Subject: bug#706: yarnpkg: depends on incompatible version of commander

From: Kristof Csillag <[email-masked]>
Date: Tue, 6 Sep 2022 23:47:59 +0200

Package: yarnpkg

Version: 1.22.19+~cs24.27.18-1
Severity: normal
X-Debbugs-Cc: [email-masked]

The current version of node-commander in Debian testing an unstable in 9.4.0.
However, this version is not fully compatible
with the current version of yarn.

For some packages, you will get something like this:

yarn run v1.22.19
TypeError: _commander(...).default.optionFor is not a function
     at /usr/share/nodejs/yarn/lib/cli/index.js:511:88
     at Array.findIndex (<anonymous>)
     at _callee$ (/usr/share/nodejs/yarn/lib/cli/index.js:507:38)
     at tryCatch
(/usr/share/nodejs/@babel/runtime/helpers/regeneratorRuntime.js:86:17)
     at Generator._invoke
(/usr/share/nodejs/@babel/runtime/helpers/regeneratorRuntime.js:66:24)
     at Generator.next
(/usr/share/nodejs/@babel/runtime/helpers/regeneratorRuntime.js:117:21)
     at asyncGeneratorStep
(/usr/share/nodejs/@babel/runtime/helpers/asyncToGenerator.js:3:24)
     at _next
(/usr/share/nodejs/@babel/runtime/helpers/asyncToGenerator.js:25:9)
     at /usr/share/nodejs/@babel/runtime/helpers/asyncToGenerator.js:32:7
     at new Promise (<anonymous>)

The short summary is that yarn tries to use the "optionFor" feature of
commnder,
but as far as I can tell, the last version of commander that still had
optionFor was version 4.1.1;
it has been removed by the time 5.0.0 has been released.

The upstream yarn package depends on "^2.9.0", so the currently packaged 9.4.0
definitely doesn't satisfy it.

I suggest shipping an older version commander to satisfy this dependency.

-- System Information:
Distributor ID: Devuan
Description:    Devuan GNU/Linux 4 (chimaera)
Release:        4
Codename:       chimaera
Architecture: x86_64

Kernel: Linux 5.19.0-1-amd64 (SMP w/24 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=hu_HU.UTF-8, LC_CTYPE=hu_HU.UTF-8 (charmap=UTF-8), LANGUAGE not
set
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled

Versions of packages yarnpkg depends on:
ii  ca-certificates                    20210119
ii  node-asap                          2.0.6+~2.0.0-1
ii  node-babel7-runtime                7.18.13+~cs214.250.184-2
ii  node-bytes                         3.1.2-1
ii  node-camelcase                     7.0.0-2
ii  node-chalk                         5.0.1-2
ii  node-chownr                        1.1.3-5
ii  node-ci-info                       3.3.2+~cs4.2.0-1
ii  node-cli-table                     0.3.11+~cs0.13.4-1
ii  node-commander                     9.4.0-1
ii  node-death                         1.1.0-2
ii  node-debug                         4.3.4+~cs4.1.7-1
ii  node-deep-equal                    2.0.5+~cs32.12.77-1
ii  node-detect-indent                 6.1.0-1
ii  node-duplexify                     4.1.2-1
ii  node-emoji                         1.10.0+~1.8.1-1
ii  node-fast-levenshtein              2.0.6+ds-3
ii  node-glob                          7.1.6+~7.1.3-1
ii  node-imports-loader                0.8.0-5
ii  node-ini                           3.0.1-1
ii  node-inquirer                      8.2.3+~cs26.8.8-1
ii  node-invariant                     2.2.4-2
ii  node-is-builtin-module             3.2.0-1
ii  node-js-yaml                       4.1.0+dfsg+~4.0.5-6
ii  node-loud-rejection                2.2.0-2
ii  node-micromatch                    4.0.5+~4.0.2-1
ii  node-minimatch                     3.0.4+~3.0.3-1
ii  node-mkdirp                        1.0.4+~1.0.1-1
ii  node-object-path                   0.11.8+~0.11.1-1
ii  node-path-root                     0.1.1-2
ii  node-prepend-http                  3.0.1-2
ii  node-proper-lockfile               4.1.2-2
ii  node-puka                          1.0.1+dfsg-2
ii  node-pump                          3.0.0-5
ii  node-pumpify                       2.0.1-2
ii  node-read                          1.0.7-4
ii  node-request                       2.88.1-5
ii  node-request-capture-har           1.2.2-2
ii  node-resolve                       1.22.1+~cs5.31.10-1
ii  node-rimraf                        3.0.2-1
ii  node-semver                        7.3.4-1
ii  node-sort-keys                     4.0.0-1
ii  node-ssri                          9.0.1-1
ii  node-strict-uri-encode             2.0.0+~2.0.0-1
ii  node-strip-ansi                    6.0.1-1
ii  node-strip-bom                     4.0.0-2
ii  node-tar-stream                    2.2.0+~cs3.2.2-1
ii  node-through2                      4.0.2-2
ii  node-uuid                          8.3.2+~8.3.3-2
ii  node-validate-npm-package-license  3.0.4-2
ii  node-yn                            4.0.0-2
ii  nodejs                             18.7.0+dfsg-5

yarnpkg recommends no packages.

yarnpkg suggests no packages.

---

From: Mark Hindley <[email-masked]>
Date: Fri, 9 Sep 2022 17:57:05 +0100

Control: tags -1 debian
Control: forwarded -1 https://bugs.debian.org/1019291

Kristof,

Thanks for this.

> X-Debbugs-Cc: [email-masked]

However, neither node-commander not yarn are forked packages in Devuan and we
use Debian's packages directly without recompilation.

Thanks for already reporting it to Debian's BTS to be addressed.

Mark

---

From: "Devuan bug Tracking System" <[email-masked]>
Date: Tue, 10 Jan 2023 17:02:03 +0000

This is an automatic notification regarding your bug report
which was filed against the yarnpkg package:

#706: yarnpkg: depends on incompatible version of commander

It has been closed by Mark Hindley <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mark Hindley <[email-masked]> by
replying to this email.

-- 
706: https://bugs.devuan.org/cgi/bugreport.cgi?bug=706
Devuan Bug Tracking System
Contact [email-masked] with problems

Subject: Fixed in Debian #1019291
From: Mark Hindley <[email-masked]>
To: [email-masked]
Date: Tue, 10 Jan 2023 17:01:06 +0000

Version: 1.22.19+~cs24.27.18-2

Subject: yarnpkg: depends on incompatible version of commander
From: Kristof Csillag <[email-masked]>
To: Devuan Bug Tracking System <[email-masked]>
Date: Tue, 6 Sep 2022 23:47:59 +0200

Package: yarnpkg

yarn run v1.22.19

-- System Information:
Distributor ID: Devuan