Yarn Berry

ID

yarn-berry

Home page

https://yarnpkg.com

Version requirement

>= 2

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

search · cleanup

purl types

pkg:npm · pkg:yarn-berry

CLI name

yarn

Issues and PRs

📦 manager: npm-based

Source

meta_package_manager/managers/yarn.py

Yarn Berry, the 2.x and later line.

mpm claims this class for any yarn binary reporting a 2.x or newer version.

Warning

Yarn Berry removed the yarn global command family entirely: it has no notion of globally installed packages. Only search is available, while installed, outdated, install, upgrade and remove are all unsupported.

Note

search is simulated with yarn npm info and only resolves exact package names.

What mpm adds to yarn-berry

Through mpm, yarn-berry gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover yarn-berry alongside npm, pnpm, volta, yarn and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Operations

Operation

Supported

Notes

installed

outdated

orphans

search

✓

exact and extended search backfilled by mpm

install

upgrade

upgrade_all

remove

sync

cleanup

✓

doctor

Selecting and configuring yarn-berry

Deselect yarn-berry for a single run with --no-yarn-berry, or persist the choice in your configuration:

[mpm]
yarn-berry = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.yarn-berry]
timeout = 900

mpm config-template yarn-berry prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around yarn-berry, one mpm command each:

  • Snapshot and clone a machine: mpm --yarn-berry dump yarn-berry.toml, then mpm restore yarn-berry.toml on the next one.

  • Export a compliance SBOM: mpm --yarn-berry sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Yarn Berry’s release-age gating, from the cooldown support table:

  • Status: ➖ N/A (Yarn Berry removed global installs, so mpm implements no install / upgrade / remove to gate; the upstream gate, Berry ≥ 4.10, covers project installs)

  • Mechanism: npmMinimalAgeGate

  • Reference: Yarn settings

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: npm registry (pkg:npm)

  • Retraction: Unpublish within 72 h of publishing, then only with no dependents, under 300 weekly downloads and a single owner (policy). Past that, flag only: npm deprecate warns on install but does not stop resolution

  • Publish date: ✅ time, mapping each version to its publication timestamp (packument)

Version probe

The version is extracted from the output of yarn --version with:

r"(?P<version>\S+)"

Changelog

  • 6.3.0 (2026-04-09)

    • Add Yarn Berry (2.x+) manager with search and cleanup support.