Proposal: remove Yarn v1 Classic with Node.js 26

[MikeMcC399]

Situation

• Cypress Docker images currently include the npm module Yarn v1 Classic, with its latest release yarn@1.22.22 from Mar 9, 2024, in each cypress/base, cypress/browser and cypress/included image build.

• The cypress/factory image allows the selection of any Yarn v1 Classic version using YARN_VERSION for customized Cypress image building.

• Yarn v1 Classic has been in maintenance mode since Jan 2020 with no further support.

Background

Yarn was originally released 14 years ago. The yarn@1.0.0 release followed then 8 years ago. With the release of Yarn 2 in Jan 2020, it was announced that Yarn v1 would enter maintenance mode and provide security fixes only. This is underlined by the notice on the source repo https://github.com/yarnpkg/yarn :

The 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry

The last Yarn v1 Classic release was yarn@1.22.22, more than two years ago.

Event	Date
Inital yarn@0.1.0 release	Mar 2012
yarn@1.0.0 release	Sep 2017
Yarn 2 GA	Jan 2020
yarn@1.22.22 release	Mar 2024
PGP signing key expiry	Jan 2030

Yarn v1 Classic CircleCI config attempts to test against Node.js version 4 - 13 only. The pipeline runs and fails nightly in CircleCI. Edit: pipeline fails and no longer runs nightly

Cloning the repo and attempting to run yarn test locally under Ubuntu 24.04.3 LTS produces failures on all Node.js versions from 8 - 25.

The PGP signing key 6A010C5166006599AA17F08146C2130DFD2497F5 expires on 2030-01-22T18:44:02Z.

Assessment

Yarn v1 Classic must be considered as no longer suitable for production usage.

• It is untested in currently supported Node.js versions >=20
• Emerging bugs and open issues are not addressed

Inclusion in production-ready Cypress Docker images suggest an implicit and unwarranted endorsement by Cypress for continued usage.

Recommendation

Remove Yarn v1 Classic from Cypress Docker images.

The first step should be to announce a deprecation. The next opportunity for removing Yarn v1 Classic, without causing a separate breaking change, would be with the planned release of Node.js 26 in April 2026. This version of Node.js is planned to transition to LTS in October 2026 (see schedule.json).

Suggested Timeline

Milestone	External Date	Suggested Date	PR	Factory
Freeze of Yarn v1 Classic and removal of support	2020-01-24
Deprecate usage of Yarn v1 Classic with Cypress Docker images		Apr 2026	#1490	7.4.0
Disallow Yarn v1 Classic in new Cypress Docker images using Node.js >=26		Apr 2026	#1495	8.0.0
Node.js 26.0.0 Current release	2026-04-22
Remove Yarn v1 Classic from cypress/factory		Oct 2026
Node.js 26.x transition to Active LTS status	2026-10-28

[MikeMcC399]

Testing the Yarn v1 Classic repo source https://github.com/yarnpkg/yarn against its own test suite, and auditing for vulnerabilities, shows:

Test Suites: 13 failed, 76 passed, 89 total
Tests:       52 failed, 3 skipped, 1222 passed, 1277 total
Snapshots:   119 passed, 119 total

52 vulnerabilities found - Packages audited: 253
Severity: 7 Low | 13 Moderate | 24 High | 8 Critical

Since the repo has declared itself as frozen, there can be no expectation that test failures or security vulnerabilities will be resolved in Yarn v1 Classic.

Steps to reproduce

Debian 13.1, Node.js 24.11.0 (LTS)
Yarn v1 Classic master branch 7cafa512

npm install yarn@1.22.22 -g
git clone https://github.com/yarnpkg/yarn
cd yarn
yarn
yarn build
yarn test-only
yarn audit --groups dependencies --level critical

Test results

Test Suites: 13 failed, 76 passed, 89 total
Tests:       52 failed, 3 skipped, 1222 passed, 1277 total
Snapshots:   119 passed, 119 total

Test Suite failure rate: 14%
Test failure rate: 4%

Vulnerability results

52 vulnerabilities found - Packages audited: 253
Severity: 7 Low | 13 Moderate | 24 High | 8 Critical

[MikeMcC399]

Closing this issue, as there was no feedback.

• Node.js Docker images are continuing to distribute Yarn v1 Classic
• GitHub Actions runner images: ubuntu-latest, windows-latest & macos-latest all continue to distribute Yarn 1.22.22

[MikeMcC399]

Re-opening, as non-support of Yarn v1 Classic continues to be an issue.

[MikeMcC399]

A comparable suggestion is also under consideration by the Node.js Docker Working Group. I will post here if / when they take any decision. Node.js can be considered as a reference for the Cypress Docker images.