2021, 10:47 PM

https://github.com/yarnpkg/yarn/blob/3119382885ea373d3c13d6a846de743eca8c914b/src/resolvers/registries/npm-resolver.js#L51

I think this is the relevant code

Because it falls back to a string sort

As does NPM

Since the latest version reported by the API is not in the 13.x semver range

https://github.com/yarnpkg/yarn/issues/3560#issuecomment-307453951

inner flare Jul 30, 2021, 10:50 PM

And yet npm hasn't this issue

grave hazel Jul 30, 2021, 10:54 PM

I think npm does, because it shouldn't be showing any output at all, and yet it complains that discord.js isn't latest

Even though it exits with 0, it still shouldn't be marking it as old

hushed rampart Jul 30, 2021, 11:06 PM

yes

thats normal

that happens with any dependency thats not on @latest

so @next, @beta, @dev etc

are you sure that wont break npm

👀

grave hazel Jul 30, 2021, 11:10 PM

it shouldn't seeing as commit shas have letters in them

so there's really no change as far as NPM would be concerned

hushed rampart Jul 30, 2021, 11:11 PM

can u make a PR right after this one is merged

removing the t

thx

grave hazel Jul 30, 2021, 11:11 PM

yea

grave hazel Jul 30, 2021, 11:13 PM

hushed rampart can u make a PR right after this one is merged

shouldnt the pr also change this line:

        run: npm deprecate discord.js@"~13.0.0-dev" "no longer supported" || true

that seems problematic seeing as the other one uses package.json version

hushed rampart Jul 30, 2021, 11:15 PM

what other one

grave hazel Jul 30, 2021, 11:15 PM

          npm version --git-tag-version=false $(jq --raw-output '.version' package.json).$(date +%s).$(git rev-parse --short HEAD)

hushed rampart Jul 30, 2021, 11:15 PM

i mean sure

grave hazel Jul 30, 2021, 11:15 PM

it uses jq

hushed rampart Jul 30, 2021, 11:15 PM

sure

published a new dev release btw

does that fix it now

grave hazel Jul 30, 2021, 11:17 PM

sec lemme check

yes

fixed

hushed rampart Jul 30, 2021, 11:22 PM

wait what

are you saying we have to stick with the t for now lol