chore(deps): update yarn to v4.17.1

[nickboldt]

Summary

• Bump Yarn from 4.12.0 to 4.17.1 (packageManager, yarnPath / release binary, Containerfile pin) to align with rhdh-plugins.

Test plan

• Confirm yarn -v reports 4.17.1 via yarnPath / Corepack
• Spot-check install/build for affected packages

Generated-by: cursor

Ref: https://redhat.atlassian.net/browse/RHIDP-16074

[rhdh-qodo-merge]

PR Summary by Qodo

chore(deps): bump Yarn to 4.17.1 across repo and container build

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Pin Yarn to 4.17.1 via packageManager across workspaces for consistent Corepack resolution.
• Update .yarnrc.yml yarnPath to the 4.17.1 release binary for reproducible installs.
• Align container build Yarn path/env to match the repo-pinned Yarn version.

Diagram

graph TD
  A["package.json (root)"] --> F(["Yarn/Corepack 4.17.1"])
  B[".ci/package.json"] --> F
  C["dynamic-plugins/package.json"] --> F
  D["e2e-tests/package.json"] --> F
  E[".yarnrc.yml"] --> G[".yarn/releases yarn-4.17.1.cjs"] --> F
  H["Containerfile"] --> F

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Rely on Corepack only (remove yarnPath)

• ➕ Avoid committing/maintaining a Yarn release binary under .yarn/releases.
• ➕ Reduces the number of places that must be updated during Yarn bumps.
• ➖ Less deterministic if Corepack resolution differs across environments.
• ➖ May diverge from existing repo conventions and container expectations.

2. Single-source Yarn version via build arg/env (container)

• ➕ Avoids hardcoding the Yarn binary filename in the Containerfile.
• ➕ Makes future bumps a single-variable change for container builds.
• ➖ Still requires ensuring runtime matches repo packageManager/yarnPath.
• ➖ Adds indirection to the container build process.

Recommendation: Keep the current approach (updating packageManager, yarnPath, and the container pin together) because it maximizes determinism across dev/CI/container environments and aligns with the referenced rhdh-plugins baseline. Consider a future follow-up to reduce duplicated version strings (e.g., templating the Containerfile) if bumps become frequent.

Files changed (6) +6 / -6

Other (6) +6 / -6

package.jsonBump CI packageManager Yarn pin to 4.17.1 +1/-1

Bump CI packageManager Yarn pin to 4.17.1

• Updates the 'packageManager' field from 'yarn@4.12.0' to 'yarn@4.17.1' to keep CI aligned with the repo Yarn version.

.ci/package.json

.yarnrc.ymlUpdate yarnPath to Yarn 4.17.1 release binary +1/-1

Update yarnPath to Yarn 4.17.1 release binary

• Points 'yarnPath' at '.yarn/releases/yarn-4.17.1.cjs' so the repo uses the pinned Yarn 4.17.1 binary.

.yarnrc.yml

ContainerfilePin container YARN env path to 4.17.1 binary +1/-1

Pin container YARN env path to 4.17.1 binary

• Updates the 'ENV YARN=...' path to reference the Yarn 4.17.1 release binary copied into the container build context.

build/containerfiles/Containerfile

package.jsonBump dynamic-plugins packageManager Yarn pin to 4.17.1 +1/-1

Bump dynamic-plugins packageManager Yarn pin to 4.17.1

• Updates the workspace 'packageManager' field to 'yarn@4.17.1' for consistent Corepack behavior.

dynamic-plugins/package.json

package.jsonBump e2e-tests packageManager Yarn pin to 4.17.1 +1/-1

Bump e2e-tests packageManager Yarn pin to 4.17.1

• Updates the workspace 'packageManager' field to 'yarn@4.17.1' so E2E tooling uses the same Yarn version.

e2e-tests/package.json

package.jsonBump root packageManager Yarn pin to 4.17.1 +1/-1

Bump root packageManager Yarn pin to 4.17.1

• Updates the root 'packageManager' field to 'yarn@4.17.1', ensuring the primary workspace pins the intended Yarn version.

package.json

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

1. Fullsend hardcoded Yarn path 🔗 Cross-repo conflict ☼ Reliability

Description

This PR changes RHDH’s configured vendored Yarn path to .yarn/releases/yarn-4.17.1.cjs, but
rhdh-plugins’ Fullsend helper script hardcodes the target RHDH Yarn executable as
.yarn/releases/yarn-4.12.0.cjs. As a result, Fullsend workflows that run against the RHDH repo
will fail to find/execute Yarn after this change unless rhdh-plugins is updated or RHDH keeps a
compatibility file.

Code

.yarnrc.yml[3]

+yarnPath: .yarn/releases/yarn-4.17.1.cjs

Relevance

●●● Strong

Likely treated as workflow-breaking drift; team often accepts fixes ensuring build/tool paths stay
valid.

PR-#4908
PR-#2813

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

In this PR, RHDH now points to a vendored Yarn file named yarn-4.17.1.cjs. In rhdh-plugins, the
Fullsend helper script for RHDH explicitly checks for and executes
.../.yarn/releases/yarn-4.12.0.cjs in the target repo, so the script will fail once that exact
filename is no longer present in RHDH.

.yarnrc.yml[1-3]
build/containerfiles/Containerfile[52-63]
External repo: redhat-developer/rhdh-plugins, .fullsend/rhdh/bin/yarn [4-12]
External repo: redhat-developer/rhdh-plugins, package.json [14-17]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
rhdh-plugins contains a Fullsend wrapper script that expects the RHDH repo to have a vendored Yarn file at `.yarn/releases/yarn-4.12.0.cjs`. This PR updates RHDH to use `.yarn/releases/yarn-4.17.1.cjs`, which makes that hardcoded path invalid.

## Issue Context
The breaking dependency is in `rhdh-plugins/.fullsend/rhdh/bin/yarn`, which checks for `${FULLSEND_TARGET_REPO_DIR}/.yarn/releases/yarn-4.12.0.cjs` and then executes it via `node`.

## Fix Focus Areas
Option A (PR-side compatibility, minimal coordination):
- Add a small compatibility wrapper file at `.yarn/releases/yarn-4.12.0.cjs` that simply requires/executes `yarn-4.17.1.cjs`, or add a symlink named `yarn-4.12.0.cjs` pointing to `yarn-4.17.1.cjs`.

Option B (cross-repo coordination, more robust long-term):
- Update the rhdh-plugins Fullsend script to read `yarnPath` from the target repo’s `.yarnrc.yml` (or to execute `corepack yarn`) rather than hardcoding a specific Yarn release filename.

Recommended focus locations:
- .yarnrc.yml[1-3]
- .yarn/releases/[add yarn-4.12.0.cjs shim]
- /cross_repos/rhdh-plugins/.fullsend/rhdh/bin/yarn[4-12]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Compliance rules (platform): 46 rules

✅ Skills: e2e-verify-fix, e2e-diagnose-and-fix

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh-plugins (sha: 64becad8)

  Not relevant to this PR: redhat-developer/rhdh-chart

  Not relevant to this PR: redhat-developer/rhdh-operator

  Not relevant to this PR: redhat-developer/rhdh-local

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.69%. Comparing base (4c5a4e8) to head (d7b4ec0).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5226   +/-   ##
=======================================
  Coverage   63.69%   63.69%           
=======================================
  Files         123      123           
  Lines        2424     2424           
  Branches      548      576   +28     
=======================================
  Hits         1544     1544           
+ Misses        879      878    -1     
- Partials        1        2    +1     

Flag	Coverage Δ
rhdh	63.69% <ø> (ø)

Components	Coverage Δ
Backend plugins	100.00% <ø> (ø)
Backend app	66.66% <ø> (ø)
Frontend app	58.89% <ø> (ø)
Plugin utils	100.00% <ø> (ø)
Dynamic plugins utils	∅ <ø> (∅)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4c5a4e8...d7b4ec0. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

The container image build workflow finished with status: failure.

[nickboldt]

/retest

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5226
• quay.io/rhdh-community/rhdh:pr-5226-341e9864

[nickboldt]

/test e2e-ocp-helm

[nickboldt]

Unclear if the failures are known / expected?

Error: Timed out waiting 180000ms from config.webServer.

?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5226
• quay.io/rhdh-community/rhdh:pr-5226-d7b4ec0e