cypress-io / cypress-io/github-action
Yarn v1 Classic unsupported - deprecation is due
- Dominant language
- JavaScript
- Stars
- 1.5k
- Forks
- 353
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 27
Description
## Situation
- The action installs and runs projects based on Yarn v1 Classic `yarn.lock` lock files, alongside npm and pnpm projects as alternatives.
- GitHub Actions runner images such as [ubuntu-26.04](https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2604-Readme.md#package-management) continue to bundle Yarn 1.22.22.
- Yarn v1 Classic has however been in maintenance mode since Jan 2020 with no further support. Maintainers have indicated that they may formally deprecate Yarn v1 in Q3/2026.
## Background
Yarn was originally released 14 years ago. The [yarn@1.0.0](https://github.com/yarnpkg/yarn/releases/tag/v1.0.0) release followed then 8 years ago. With the release of [Yarn 2](https://dev.to/arcanis/introducing-yarn-2-4eh1) in Jan 2020, it was [announced](https://dev.to/arcanis/introducing-yarn-2-4eh1#what-will-happen-to-the-legacy-codebase) that Yarn v1 would enter maintenance mode and provide security fixes only. This is underlined by the notice on the source repo https://github.com/yarnpkg/yarn :
> The 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry
The last Yarn v1 Classic release was [yarn@1.22.22](https://github.com/yarnpkg/yarn/releases/tag/v1.22.22) in March 2024.
| Event | Date |
| ----------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| Inital `yarn@0.1.0` release | Mar 2012 |
| [yarn@1.0.0](https://github.com/yarnpkg/yarn/releases/tag/v1.0.0) release | Sep 2017 |
| [Yarn 2 GA](https://dev.to/arcanis/introducing-yarn-2-4eh1) | Jan 2020 |
| [yarn@1.22.22](https://github.com/yarnpkg/yarn/releases/tag/v1.22.22) release | Mar 2024 |
| [PGP signing key expiry](https://keyserver.ubuntu.com/pks/lookup?search=6A010C5166006599AA17F08146C2130DFD2497F5&fingerprint=on&op=index) | Jan 2030 |
Cloning the repo and attempting to run `yarn test` locally under Ubuntu `24.04.4` LTS produces failures on all Node.js versions from `8 - 26`.
The PGP signing key [6A010C5166006599AA17F08146C2130DFD2497F5](https://keyserver.ubuntu.com/pks/lookup?search=6A010C5166006599AA17F08146C2130DFD2497F5&fingerprint=on&op=index) expires on 2030-01-22T18:44:02Z.
## Assessment
Yarn v1 Classic must be considered as no longer suitable for production usage.
- It is untested in currently supported Node.js versions `>=20`
- Emerging bugs and [open issues](https://github.com/yarnpkg/yarn/issues) are not addressed. PRs can no longer be submitted by community Contributors.
## Recommendation
Deprecate Yarn v1 Classic usage in the Cypress action.
Contributor guide
Assessment
This issue has not been assessed yet.