Yarn Classic

Note

Yarn Classic (1.x) is frozen, taking only security fixes; the actively developed Yarn Berry line has a different CLI and is wrapped separately as the yarn-berry manager.

ID

yarn

Links

Home page · Documentation · Repository · Wikipedia

Upstream stars

⭐ 41,476

Last commit

2026-02-12

Version requirement

>= 1.20, < 2

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup

purl types

pkg:npm/ · pkg:yarn/

CLI name

yarn

Every call

yarn --silent <command>

Issues and PRs

📦 manager: npm-based

Source

yarn.py

Yarn Classic, the 1.x line.

mpm claims this class for any yarn binary reporting a 1.x version and drives it through the yarn global command family, so installs, upgrades and removals target the global prefix. Its --json output is a stream of one JSON object per line, not a single document, so every query is parsed line by line.

Note

Yarn has no dedicated search command by maintainer decision, so search is simulated with yarn info and only resolves exact package names.

What mpm adds to yarn

Through mpm, yarn gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover yarn alongside bun, npm, pnpm, volta, yarn-berry and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your yarn commands, in mpm

You already know yarn: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With yarn	With mpm
List what’s installed	yarn global --json list --depth 0	mpm --yarn installed
List outdated packages	yarn --json outdated --cwd ~/.config/yarn/global	mpm --yarn outdated
Search for a package	yarn --json --verbose info @bouzuya/borage	mpm --yarn search @bouzuya/borage
Install a package	yarn global add awesome-lint	mpm install pkg:yarn/awesome-lint
Upgrade one package	yarn global upgrade markdown --latest	mpm --yarn upgrade markdown
Upgrade everything	yarn global upgrade --latest	mpm --yarn upgrade --all
Remove a package	yarn global remove awesome-lint	mpm remove pkg:yarn/awesome-lint
Clear caches	yarn cache clean --all	mpm --yarn cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✅
outdated	✅
orphans
search	✅	Exact and extended search backfilled by mpm.
install	✅
upgrade	✅
upgrade_all	✅
remove	✅
sync
cleanup	✅
doctor

Configuration

• Ignore yarn on the mpm CLI by passing the --no-yarn option.

• Ignore it for every run in your configuration:

  [mpm]
  yarn = false
  

• Raise the timeout of all yarn calls:

  [mpm.overrides.yarn]
  timeout = 900
  

• Run mpm config-template yarn to print all overridable settings for your configuration file:

  [mpm.overrides.yarn]
  cli_names = [
      "yarn",
  ]
  cli_search_path = []
  dry_run = false
  ignore_auto_updates = true
  plan = false
  post_args = []
  pre_args = [
      "--silent",
  ]
  pre_cmds = []
  requirement = ">=1.20.0,<2.0.0"
  stop_on_error = false
  unmaintained = false
  version_cli_options = [
      "--version",
  ]
  version_regexes = [
      "(?P<version>\\S+)",
  ]
  

The arguments and environment variables listed in the box atop this page are forced on every yarn call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes

A few jobs you would otherwise script around yarn, one mpm command each:

• Snapshot and clone a machine: mpm --yarn dump yarn.toml, then mpm restore yarn.toml on the next one.

• Export a compliance SBOM: mpm --yarn sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown

State of Yarn Classic’s release-age gating, from the cooldown support table:

• Status: ❌ None (project in maintenance mode)

• Reference: yarnpkg/yarn

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: npm registry (pkg:npm)

• Retraction: Unpublish within 72 h of publishing, then only with no dependents, under 300 weekly downloads and a single owner (policy). Past that, flag only: npm deprecate warns on install but does not stop resolution

• Publish date: ✅ time, mapping each version to its publication timestamp (packument)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Yarn Classic well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ yarn --silent global --json list --depth 0
{"type":"activityStart","data":{"id":0}}
{"type":"activityTick","data":{"id":0,"name":"awesome-lint@^0.18.0"}}
{"type":"activityTick","data":{"id":0,"name":"arrify@^2.0.1"}}
{"type":"activityTick","data":{"id":0,"name":"case@^1.6.3"}}
{"type":"activityTick","data":{"id":0,"name":"emoji-regex@^9.2.0"}}
{"type":"activityEnd","data":{"id":0}}
{"type":"progressStart","data":{"id":0,"total":327}}
{"type":"progressTick","data":{"id":0,"current":1}}
{"type":"progressTick","data":{"id":0,"current":2}}
{"type":"progressTick","data":{"id":0,"current":3}}
{"type":"progressTick","data":{"id":0,"current":4}}
{"type":"progressTick","data":{"id":0,"current":5}}
{"type":"progressFinish","data":{"id":0}}
{"type":"info","data":""[email protected]" has binaries:"}
{"type":"list","data":{"type":"bins-awesome-lint","items":["awesome-lint"]}}

$ yarn --silent --json outdated --cwd ~/.config/yarn/global
{"type":"warning","data":"package.json: No license field"}
{"type":"table","data":{"head":["Package","Current","Wanted","Latest","Package Type","URL"],"body":[["markdown","0.4.0","0.4.0","0.5.0","dependencies","git://github.com/evilstreak/markdown-js.git"]]}}

Version check

The version is extracted from the output of yarn --version with:

r"(?P<version>\S+)"

Upstream project

Metrics	yarnpkg/yarn
Activity
Popularity
Metadata

Changelog

• 8.0.0 (2026-09-20)

  • Warn and report no package, instead of crashing, when a JSON listing cannot be parsed.

  • Fix search and install reading a failed registry request as a missing package: the failure now prints as a warning naming the registry’s answer.

  • Fix outdated reporting an error instead of the packages whenever an update exists.

  • Correct the commands shown on each manager’s page, which named fewer options than mpm actually runs.

• 6.5.0 (2026-05-25)

  • Fix search to parse NDJSON output line by line, collecting only inspect-type entries, since newer Yarn emits multiple JSON objects with a trailing status line.

• 6.3.0 (2026-04-09)

  • Split into Yarn Classic and Yarn Berry managers. Restrict Classic to <2.0.0. Closes #1548.

• 6.2.0 (2026-03-25)

  • Add --silent option to all yarn invocations to suppress console logs.

• 5.12.0 (2023-02-25)

  • Do not test yarn on Linux and Windows.

• 5.5.1 (2022-07-11)

  • Implements remove operation.

  • Fix, document and cleanup all global commands.

  • Set minimal yarn version to 1.20.0, as it should have been.

• 3.4.0 (2020-08-18)

  • Set minimal requirement to 1.20.0.

  • Fix deprecated global arguments.

• 3.0.0 (2020-03-25)

  • Add support for yarn package manager for Linux, macOS and Windows.

  • Install yarn on all unittest platforms.