Bump yarn to 4.5.3

[jeffwidman]

What are you trying to accomplish?

I'm debugging in this area, and want to make sure I'm working off the latest upstream changes.

[yeikel]

Closes #8265

[jeffwidman]

This is the failing test:

dependabot-core/npm_and_yarn/spec/dependabot/npm_and_yarn/update_checker/version_resolver_spec.rb

Lines 855 to 875 in 8f037cf

	context "with a yarn berry lockfile" do
	context "when updating a dependency with a peer requirement" do
	let(:project_name) { "yarn_berry/peer_dependency" }
	let(:latest_allowable_version) { Gem::Version.new("16.3.1") }
	let(:dependency) do
	Dependabot::Dependency.new(
	name: "react-dom",
	version: "15.2.0",
	package_manager: "npm_and_yarn",
	requirements: [{
	file: "package.json",
	requirement: "^15.2.0",
	groups: ["dependencies"],
	source: { type: "registry", url: "https://registry.npmjs.org" }
	}]
	)
	end
	it { is_expected.to eq(Gem::Version.new("15.2.0")) }
	end
	end

Full commit including lockfiles: 1dcda58

Interestingly, it doesn't fail in Yarn 4.3.1 as seen in:

• build(deps): bump Yarn to 4.3.1 #8265

Poking through the changelog between 4.3.1 and 4.5.3, this seems to be relevant upstream PR:

• fix(nm): optimize hoisting by treating peer deps same as other deps yarnpkg/berry#6517

My understanding of peer dependency handling in Yarn is hazy at best, but after reading the PR description, it looks like the algorithm changed and now the peer dependency can be updated and not necessarily held back.

That would explain this test failure:

  1) Dependabot::NpmAndYarn::UpdateChecker::VersionResolver#latest_resolvable_version with a yarn berry lockfile when updating a dependency with a peer requirement is expected to eq #<Gem::Version "15.2.0">
     Failure/Error: it { is_expected.to eq(Gem::Version.new("15.2.0")) }

       expected: #<Gem::Version "15.2.0">
            got: #<Gem::Version "16.3.1">

       (compared using ==)

       Diff:
       @@ -1 +1 @@
       -Gem::Version.new("15.2.0")
       +Gem::Version.new("16.3.1")
     # ./spec/dependabot/npm_and_yarn/update_checker/version_resolver_spec.rb:873:in `block (5 levels) in <top (required)>'
     # /home/dependabot/common/spec/spec_helper.rb:66:in `block (2 levels) in <top (required)>'
     # /home/dependabot/dependabot-updater/vendor/ruby/3.3.0/gems/webmock-3.24.0/lib/webmock/rspec.rb:39:in `block (2 levels) in <top (required)>'

[jeffwidman]

@yeikel does ☝️ sound reasonable to you? I am not very familiar with Yarn Berry or peer dependencies in the yarn ecosystem...

[yeikel]

@yeikel does ☝️ sound reasonable to you? I am not very familiar with Yarn Berry or peer dependencies in the yarn ecosystem...

Yes it does. Your analysis seems correct to me.