[공통] Yarn 4.17.0 업그레이드로 PnP prettier 로드 오류 수정#1280
Merged
Conversation
WalkthroughYarn 패키지 매니저를 4.10.3에서 4.17.0으로 업그레이드합니다. ChangesYarn 4.17.0 업그레이드
VS Code 설정 포맷 정리
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.yarnrc.yml (1)
10-10: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winnpm 패키지 연령 보호 비활성화.
npmMinimalAgeGate: 0설정은 신규 게시된 npm 패키지에 대한 보호를 비활성화합니다. 이로 인해 악의적인 타이포스쿼팅 공격에 사용되는 신규 패키지를 즉시 설치할 수 있는 위험이 있습니다.최소 24~48시간(예:
86400또는172800초)의 대기 시간을 설정하여 신규 패키지에 대한 기본적인 보호를 추가하는 것을 권장합니다.🛡️ 권장 설정
-npmMinimalAgeGate: 0 +npmMinimalAgeGate: 86400 # 24시간 대기 (초 단위)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.yarnrc.yml at line 10, The npmMinimalAgeGate setting in .yarnrc.yml is currently set to 0, which disables protection against newly published npm packages. Change the value of npmMinimalAgeGate from 0 to a higher value representing a minimum wait time in seconds, such as 86400 for 24 hours or 172800 for 48 hours, to prevent the immediate installation of newly published packages that could be part of typosquatting attacks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.yarnrc.yml:
- Around line 1-2: The approvedGitRepositories setting in the .yarnrc.yml file
uses a wildcard pattern that permits all Git repositories as dependency sources,
which poses a supply chain security risk. Replace the wildcard pattern "**" with
explicit, specific patterns that only allow trusted repositories that your
project actually depends on. Identify the legitimate repository domains or
patterns your dependencies require and add only those to the
approvedGitRepositories list instead of allowing all repositories with the
catch-all pattern.
- Line 8: The `enableScripts: true` setting in the `.yarnrc.yml` file enables
lifecycle scripts unnecessarily, as the current project dependencies do not use
any lifecycle scripts (preinstall, postinstall, install, prepare). Either change
the `enableScripts` setting from `true` to `false` to remove this unnecessary
security risk, or if there is a specific purpose for enabling scripts, add a
clear comment above the line in `.yarnrc.yml` explaining the rationale.
---
Nitpick comments:
In @.yarnrc.yml:
- Line 10: The npmMinimalAgeGate setting in .yarnrc.yml is currently set to 0,
which disables protection against newly published npm packages. Change the value
of npmMinimalAgeGate from 0 to a higher value representing a minimum wait time
in seconds, such as 86400 for 24 hours or 172800 for 48 hours, to prevent the
immediate installation of newly published packages that could be part of
typosquatting attacks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e259ae72-f6ad-434d-aba7-958a47b652cc
⛔ Files ignored due to path filters (23)
.pnp.cjsis excluded by!.pnp.cjsand included by**.pnp.loader.mjsis excluded by!.pnp.loader.mjsand included by**.yarn/cache/@esbuild-darwin-arm64-npm-0.27.2-d675c4a521-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@esbuild-linux-x64-npm-0.27.2-11f1a3d9db-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@img-sharp-darwin-arm64-npm-0.34.3-8944698b4c-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@img-sharp-libvips-darwin-arm64-npm-1.2.0-2d65006be7-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@img-sharp-libvips-linux-x64-npm-1.2.0-91cf635ac8-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@img-sharp-linux-x64-npm-0.34.3-aa297ca1ca-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@next-env-npm-15.5.16-451e0aa651-4ba5975b7b.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@next-swc-darwin-arm64-npm-15.5.18-ac1ed6c8cc-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@next-swc-linux-x64-gnu-npm-15.5.18-388d9a3fbc-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@rollup-rollup-darwin-arm64-npm-4.59.0-db3495ba42-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@rollup-rollup-linux-x64-gnu-npm-4.59.0-da6c703f69-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@sentry-cli-darwin-npm-2.45.0-76059cfa9f-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@sentry-cli-darwin-npm-2.58.5-1f667e3b9d-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@sentry-cli-linux-x64-npm-2.45.0-6e5f26280b-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@sentry-cli-linux-x64-npm-2.58.5-7cea7778bc-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@unrs-resolver-binding-darwin-arm64-npm-1.11.1-c78d4bd2cb-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/@unrs-resolver-binding-linux-x64-gnu-npm-1.11.1-93a00570de-10.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/cache/next-npm-15.5.16-6a72a2b582-6575ffe4b6.zipis excluded by!**/.yarn/**,!**/*.zip,!.yarn/**and included by**.yarn/releases/yarn-4.10.3.cjsis excluded by!**/.yarn/**,!.yarn/**and included by**.yarn/releases/yarn-4.17.0.cjsis excluded by!**/.yarn/**,!.yarn/**and included by**yarn.lockis excluded by!**/yarn.lock,!**/*.lock,!yarn.lockand included by**
📒 Files selected for processing (3)
.vscode/settings.json.yarnrc.ymlpackage.json
Comment on lines
+1
to
+2
| approvedGitRepositories: | ||
| - "**" |
There was a problem hiding this comment.
과도하게 허용적인 Git 저장소 설정.
approvedGitRepositories: ["**"] 설정은 모든 Git 저장소를 의존성 소스로 허용합니다. 이는 악의적이거나 손상된 저장소가 의존성으로 추가될 위험을 높이는 공급망 보안 취약점입니다.
명시적으로 신뢰할 수 있는 저장소만 허용하도록 패턴을 제한하는 것을 권장합니다.
🔒 더 제한적인 설정 예시
approvedGitRepositories:
- - "**"
+ - "https://github.com/your-org/**"
+ - "https://github.com/trusted-vendor/**"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.yarnrc.yml around lines 1 - 2, The approvedGitRepositories setting in the
.yarnrc.yml file uses a wildcard pattern that permits all Git repositories as
dependency sources, which poses a supply chain security risk. Replace the
wildcard pattern "**" with explicit, specific patterns that only allow trusted
repositories that your project actually depends on. Identify the legitimate
repository domains or patterns your dependencies require and add only those to
the approvedGitRepositories list instead of allowing all repositories with the
catch-all pattern.
| enableGlobalCache: false | ||
|
|
||
| yarnPath: .yarn/releases/yarn-4.10.3.cjs | ||
| enableScripts: true |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: 라이프사이클 스크립트를 포함한 패키지 검색
# node_modules 내 package.json에서 scripts 필드가 있는 패키지 검색
fd -t f -H 'package.json' node_modules | xargs -I {} sh -c 'jq -r "select(.scripts | has(\"preinstall\", \"postinstall\", \"install\")) | .name" {} 2>/dev/null' | grep -v "^$" | sort -uRepository: BCSDLab/KOIN_WEB_RECODE
Length of output: 167
🏁 Script executed:
# Check if .yarnrc.yml exists and view its content
cat -n .yarnrc.yml 2>/dev/null || echo "File not found"Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 499
🏁 Script executed:
# Check for package.json and yarn.lock
ls -la | grep -E "package\.json|yarn\.lock"Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 196
🏁 Script executed:
# Get file size of yarn.lock to understand if we can read it
stat yarn.lock 2>/dev/null | grep -i size || echo "yarn.lock info not available"Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 96
🏁 Script executed:
# Read full package.json
cat -n package.jsonRepository: BCSDLab/KOIN_WEB_RECODE
Length of output: 3812
🏁 Script executed:
# Search yarn.lock for packages that have lifecycle scripts defined
grep -E "^\s+(preinstall|postinstall|install|prepare):" yarn.lock | head -30Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 49
🏁 Script executed:
# Search yarn.lock more broadly for script sections
grep -A 5 'scripts:' yarn.lock | grep -E '(preinstall|postinstall|install|prepare):' | head -20Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 49
🏁 Script executed:
# Count how many packages have scripts sections in yarn.lock
grep -c 'scripts:' yarn.lockRepository: BCSDLab/KOIN_WEB_RECODE
Length of output: 69
🏁 Script executed:
# Look for specific patterns - search for packages with script entries
grep -B 2 'preinstall\|postinstall\|prepare":' yarn.lock | head -40Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 371
🏁 Script executed:
# Final check - search for any lifecycle script mentions in entire yarn.lock
grep -E '"(preinstall|postinstall|prepare|install)"' yarn.lock | head -10Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 49
🏁 Script executed:
# Also check if .yarnrc.yml has any comments or context about why enableScripts is true
cat -n .yarnrc.yml | head -20Repository: BCSDLab/KOIN_WEB_RECODE
Length of output: 499
불필요한 라이프사이클 스크립트 활성화 설정 제거 권장
enableScripts: true 설정이 활성화되어 있으나, 현재 프로젝트의 의존성 중 라이프사이클 스크립트(preinstall, postinstall, install, prepare)를 사용하는 패키지가 없습니다. 불필요한 보안 위험을 제거하기 위해 이 설정을 false로 변경하거나, 특정 목적이 있는 경우 .yarnrc.yml에 주석으로 설명해주세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.yarnrc.yml at line 8, The `enableScripts: true` setting in the
`.yarnrc.yml` file enables lifecycle scripts unnecessarily, as the current
project dependencies do not use any lifecycle scripts (preinstall, postinstall,
install, prepare). Either change the `enableScripts` setting from `true` to
`false` to remove this unnecessary security risk, or if there is a specific
purpose for enabling scripts, add a clear comment above the line in
`.yarnrc.yml` explaining the rationale.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR? 🔍
기능 : Yarn 4.10.3 → 4.17.0 업그레이드로 VSCode Prettier 확장 로드 오류 해결
Yarn
4.10.3→4.17.0업그레이드Node 22.18+ 에서 PnP가
require()의conditions옵션을 거부해 Prettier 확장 로드가 실패하던 문제 수정 (4.17.0 PnP 런타임에서 해결).pnp.cjs/.yarn/sdks/.vscode/settings.json재생성Test CheckList ✅
yarn install정상 완료✔️ Please check if the PR fulfills these requirements
developbranch unconditionally?main?yarn lintSummary by CodeRabbit