cypress-io / cypress-io/github-action

Yarn v1 Classic unsupported - deprecation is due

Open
#1,819 2 comments 0 reactions 1 assignee Claimed by @MikeMcC399 View on GitHub
documentation
Dominant language
JavaScript
Stars
1.5k
Forks
353
Avg merge
1d 22h
Merged PRs (30d)
27

Description

## Situation

- The action installs and runs projects based on Yarn v1 Classic `yarn.lock` lock files, alongside npm and pnpm projects as alternatives.

- GitHub Actions runner images such as [ubuntu-26.04](https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2604-Readme.md#package-management) continue to bundle Yarn 1.22.22.

- Yarn v1 Classic has however been in maintenance mode since Jan 2020 with no further support. Maintainers have indicated that they may formally deprecate Yarn v1 in Q3/2026.

## Background

Yarn was originally released 14 years ago. The [yarn@1.0.0](https://github.com/yarnpkg/yarn/releases/tag/v1.0.0) release followed then 8 years ago. With the release of [Yarn 2](https://dev.to/arcanis/introducing-yarn-2-4eh1) in Jan 2020, it was [announced](https://dev.to/arcanis/introducing-yarn-2-4eh1#what-will-happen-to-the-legacy-codebase) that Yarn v1 would enter maintenance mode and provide security fixes only. This is underlined by the notice on the source repo https://github.com/yarnpkg/yarn :

> The 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry

The last Yarn v1 Classic release was [yarn@1.22.22](https://github.com/yarnpkg/yarn/releases/tag/v1.22.22) in March 2024.

| Event | Date |
| ----------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| Inital `yarn@0.1.0` release | Mar 2012 |
| [yarn@1.0.0](https://github.com/yarnpkg/yarn/releases/tag/v1.0.0) release | Sep 2017 |
| [Yarn 2 GA](https://dev.to/arcanis/introducing-yarn-2-4eh1) | Jan 2020 |
| [yarn@1.22.22](https://github.com/yarnpkg/yarn/releases/tag/v1.22.22) release | Mar 2024 |
| [PGP signing key expiry](https://keyserver.ubuntu.com/pks/lookup?search=6A010C5166006599AA17F08146C2130DFD2497F5&fingerprint=on&op=index) | Jan 2030 |

Cloning the repo and attempting to run `yarn test` locally under Ubuntu `24.04.4` LTS produces failures on all Node.js versions from `8 - 26`.

The PGP signing key [6A010C5166006599AA17F08146C2130DFD2497F5](https://keyserver.ubuntu.com/pks/lookup?search=6A010C5166006599AA17F08146C2130DFD2497F5&fingerprint=on&op=index) expires on 2030-01-22T18:44:02Z.

## Assessment

Yarn v1 Classic must be considered as no longer suitable for production usage.

- It is untested in currently supported Node.js versions `>=20`
- Emerging bugs and [open issues](https://github.com/yarnpkg/yarn/issues) are not addressed. PRs can no longer be submitted by community Contributors.

## Recommendation

Deprecate Yarn v1 Classic usage in the Cypress action.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.