Browserslist: --update-db fails with Yarn v2 lock file

[bdukes]

Description

When using Yarn v2, running npx browserslist@latest --update-db fails with the error Cannot read property '1' of null. Calling yarn run browserslist --update-db gives the error with some more details:

C:\inetpub\wwwroot\blt\.yarn\cache\browserslist-npm-4.16.1-37866cfd90-56f51464c3.zip\node_modules\browserslist\update-db.js:57
    if (match[1]) return match[1]
             ^

TypeError: Cannot read property '1' of null
    at getCurrentVersion (C:\inetpub\wwwroot\blt\.yarn\cache\browserslist-npm-4.16.1-37866cfd90-56f51464c3.zip\node_modules\browserslist\update-db.js:57:14)
    at updateDB (C:\inetpub\wwwroot\blt\.yarn\cache\browserslist-npm-4.16.1-37866cfd90-56f51464c3.zip\node_modules\browserslist\update-db.js:179:17)
    at Object.<anonymous> (C:\inetpub\wwwroot\blt\.yarn\cache\browserslist-npm-4.16.1-37866cfd90-56f51464c3.zip\node_modules\browserslist\cli.js:40:3)
    at Module._compile (internal/modules/cjs/loader.js:999:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1027:10)
    at Module.load (internal/modules/cjs/loader.js:863:32)
    at Function.external_module_.Module._load (C:\inetpub\wwwroot\blt\.pnp.js:4980:14)
    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:60:12)
    at internal/main/run_main_module.js:17:47

package.json

{
  "name": "blt",
  "version": "1.0.0",
  "main": "index.js",
  "license": "MIT",
  "dependencies": {
    "browserslist": "^4.16.1"
  }
}

yarn.lock

# This file is generated by running "yarn install" inside your project.
# Manual changes might be lost - proceed with caution!

__metadata:
  version: 4
  cacheKey: 7

"blt@workspace:.":
  version: 0.0.0-use.local
  resolution: "blt@workspace:."
  dependencies:
    browserslist: ^4.16.1
  languageName: unknown
  linkType: soft

"browserslist@npm:^4.16.1":
  version: 4.16.1
  resolution: "browserslist@npm:4.16.1"
  dependencies:
    caniuse-lite: ^1.0.30001173
    colorette: ^1.2.1
    electron-to-chromium: ^1.3.634
    escalade: ^3.1.1
    node-releases: ^1.1.69
  bin:
    browserslist: cli.js
  checksum: 56f51464c3a3bd9b2aeb75ded1dc3fce5ad91bd6d84187aba812a78ba66b69bc97c2de25a1b7409daac3c0049e979bf0faa6cca4aacce0abcaf3107c250ce3fb
  languageName: node
  linkType: hard

"caniuse-lite@npm:^1.0.30001173":
  version: 1.0.30001177
  resolution: "caniuse-lite@npm:1.0.30001177"
  checksum: a43eafb57339093bf3343bc6f57cc21ff6779af44c9a26cc078c3b335db12598179d1333a1cbdd6fd25a2c08cfc550c78538b48fbb3e9c383f46460a1c32a1c0
  languageName: node
  linkType: hard

"colorette@npm:^1.2.1":
  version: 1.2.1
  resolution: "colorette@npm:1.2.1"
  checksum: 1cc21ad4b84777a424794f78b6bb6a44b614ae17dcea91762199339f8047598e6d981249eeef7ea588c99eaf062be8fcdcd4866c112998922ed854db6dde96f9
  languageName: node
  linkType: hard

"electron-to-chromium@npm:^1.3.634":
  version: 1.3.639
  resolution: "electron-to-chromium@npm:1.3.639"
  checksum: bf8b79e55d50ddcd55b029feb161a56250f3a8980b5c11b47055fd983b9306ad8c69c0501eef9317e0e03f8c5d69fecb97338c08df8c9456953f5741646794c1
  languageName: node
  linkType: hard

"escalade@npm:^3.1.1":
  version: 3.1.1
  resolution: "escalade@npm:3.1.1"
  checksum: 1e31ff50d66f47cd0dfffa702061127116ccf9886d1f54a802a7b3bc95b94cab0cbf5b145cc5ac199036df6fd9d1bb24af1fa1bfed87c94879e950fbee5f86d1
  languageName: node
  linkType: hard

"node-releases@npm:^1.1.69":
  version: 1.1.69
  resolution: "node-releases@npm:1.1.69"
  checksum: 240b2534f32c8bbdfefb1fb052d2b1c198f3a745141ce245c6c5241a6efefae22d356b66965e5250869013c3c4777050cdca78d39f3b46965166b5f3e02b08d7
  languageName: node
  linkType: hard

Here's a zip of the whole project (just package.json and various Yarn artifacts): sscce.zip

[ai]

--update-db doesn’t have Yarn 2 support.

Do you want to send PR?

[bdukes]

I took a look at implementing this, but the main issue I saw was that Yarn 2 expects a sha512 checksum of the package, which isn't readily available, that I can see. I've asked about it on the Yarn Discord

[Timer]

Why does browserslist use a custom command rather than yarn upgrade or npm upgrade --depth=9999?

[ai]

@Timer I’d like to have a simple command. But both yarn upgrade and npm update will update all dependencies and will make browserslist --update-db a very dangerous move.

We need to update only caniuse-lite version because it is much safer for users.

I tried to find a command to do it but didn’t find a proper way to update all deep dependencies of X (and X only).

[SleeplessByte]

(Just linking these here to point out what Andrey says: there is a yarn feature request to upgrade only a specific package, and deeply/indirect-deps included https://github.com/yarnpkg/yarn/issues/4986 and ~yarnpkg/yarn#2394~ (closed). It's just not possible to deeply update dependencies for a specific package, or so it seems.)

For npm that would be npm --depth 9999 update caniuse-lite?

[ai]

It didn’t work before, but maybe the npm team fixed the command.

Can you create a simple test stand with outdated caniuse-lite in deep dependencies, run npm --depth 9999 update caniuse-lite and show me package-lock.json diff?

We can use this command in --update-db for the npm case.

[arcanis]

At least for Yarn, we want to implement a yarn up -R <name> command that would upgrade the given package regardless where it is on the dependency tree (and only this one). If we had that, would --update-db just shell out to yarn up -R caniuse-lite?

[ai]

@acusti yeap, we can call yarn up -R caniuse-lite in --update-db on Yarn 2 lock-file.

P. S. yarn up -R * is the only blocker for me from moving to Yarn 2 in my working project 😺

[arcanis]

Just merged yarn up -R. It will be released along with the next release (hopefully Yarn 3!) in a month or two (it can already be used now for people who build Yarn from sources, which is a very easy thing).