jfrog / jfrog/jfrog-cli-security

jfrog aud --yarn fails on Yarn v4 despite v2.104.1 adding Yarn v4 support

Open
#825 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

jfrog aud --yarn fails on Yarn v4 monorepos despite v2.104.1 release notes explicitly listing Yarn v4 support (RTECO-1035).

Current behavior

Every package in the monorepo fails with:
failed to build dependency tree: failed while building 'yarn' dependency tree: failed to configure an Artifactory resolution server or running and install command: resolving Yarn dependencies from Artifactory is currently not supported for Yarn V1 and Yarn V4. The current Yarn version is: 4.5.3

Reproduction steps
  1. Have a Yarn v4 (Berry) monorepo with yarnPath: .yarn/releases/yarn-4.5.3.cjs set in .yarnrc.yml
  2. Install jfrog CLI v2.104.1
  3. Run jfrog aud --yarn
  4. Observe error above for every package in the workspace
Expected behavior

Audit runs successfully and generates a dependency tree using Yarn v4 as advertised in the v2.104.1 release notes: https://github.com/jfrog/jfrog-cli/releases/tag/v2.104.1

JFrog CLI version

jf version 2.104.1

Operating system type and version

macOS Darwin 25.5.0

JFrog Artifactory version

No response

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with jfrog aud --yarn in a Yarn v4 monorepo using yarnPath: .yarn/releases/yarn-4.5.3.cjs. Trace the Yarn dependency-tree handling for the audit command and compare it with the v2.104.1 release note for RTECO-1035. Done means the command completes and generates a dependency tree for every workspace package without the unsupported-version error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.