Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

Recently, Node.js changed the way node modules are installed to allow for better parallel functionality and easier unbundling of certain parts of Node.js.

Previously, Node.js was using a symlink, %{_libdir}/node_modules, which pointed to a versioned path, e.g., %{_libdir}/node_modules_22.

This has changed to using a global %{_libdir}/node_modules static shared folder for generic modules and %{_libdir}/node_modules_XX for version-specific modules.

This change is better described in the Fedora change proposal wiki: https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath.

This also needed to be reflected in nodejs-packaging macros, which forces a rebuild of dependent packages.

.gitignore

@@ -15,3 +15,7 @@
 /yarnpkg-v1.22.22-bundled-20250624.tar.gz
 /yarnpkg-v1.22.22-bundled-20250728.tar.gz
 /yarnpkg-v1.22.22-bundled-20250930.tar.gz
+/yarnpkg-v1.22.22-bundled-20251203.tar.gz
+/yarnpkg-v1.22.22-bundled-20260126.tar.gz
+/yarnpkg-v1.22.22-bundled-20260308.tar.gz
+/yarnpkg-v1.22.22-bundled-20260402.tar.gz

0001-yarn-no-eslint.prebundle.patch

@@ -1,4 +1,4 @@
-diff -rupN --no-dereference yarn-1.22.22/.eslintignore yarn-1.22.22-new/.eslintignore
+diff -rupN yarn-1.22.22/.eslintignore yarn-1.22.22-new/.eslintignore
 --- yarn-1.22.22/.eslintignore	2024-03-09 22:33:28.000000000 +0100
 +++ yarn-1.22.22-new/.eslintignore	1970-01-01 01:00:00.000000000 +0100
 @@ -1,12 +0,0 @@
@@ -14,7 +14,7 @@ diff -rupN --no-dereference yarn-1.22.22/.eslintignore yarn-1.22.22-new/.eslinti
 -artifacts
 -dist
 -packages
-diff -rupN --no-dereference yarn-1.22.22/.eslintrc.json yarn-1.22.22-new/.eslintrc.json
+diff -rupN yarn-1.22.22/.eslintrc.json yarn-1.22.22-new/.eslintrc.json
 --- yarn-1.22.22/.eslintrc.json	2024-03-09 22:33:28.000000000 +0100
 +++ yarn-1.22.22-new/.eslintrc.json	1970-01-01 01:00:00.000000000 +0100
 @@ -1,56 +0,0 @@
@@ -74,9 +74,9 @@ diff -rupN --no-dereference yarn-1.22.22/.eslintrc.json yarn-1.22.22-new/.eslint
 -    }
 -  ]
 -}
-diff -rupN --no-dereference yarn-1.22.22/package.json yarn-1.22.22-new/package.json
---- yarn-1.22.22/package.json	2025-09-30 14:26:03.997138837 +0200
-+++ yarn-1.22.22-new/package.json	2025-09-30 14:26:04.000964590 +0200
+diff -rupN yarn-1.22.22/package.json yarn-1.22.22-new/package.json
+--- yarn-1.22.22/package.json	2024-03-09 22:33:28.000000000 +0100
++++ yarn-1.22.22-new/package.json	2026-01-29 19:42:33.944311623 +0100
 @@ -58,7 +58,6 @@
    },
    "devDependencies": {
@@ -85,9 +85,9 @@ diff -rupN --no-dereference yarn-1.22.22/package.json yarn-1.22.22-new/package.j
      "babel-loader": "^6.2.5",
      "babel-plugin-array-includes": "^2.0.3",
      "babel-plugin-inline-import": "^3.0.0",
-@@ -70,18 +69,6 @@
-     "babel-preset-stage-0": "^6.0.0",
+@@ -71,18 +70,6 @@
      "babylon": "^6.5.0",
+     "commitizen": "^2.9.6",
      "cz-conventional-changelog": "^2.0.0",
 -    "eslint": "^4.3.0",
 -    "eslint-config-fb-strict": "^22.0.0",
@@ -104,7 +104,7 @@ diff -rupN --no-dereference yarn-1.22.22/package.json yarn-1.22.22-new/package.j
      "execa": "^0.11.0",
      "fancy-log": "^1.3.2",
      "flow-bin": "^0.66.0",
-@@ -122,9 +109,7 @@
+@@ -123,9 +110,7 @@
      "build-win-installer": "scripts\\build-windows-installer.bat",
      "changelog": "git-release-notes $(git describe --tags --abbrev=0 $(git describe --tags --abbrev=0)^)..$(git describe --tags --abbrev=0) scripts/changelog.md",
      "dupe-check": "yarn jsinspect ./src",

0002-yarn-no-commitizen.prebundle.patch

@@ -1,15 +1,15 @@
-diff -rupN --no-dereference yarn-1.22.22/package.json yarn-1.22.22-new/package.json
---- yarn-1.22.22/package.json	2025-09-30 14:26:03.561888356 +0200
-+++ yarn-1.22.22-new/package.json	2025-09-30 14:26:03.566194507 +0200
-@@ -69,7 +69,6 @@
+diff -rupN yarn-1.22.22/package.json yarn-1.22.22-new/package.json
+--- yarn-1.22.22/package.json	2026-01-29 19:43:12.400879552 +0100
++++ yarn-1.22.22-new/package.json	2026-01-29 19:43:21.918142076 +0100
+@@ -68,7 +68,6 @@
      "babel-preset-flow": "^6.23.0",
      "babel-preset-stage-0": "^6.0.0",
      "babylon": "^6.5.0",
 -    "commitizen": "^2.9.6",
      "cz-conventional-changelog": "^2.0.0",
-     "eslint": "^4.3.0",
-     "eslint-config-fb-strict": "^22.0.0",
-@@ -131,8 +130,7 @@
+     "execa": "^0.11.0",
+     "fancy-log": "^1.3.2",
+@@ -116,8 +115,7 @@
      "test-only": "node --max_old_space_size=4096 node_modules/jest/bin/jest.js --verbose",
      "test-only-debug": "node --inspect-brk --max_old_space_size=4096 node_modules/jest/bin/jest.js --runInBand --verbose",
      "test-coverage": "node --max_old_space_size=4096 node_modules/jest/bin/jest.js --coverage --verbose",
@@ -19,7 +19,7 @@ diff -rupN --no-dereference yarn-1.22.22/package.json yarn-1.22.22-new/package.j
    },
    "jest": {
      "collectCoverageFrom": [
-@@ -152,8 +150,5 @@
+@@ -137,8 +135,5 @@
      ]
    },
    "config": {

0003-yarn-no-jest.prebundle.patch

@@ -0,0 +1,43 @@
+diff -rupN yarn-1.22.22/package.json yarn-1.22.22-new/package.json
+--- yarn-1.22.22/package.json	2026-01-29 19:43:38.748927341 +0100
++++ yarn-1.22.22-new/package.json	2026-01-29 19:44:35.305149558 +0100
+@@ -79,7 +79,6 @@
+     "gulp-newer": "^1.0.0",
+     "gulp-plumber": "^1.0.1",
+     "gulp-sourcemaps": "^2.2.0",
+-    "jest": "^22.4.4",
+     "jsinspect": "^0.12.6",
+     "minimatch": "^3.0.4",
+     "mock-stdin": "^0.3.0",
+@@ -109,31 +108,9 @@
+     "build-win-installer": "scripts\\build-windows-installer.bat",
+     "changelog": "git-release-notes $(git describe --tags --abbrev=0 $(git describe --tags --abbrev=0)^)..$(git describe --tags --abbrev=0) scripts/changelog.md",
+     "dupe-check": "yarn jsinspect ./src",
+-    "pkg-tests": "yarn --cwd packages/pkg-tests jest yarn.test.js",
+     "release-branch": "./scripts/release-branch.sh",
+-    "test": "yarn lint && yarn test-only",
+-    "test-only": "node --max_old_space_size=4096 node_modules/jest/bin/jest.js --verbose",
+-    "test-only-debug": "node --inspect-brk --max_old_space_size=4096 node_modules/jest/bin/jest.js --runInBand --verbose",
+-    "test-coverage": "node --max_old_space_size=4096 node_modules/jest/bin/jest.js --coverage --verbose",
+     "watch": "gulp watch"
+   },
+-  "jest": {
+-    "collectCoverageFrom": [
+-      "src/**/*.js"
+-    ],
+-    "testEnvironment": "node",
+-    "modulePathIgnorePatterns": [
+-      "__tests__/fixtures/",
+-      "packages/pkg-tests/pkg-tests-fixtures",
+-      "dist/"
+-    ],
+-    "testPathIgnorePatterns": [
+-      "__tests__/(fixtures|__mocks__)/",
+-      "updates/",
+-      "_(temp|mock|install|init|helpers).js$",
+-      "packages/pkg-tests"
+-    ]
+-  },
+   "config": {
+   }
+ }

0004-yarn-js-yaml.prebundle.patch

@@ -0,0 +1,12 @@
+diff -rupN yarn-1.22.22/package.json yarn-1.22.22-new/package.json
+--- yarn-1.22.22/package.json   2024-03-09 22:33:28.000000000 +0100
++++ yarn-1.22.22-new/package.json       2026-01-29 19:53:54.399623053 +0100
+@@ -29,7 +29,7 @@
+     "is-builtin-module": "^2.0.0",
+     "is-ci": "^1.0.10",
+     "is-webpack-bundle": "^1.0.0",
+-    "js-yaml": "^3.13.1",
++    "js-yaml": "^4.1.1",
+     "leven": "^2.0.0",
+     "loud-rejection": "^1.2.0",
+     "micromatch": "^2.3.11",

sources

@@ -1 +1 @@
-SHA512 (yarnpkg-v1.22.22-bundled-20250930.tar.gz) = c6ed6537c82961002eefd2b6051abc18ea29e5ece420ca8c6df0a7ec686e564e32f75dac97092e92e21c95a0d15ee278ad2f06d1cd832223f16cfd439160d502
+SHA512 (yarnpkg-v1.22.22-bundled-20260402.tar.gz) = 190a8d9ecd7b2a82969a9ab33bdef9630efa523199d69f5fca8691fdd8fe8baedb4fb6a27386084039b751e7eda833c3871dc26b78b96b4d570239bd3b880374

yarn-jsyaml4.patch

@@ -0,0 +1,30 @@
+diff -rupN yarn-1.22.22/src/lockfile/parse.js yarn-1.22.22-new/src/lockfile/parse.js
+--- yarn-1.22.22/src/lockfile/parse.js	2024-03-09 22:33:28.000000000 +0100
++++ yarn-1.22.22-new/src/lockfile/parse.js	2026-04-02 10:31:02.536547390 +0200
+@@ -9,7 +9,7 @@ import {LOCKFILE_VERSION} from '../const
+ import {MessageError} from '../errors.js';
+ import map from '../util/map.js';
+ 
+-const {safeLoad, FAILSAFE_SCHEMA} = require('js-yaml');
++const {load, FAILSAFE_SCHEMA} = require('js-yaml');
+ 
+ type Token = {
+   line: number,
+@@ -390,7 +390,7 @@ function parse(str: string, fileLoc: str
+       return parser.parse();
+     } catch (error1) {
+       try {
+-        return safeLoad(str, {
++        return load(str, {
+           schema: FAILSAFE_SCHEMA,
+         });
+       } catch (error2) {
+@@ -398,7 +398,7 @@ function parse(str: string, fileLoc: str
+       }
+     }
+   } else {
+-    const result = safeLoad(str, {
++    const result = load(str, {
+       schema: FAILSAFE_SCHEMA,
+     });
+     if (typeof result === 'object') {

yarn-update-jest.prebundle.patch

@@ -1,12 +0,0 @@
-diff -rupN yarn-1.22.22/package.json yarn-1.22.22-new/package.json
---- yarn-1.22.22/package.json	2024-03-09 22:33:28.000000000 +0100
-+++ yarn-1.22.22-new/package.json	2025-07-28 10:33:09.427716996 +0200
-@@ -93,7 +93,7 @@
-     "gulp-newer": "^1.0.0",
-     "gulp-plumber": "^1.0.1",
-     "gulp-sourcemaps": "^2.2.0",
--    "jest": "^22.4.4",
-+    "jest": "^30.0.5",
-     "jsinspect": "^0.12.6",
-     "minimatch": "^3.0.4",
-     "mock-stdin": "^0.3.0",

yarnpkg.spec

@@ -8,11 +8,11 @@
 # don't require bundled modules
 %global __requires_exclude_from ^(%{nodejs_sitelib}/yarn/lib/.*|%{nodejs_sitelib}/yarn/bin/yarn(|\\.cmd|\\.ps1|pkg.*))$
 
-%global bundledate 20250930
+%global bundledate 20260402
 
 Name:           yarnpkg
 Version:        1.22.22
-Release:        12%{?dist}
+Release:        19%{?dist}
 Summary:        Fast, reliable, and secure dependency management.
 License:        BSD-2-Clause
 URL:            https://github.com/yarnpkg/yarn
@@ -32,12 +32,14 @@ Patch2:         CVE-2024-4067.patch
 Patch3:         CVE-2025-8262.patch
 # https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0
 Patch4:         CVE-2025-8263.patch
+# Adapt for js-yaml 4.x
+Patch5:         yarn-jsyaml4.patch
 
 ExclusiveArch:  %{nodejs_arches}
 
 BuildRequires:  nodejs-packaging
 %if 0%{?fedora}
-BuildRequires:  nodejs-npm
+BuildRequires:  %{_bindir}/npm
 %else
 BuildRequires:  npm
 %endif
@@ -92,6 +94,28 @@ if [[ $(%{buildroot}%{_bindir}/yarn --version) == %{version} ]] ; then echo PASS
 
 
 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.22.22-19
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Thu Apr 02 2026 Sandro Mani <manisandro@gmail.com> - 1.22.22-18
+- Add yarn-jsyaml4.patch
+- Refresh vendor bundle, fixes CVE-2026-4800
+
+* Sat Mar 07 2026 Sandro Mani <manisandro@gmail.com> - 1.22.22-17
+- Refresh vendor bundle
+
+* Tue Jan 27 2026 Sandro Mani <manisandro@gmail.com> - 1.22.22-16
+- Refresh bundle, fixes CVE-2025-13465
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.22.22-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Wed Dec 03 2025 Sandro Mani <manisandro@gmail.com> - 1.22.22-14
+- Bump release
+
+* Wed Dec 03 2025 Sandro Mani <manisandro@gmail.com> - 1.22.22-13
+- Refresh bundle, fixes CVE-2025-64756
+
 * Tue Sep 30 2025 Sandro Mani <manisandro@gmail.com> - 1.22.22-12
 - Regenerate bundle, fixes CVE-2025-59343
 - Patch out eslint and commitizen devDependencies to reduce dependencies