fix(plugin-js-packages): prevent negative scores in yarn v2+ workspaces #1025
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
🧩 js-packages-plugin
vmasek
approved these changes
Jul 7, 2025
Code PushUp😟 Code PushUp report has regressed – compared current commit 3880ae4 with previous commit 562c83b. 🕵️ See full comparison in Code PushUp portal 🔍 🏷️ Categories
👎 1 group regressed, 👎 5 audits regressed, 12 audits changed without impacting score🗃️ Groups
20 other groups are unchanged. 🛡️ Audits
588 other audits are unchanged. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Error reported by customer trying to integrate
@code-pushup/js-packages-pluginin their Yarn 4 workspace.The cause of the negative scores is the number of packages with outdated major versions (from
yarn outdated --json) exceeds the total number of packages (from rootpackage.json). This is likely caused by the fact that by default,yarn-plugin-outdatedincludes all workspaces in it's output, and this can even result in a package being listed several times. For example, runningyarn outdatedinrx-angular(also uses Yarn v4 workspaces) results in this output (notice duplicates liketslib):Our plugin isn't designed to handle workspaces, so the simplest solution is to filter out results from other packages using
--workspace=.. Tested inrx-angular, where the output becomes (notice no duplicate packages and Workspace column is always the same):In Yarn 4 projects which don't use workspaces (simulated in
rx-angularby removingworkspacesfrompackage.json), the output is the same regardless of--workspace=.being present, except the Workspace column isn't included (but we don't use it anyway).