Yarn Classic

Note

Yarn Classic (1.x) is frozen, taking only security fixes; the actively developed Yarn Berry line has a different CLI and is wrapped separately as the yarn-berry manager.

ID

yarn

Home page

https://yarnpkg.com

Version requirement

>= 1.20, < 2

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup

purl types

pkg:npm · pkg:yarn

CLI name

yarn

Every call

yarn --silent <command>

Issues and PRs

📦 manager: npm-based

Source

meta_package_manager/managers/yarn.py

Yarn Classic, the 1.x line.

mpm claims this class for any yarn binary reporting a 1.x version and drives it through the yarn global command family, so installs, upgrades and removals target the global prefix. Its --json output is a stream of one JSON object per line, not a single document, so every query is parsed line by line.

Note

Yarn has no dedicated search command by maintainer decision, so search is simulated with yarn info and only resolves exact package names.

What mpm adds to yarn

Through mpm, yarn gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover yarn alongside npm, pnpm, volta, yarn-berry and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your yarn commands, in mpm

You already know yarn: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With yarn	With mpm
List what’s installed	yarn global --json list --depth 0	mpm --yarn installed
List outdated packages	yarn --json outdated --cwd ~/.config/yarn/global	mpm --yarn outdated
Search for a package	yarn --json info python	mpm --yarn search python
Install a package	yarn global add awesome-lint	mpm install pkg:yarn/awesome-lint
Upgrade one package	yarn global upgrade markdown --latest	mpm --yarn upgrade markdown
Upgrade everything	yarn global upgrade --latest	mpm --yarn upgrade --all
Remove a package	yarn global remove awesome-lint	mpm remove pkg:yarn/awesome-lint
Clear caches	yarn cache clean --all	mpm --yarn cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated	✓
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade	✓
upgrade_all	✓
remove	✓
sync
cleanup	✓
doctor

Selecting and configuring yarn

Deselect yarn for a single run with --no-yarn, or persist the choice in your configuration:

[mpm]
yarn = false

The arguments and environment variables listed in the box atop this page are forced on every yarn call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.yarn]
timeout = 900

mpm config-template yarn prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around yarn, one mpm command each:

• Snapshot and clone a machine: mpm --yarn dump yarn.toml, then mpm restore yarn.toml on the next one.

• Export a compliance SBOM: mpm --yarn sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Yarn Classic’s release-age gating, from the cooldown support table:

• Status: ❌ None (project in maintenance mode)

• Reference: yarnpkg/yarn

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: npm registry (pkg:npm)

• Retraction: Unpublish within 72 h of publishing, then only with no dependents, under 300 weekly downloads and a single owner (policy). Past that, flag only: npm deprecate warns on install but does not stop resolution

• Publish date: ✅ time, mapping each version to its publication timestamp (packument)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is extracted from the output of yarn --version with:

r"(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Yarn Classic well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ yarn global --json list --depth 0
{"type":"activityStart","data":{"id":0}}
{"type":"activityTick","data":{"id":0,"name":"awesome-lint@^0.18.0"}}
{"type":"activityTick","data":{"id":0,"name":"arrify@^2.0.1"}}
{"type":"activityTick","data":{"id":0,"name":"case@^1.6.3"}}
{"type":"activityTick","data":{"id":0,"name":"emoji-regex@^9.2.0"}}
{"type":"activityEnd","data":{"id":0}}
{"type":"progressStart","data":{"id":0,"total":327}}
{"type":"progressTick","data":{"id":0,"current":1}}
{"type":"progressTick","data":{"id":0,"current":2}}
{"type":"progressTick","data":{"id":0,"current":3}}
{"type":"progressTick","data":{"id":0,"current":4}}
{"type":"progressTick","data":{"id":0,"current":5}}
{"type":"progressFinish","data":{"id":0}}
{"type":"info","data":""awesome-lint@0.18.0" has binaries:"}
{"type":"list","data":{"type":"bins-awesome-lint","items":["awesome-lint"]}}

$ yarn --json outdated --cwd ~/.config/yarn/global
{"type":"warning","data":"package.json: No license field"}
{"type":"table","data":{"head":["Package","Current","Wanted","Latest","Package Type","URL"],"body":[["markdown","0.4.0","0.4.0","0.5.0","dependencies","git://github.com/evilstreak/markdown-js.git"]]}}

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --yarn installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 6.5.0 (2026-05-25)

  • Fix search to parse NDJSON output line by line, collecting only inspect-type entries, since newer Yarn emits multiple JSON objects with a trailing status line.

• 6.3.0 (2026-04-09)

  • Split into Yarn Classic and Yarn Berry managers. Restrict Classic to <2.0.0. Closes #1548.

• 6.2.0 (2026-03-25)

  • Add --silent option to all yarn invocations to suppress console logs.

• 5.12.0 (2023-02-25)

  • Do not test yarn on Linux and Windows.

• 5.5.1 (2022-07-11)

  • Implements remove operation.

  • Fix, document and cleanup all global commands.

  • Set minimal yarn version to 1.20.0, as it should have been.

• 3.4.0 (2020-08-18)

  • Set minimal requirement to 1.20.0.

  • Fix deprecated global arguments.

• 3.0.0 (2020-03-25)

  • Add support for yarn package manager for Linux, macOS and Windows.

  • Install yarn on all unittest platforms.