Yarn: Yarn installs old versions in .bin

[domoritz]

Reproduce with

git clone [email protected]:vega/vega-lite.git
cd vega-lite
rm yarn.lock
yarn
node_modules/.bin/uglifyjs --version

Prints uglify-js 2.8.29 but should print version 3.

[bestander]

Can repro this with latest Yarn.
Worked in 0.24

[bestander]

uglifyjs -> ../handlebars/node_modules/uglify-js/bin/uglifyjs

[bestander]

package-linker.js determineTopLevelBinLinks has incorrect logic inside.
It needs to go through top level dependencies first and then through the flat tree.

[uhoh-itsmaciek]

As another data point, 0.24.6 works correctly for me, and 0.25.4 breaks (it means our yarn script uses the wrong eslint version and breaks our linting).

[pselden]

Also, if there is one without a bin and one with, it won't even put anything in .bin.

Example:

{
  "name": "test-yarn",
  "version": "1.0.0",
  "main": "index.js",
  "license": "MIT",
  "devDependencies": {
    "sane": "^2.0.0",
    "watch": "^1.0.2"
  }
}

sane depends on watch 0.10.0, which has no .bin, but watch 1.0 does. No watch command is added to node_modules/.bin

[gkalpak]

Just got bitten by this too. It seems that was broken in 0.25.4 (0.25.3 works fine): https://github.com/yarnpkg/yarn/compare/v0.25.3...v0.25.4

[timfish]

Our CI builds started failing only on linux because of this as our provider updated yarn to v0.27.5.
This repo reproduces the issue: https://github.com/timfish/yarn-test

Running yarn build:html used to work and now it fails as the version of html-minifier in .bin is an older version which is a dependency of aurelia-bunder.

[kaylie-alexa]

I have a working PR to fix this issue here https://github.com/yarnpkg/yarn/pull/3877