From Yarn

Yarn Classic (v1)

Yarn 1 installs a plain node_modules, which 3va runs as-is:

yarn install
3va run server.js --allow-read=./node_modules --allow-net=127.0.0.1

Tested with Express 4 and lodash: same result as npm.

3va migrate converts yarn.lock v1 with every version, URL and integrity hash:

$ 3va migrate --dry-run
Would migrate yarn.lock → 3va-lock.json (68 package(s))

After 3va migrate, 3va install keeps the locked versions (express stayed at 4.18.2 under a ^4.18.0 range in our test), and 3va ci installs them exactly.

Yarn Berry (v2+)

• Plug’n’Play doesn’t work. By default, Berry writes .pnp.cjs and no node_modules. 3va resolves modules from node_modules only. Switch the linker before migrating:

  .yarnrc.yml

  nodeLinker: node-modules

  Then run yarn install again.

• Berry’s yarn.lock can’t be converted, and 3va says so:

  ! yarn.lock is a Yarn Berry (v2+) lockfile: it records resolutions, not a flat
  node_modules tree, so it cannot be converted. Either set `nodeLinker: node-modules`
  in .yarnrc.yml and run `yarn install`, or let `3va install` resolve the manifest
  and write its own 3va-lock.json.

  Letting 3va install resolve from package.json gives you the newest versions your ranges allow, which may differ from what Yarn had locked. Run your tests after the switch.

Things to keep in mind

• 3va <script> runs scripts through Yarn when a yarn.lock is present ([3va] Running scripts.build via yarn...). It runs outside the sandbox and asks before running.
• resolutions are honoured by 3va install, and so are npm’s overrides. "resolutions": { "is-number": "7.0.0" } forced is-odd’s transitive dependency to 7.0.0 in our test.
• For workspaces, see Monorepos.