Support Yarn v4

[arusahni]

Is there an existing issue for this?

• I have searched the existing issues

Feature description

Yarn v4 was released a little under two months ago. It brings quite a few performance improvements which convinced my team to finally upgrade from v1. However, we had to pause our migration when we discovered Dependabot did not support v4. Since Dependabot does support v1-3, supporting v4 seems to be a reasonable thing to do.

[izi-p]

We recently updated our monorepo to yarn v4 , and I confirm dependabot does not work. It updates dependencies but does not commit updated yarn.lock file.

[deivid-rodriguez]

Wondering if this works if you set packageManager to yarn v4 in your package.json file. We use corepack internally to select the yarn version to be used so there's a chance that helps?

[tyzh-dev]

A PR exists to bump Yarn to V4: #8265. Only one check out of 44 seems to be failing.

[brocef]

Any update on yarn v4 support? To expound on the original reasoning for why this would be nice, it provides a way to change how yarn creates symlinks on Windows which–selfishly speaking–would make my job easier.

[jpandersen87]

I have a PR that fixes the issue causing the test to fail here: #9405

[abdulapopoola]

@brocef , @jpandersen87 's PR (thanks @jpandersen87 !) was already merged, please reactivate if yarn4 still doesn't work

[alexbchr]

We've been using Dependabot since the last few weeks with Yarn v4 and so can confirm it does "work" and update the yarn.lock.

However, just asking a question here and I'll open a separate issue with more context if I see it's related to Yarn v4, but we're having a bit of trouble with Yarn v4 and the Dependabot groups. Our dependabot.yml file contains quite a few groups configurations but for some reasons, some dependencies like next or jose seem to just be ignoring those group configurations completely, as they get added to groups defined at the complete end of our groups configuration.

Since this issue was still opened, I thought it was something to do with Yarn v4 support, but now that @abdulapopoola says it has been available since a few weeks already, I feel like it might just be an issue with Dependabot itself...

[abdulapopoola]

Thanks @alexbchr for the confirmation; yes, please file an issue with the details of the error so we can triage it.

[abdulapopoola]

We still have a few more features to add to enable full Yarn4 support.