jfrog / jfrog/jfrog-cli-security
jfrog aud --yarn fails on Yarn v4 despite v2.104.1 adding Yarn v4 support
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
jfrog aud --yarn fails on Yarn v4 monorepos despite v2.104.1 release notes explicitly listing Yarn v4 support (RTECO-1035).
Current behavior
Every package in the monorepo fails with:
failed to build dependency tree: failed while building 'yarn' dependency tree: failed to configure an Artifactory resolution server or running and install command: resolving Yarn dependencies from Artifactory is currently not supported for Yarn V1 and Yarn V4. The current Yarn version is: 4.5.3
Reproduction steps
- Have a Yarn v4 (Berry) monorepo with yarnPath: .yarn/releases/yarn-4.5.3.cjs set in .yarnrc.yml
- Install jfrog CLI v2.104.1
- Run jfrog aud --yarn
- Observe error above for every package in the workspace
Expected behavior
Audit runs successfully and generates a dependency tree using Yarn v4 as advertised in the v2.104.1 release notes: https://github.com/jfrog/jfrog-cli/releases/tag/v2.104.1
JFrog CLI version
jf version 2.104.1
Operating system type and version
macOS Darwin 25.5.0
JFrog Artifactory version
No response
JFrog Xray version
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure with jfrog aud --yarn in a Yarn v4 monorepo using yarnPath: .yarn/releases/yarn-4.5.3.cjs. Trace the Yarn dependency-tree handling for the audit command and compare it with the v2.104.1 release note for RTECO-1035. Done means the command completes and generates a dependency tree for every workspace package without the unsupported-version error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100