Migration to Yarn 2 causes unnecessary installation of devDependencies when adding custom plugins

[soulchild]

Describe the bug

The migration to Yarn2 causes our custom Docker build to install all devDependencies when adding Verdaccio plugins in a custom Dockerfile. Because Yarn2 removed the option --production (and there is no apparent alternative), every subsequent yarn add command installs all dependencies (including devDependencies) again.

To Reproduce

Given this Dockerfile:

FROM verdaccio/verdaccio:4

RUN yarn add verdaccio-ldap verdaccio-aws-s3-storage

All devDependencies of Verdaccio are installed again taking a long time and downloading half of npm. 😄 I suppose this is because the final image of the multi-stage build of Verdaccio correctly doesn't include the devDependencies (used only in the builder stage) which are now installed again when we run yarn add.

Expected behavior

Only the necessary plugin modules are installed.

[juanpicado]

I won't revert those changes, I'm basically focused on next major which we don't use yarn v2, rather pnpm. Feel free to check branch 5.x or tag 5.x-nex.

Example with yarn 2 --> https://github.com/ayush987goyal/verdaccio-service-construct/blob/main/src/assets/start.sh

Updated: 5.x uses yarn2 with pnp enabled. While the master branch (future 6.x) uses pnpm.

[soulchild]

@juanpicado Ok, cool, but what exactly does that mean? 😄 This is the first time I'm hearing about a yarn-feature called "PnP" and I don't really understand how this solves my initial problem?

Does it mean, I can just go ahead and use yarn add verdaccio-aws-s3-storage again without pulling down the whole internet? Because I just tried that and it takes a couple of minutes just to add that one simple plugin. This looks like it's again pulling all devDependencies.

Sorry for bothering you again, but I have never really used yarn. Thanks!

[juanpicado]

No worries, long story short, I'm focused on the next major release, so we might need to live with this issue (unless someone else wants to dig more) since on the master branch we use already pnpm and does not make much sense to me invest time in something that already does not have continuity.

If you want to give it a try, is this tag nightly-master, maybe the issue is gone there, maybe not, but, if it is also present there with pnpm then I'll put it on the queue of bugs toofix.

https://hub.docker.com/layers/verdaccio/verdaccio/nightly-master/images/sha256-f48b67b2111e90eacb030c40d89e677e3aab60ce807b041aa8cf1f39af39d0bb?context=explore

[juanpicado]

and the super short story :) I just wanna give some info to this problem and that I haven't forgotten the issue, 🙃 .

[soulchild]

Hey @juanpicado, thanks for the clarification. If I find some time, I'll give Verdaccio 6 a spin to see if the problem goes away.