dependabot-npm_and_yarn 0.212.0 → 0.213.0

data/helpers/package.json

@@ -10,16 +10,16 @@
   },
   "dependencies": {
     "@dependabot/yarn-lib": "^1.22.19",
-    "@npmcli/arborist": "^5.6.0",
+    "@npmcli/arborist": "^6.0.0",
     "detect-indent": "^6.1.0",
     "nock": "^13.2.9",
     "npm": "6.14.17",
-    "semver": "^7.3.7"
+    "semver": "^7.3.8"
   },
   "devDependencies": {
-    "eslint": "^8.22.0",
+    "eslint": "^8.26.0",
     "eslint-config-prettier": "^8.5.0",
-    "jest": "^28.1.3",
+    "jest": "^29.2.1",
     "prettier": "^2.7.1",
     "rimraf": "^3.0.2"
   }

data/lib/dependabot/npm_and_yarn/file_fetcher.rb

@@ -19,9 +19,8 @@ module Dependabot
       # when it specifies a path. Only include Yarn "link:"'s that start with a
       # path and ignore symlinked package names that have been registered with
       # "yarn link", e.g. "link:react"
-      PATH_DEPENDENCY_STARTS =
-        %w(file: link:. link:/ link:~/ / ./ ../ ~/).freeze
-      PATH_DEPENDENCY_CLEAN_REGEX = /^file:|^link:/.freeze
+      PATH_DEPENDENCY_STARTS = %w(file: link:. link:/ link:~/ / ./ ../ ~/).freeze
+      PATH_DEPENDENCY_CLEAN_REGEX = /^file:|^link:/
 
       def self.required_files_in?(filenames)
         filenames.include?("package.json")
@@ -42,6 +41,7 @@ module Dependabot
         fetched_files << lerna_json if lerna_json
         fetched_files << npmrc if npmrc
         fetched_files << yarnrc if yarnrc
+        fetched_files << yarnrc_yml if yarnrc_yml
         fetched_files += workspace_package_jsons
         fetched_files += lerna_packages
         fetched_files += path_dependencies(fetched_files)
@@ -53,8 +53,8 @@ module Dependabot
       def instrument_package_manager_version
         package_managers = {}
 
-        package_managers["npm"] =  Helpers.npm_version_numeric(package_lock.content) if package_lock
-        package_managers["yarn"] = 1 if yarn_lock
+        package_managers["npm"] = Helpers.npm_version_numeric(package_lock.content) if package_lock
+        package_managers["yarn"] = yarn_version if yarn_version
         package_managers["shrinkwrap"] = 1 if shrinkwrap
 
         Dependabot.instrument(
@@ -64,6 +64,22 @@ module Dependabot
         )
       end
 
+      def yarn_version
+        return @yarn_version if defined?(@yarn_version)
+
+        package = JSON.parse(package_json.content)
+        if Experiments.enabled?(:yarn_berry) && (package_manager = package.fetch("packageManager", nil))
+          get_yarn_version_from_package_json(package_manager)
+        elsif yarn_lock
+          1
+        end
+      end
+
+      def get_yarn_version_from_package_json(package_manager)
+        version_match = package_manager.match(/yarn@(?<version>\d+.\d+.\d+)/)
+        version_match&.named_captures&.fetch("version", nil)
+      end
+
       def package_json
         @package_json ||= fetch_file_from_host("package.json")
       end
@@ -118,6 +134,11 @@ module Dependabot
         @yarnrc
       end
 
+      def yarnrc_yml
+        @yarnrc_yml ||= fetch_file_if_present(".yarnrc.yml")&.
+                       tap { |f| f.support_file = true }
+      end
+
       def lerna_json
         @lerna_json ||= fetch_file_if_present("lerna.json")&.
                         tap { |f| f.support_file = true }
@@ -137,6 +158,8 @@ module Dependabot
 
         path_dependency_details(fetched_files).each do |name, path|
           path = path.gsub(PATH_DEPENDENCY_CLEAN_REGEX, "")
+          raise PathDependenciesNotReachable, "#{name} at #{path}" if path.start_with?("/")
+
           filename = path
           # NPM/Yarn support loading path dependencies from tarballs:
           # https://docs.npmjs.com/cli/pack.html
@@ -212,6 +235,8 @@ module Dependabot
           select { |_, v| v.is_a?(String) && v.start_with?(*path_starts) }.
           map do |name, path|
             path = path.gsub(PATH_DEPENDENCY_CLEAN_REGEX, "")
+            raise PathDependenciesNotReachable, "#{name} at #{path}" if path.start_with?("/")
+
             path = File.join(current_dir, path) unless current_dir.nil?
             [name, Pathname.new(path).cleanpath.to_path]
           end

data/lib/dependabot/npm_and_yarn/file_parser/lockfile_parser.rb

@@ -12,12 +12,17 @@ module Dependabot
           @dependency_files = dependency_files
         end
 
-        def parse
+        def parse_set
           dependency_set = Dependabot::NpmAndYarn::FileParser::DependencySet.new
           dependency_set += yarn_lock_dependencies if yarn_locks.any?
           dependency_set += package_lock_dependencies if package_locks.any?
           dependency_set += shrinkwrap_dependencies if shrinkwraps.any?
-          dependency_set.dependencies
+
+          dependency_set
+        end
+
+        def parse
+          Helpers.dependencies_with_all_versions_metadata(parse_set)
         end
 
         def lockfile_details(dependency_name:, requirement:, manifest_name:)
@@ -77,7 +82,7 @@ module Dependabot
             details_candidates.first.last
           else
             details_candidates.find do |k, _|
-              k.split(/(?<=\w)\@/)[1..-1].join("@") == requirement
+              k.scan(/(?<=\w)\@(?:npm:)?([^\s,]+)/).flatten.include?(requirement)
             end&.last
           end
         end
@@ -96,6 +101,8 @@ module Dependabot
             parse_yarn_lock(yarn_lock).each do |req, details|
               next unless semver_version_for(details["version"])
               next if alias_package?(req)
+              next if Experiments.enabled?(:yarn_berry) && workspace_package?(req)
+              next if Experiments.enabled?(:yarn_berry) && req == "__metadata"
 
               # NOTE: The DependencySet will de-dupe our dependencies, so they
               # end up unique by name. That's not a perfect representation of
@@ -188,7 +195,15 @@ module Dependabot
         end
 
         def alias_package?(requirement)
-          requirement.include?("@npm:")
+          if Experiments.enabled?(:yarn_berry)
+            requirement.match?(/@npm:(.+@(?!npm))/)
+          else
+            requirement.include?("@npm:")
+          end
+        end
+
+        def workspace_package?(requirement)
+          requirement.include?("@workspace:")
         end
 
         def parse_package_lock(package_lock)

data/lib/dependabot/npm_and_yarn/file_parser.rb

@@ -3,9 +3,11 @@
 # See https://docs.npmjs.com/files/package.json for package.json format docs.
 
 require "dependabot/dependency"
+require "dependabot/experiments"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/shared_helpers"
+require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/npm_and_yarn/version"
 require "dependabot/git_metadata_fetcher"
@@ -29,13 +31,14 @@ module Dependabot
           (?:\#(?=[\^~=<>*])(?<semver>.+))|
           (?:\#(?<ref>.+))
         )?$
-      }ix.freeze
+      }ix
 
       def parse
         dependency_set = DependencySet.new
         dependency_set += manifest_dependencies
         dependency_set += lockfile_dependencies
-        dependencies = dependency_set.dependencies
+
+        dependencies = Helpers.dependencies_with_all_versions_metadata(dependency_set)
 
         # TODO: Currently, Dependabot can't handle dependencies that have both
         # a git source *and* a non-git source. Fix that!
@@ -84,7 +87,7 @@ module Dependabot
       end
 
       def lockfile_dependencies
-        DependencySet.new(lockfile_parser.parse)
+        lockfile_parser.parse_set
       end
 
       def build_dependency(file:, type:, name:, requirement:)
@@ -94,6 +97,7 @@ module Dependabot
           manifest_name: file.name
         )
         version = version_for(name, requirement, file.name)
+
         return if lockfile_details && !version
         return if ignore_requirement?(requirement)
         return if workspace_package_names.include?(name)
@@ -239,11 +243,18 @@ module Dependabot
       def source_for(name, requirement, manifest_name)
         return git_source_for(requirement) if git_url?(requirement)
 
-        resolved_url = lockfile_parser.lockfile_details(
+        lockfile_details = lockfile_parser.lockfile_details(
           dependency_name: name,
           requirement: requirement,
           manifest_name: manifest_name
-        )&.fetch("resolved", nil)
+        )
+        resolved_url = lockfile_details&.fetch("resolved", nil)
+
+        if Experiments.enabled?(:yarn_berry) && resolved_url.nil?
+          resolution = lockfile_details&.fetch("resolution", nil)
+          package_match = resolution&.match(/__archiveUrl=(?<package_url>.+)/)
+          resolved_url = CGI.unescape(package_match.named_captures.fetch("package_url", "")) if package_match
+        end
 
         return unless resolved_url
         return unless resolved_url.start_with?("http")
@@ -326,6 +337,7 @@ module Dependabot
               dependency_files.
               select { |f| f.name.end_with?("package.json") }.
               reject { |f| f.name == "package.json" }.
+              reject { |f| f.name.include?("node_modules/") if Experiments.enabled?(:yarn_berry) }.
               reject(&:support_file?)
 
             [

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -34,21 +34,21 @@ module Dependabot
 
         attr_reader :lockfile, :dependencies, :dependency_files, :credentials
 
-        UNREACHABLE_GIT = /fatal: repository '(?<url>.*)' not found/.freeze
-        FORBIDDEN_GIT = /fatal: Authentication failed for '(?<url>.*)'/.freeze
-        FORBIDDEN_PACKAGE = %r{(?<package_req>[^/]+) - (Forbidden|Unauthorized)}.freeze
+        UNREACHABLE_GIT = /fatal: repository '(?<url>.*)' not found/
+        FORBIDDEN_GIT = /fatal: Authentication failed for '(?<url>.*)'/
+        FORBIDDEN_PACKAGE = %r{(?<package_req>[^/]+) - (Forbidden|Unauthorized)}
         FORBIDDEN_PACKAGE_403 = %r{^403\sForbidden\s
-          -\sGET\shttps?://(?<source>[^/]+)/(?<package_req>[^/\s]+)}x.freeze
-        MISSING_PACKAGE = %r{(?<package_req>[^/]+) - Not found}.freeze
-        INVALID_PACKAGE = /Can't install (?<package_req>.*): Missing/.freeze
+          -\sGET\shttps?://(?<source>[^/]+)/(?<package_req>[^/\s]+)}x
+        MISSING_PACKAGE = %r{(?<package_req>[^/]+) - Not found}
+        INVALID_PACKAGE = /Can't install (?<package_req>.*): Missing/
 
         # TODO: look into fixing this in npm, seems like a bug in the git
         # downloader introduced in npm 7
         #
         # NOTE: error message returned from arborist/npm 8 when trying to
         # fetching a invalid/non-existent git ref
-        NPM8_MISSING_GIT_REF = /already exists and is not an empty directory/.freeze
-        NPM6_MISSING_GIT_REF = /did not match any file\(s\) known to git/.freeze
+        NPM8_MISSING_GIT_REF = /already exists and is not an empty directory/
+        NPM6_MISSING_GIT_REF = /did not match any file\(s\) known to git/
 
         def updated_lockfile_content
           return lockfile.content if npmrc_disables_lockfile?
@@ -112,7 +112,7 @@ module Dependabot
         end
 
         def run_current_npm_update
-          run_npm_updater(top_level_dependencies: top_level_dependencies)
+          run_npm_updater(top_level_dependencies: top_level_dependencies, sub_dependencies: sub_dependencies)
         end
 
         def run_previous_npm_update
@@ -127,16 +127,31 @@ module Dependabot
             )
           end
 
-          run_npm_updater(top_level_dependencies: previous_top_level_dependencies)
+          previous_sub_dependencies = sub_dependencies.map do |d|
+            Dependabot::Dependency.new(
+              name: d.name,
+              package_manager: d.package_manager,
+              version: d.previous_version,
+              previous_version: d.previous_version,
+              requirements: [],
+              previous_requirements: []
+            )
+          end
+
+          run_npm_updater(top_level_dependencies: previous_top_level_dependencies,
+                          sub_dependencies: previous_sub_dependencies)
         end
 
-        def run_npm_updater(top_level_dependencies:)
+        def run_npm_updater(top_level_dependencies:, sub_dependencies:)
           SharedHelpers.with_git_configured(credentials: credentials) do
+            updated_files = {}
             if top_level_dependencies.any?
-              run_npm_top_level_updater(top_level_dependencies: top_level_dependencies)
-            else
-              run_npm_subdependency_updater
+              updated_files.merge!(run_npm_top_level_updater(top_level_dependencies: top_level_dependencies))
+            end
+            if sub_dependencies.any?
+              updated_files.merge!(run_npm_subdependency_updater(sub_dependencies: sub_dependencies))
             end
+            updated_files
           end
         end
 
@@ -194,9 +209,9 @@ module Dependabot
           { lockfile_basename => File.read(lockfile_basename) }
         end
 
-        def run_npm_subdependency_updater
+        def run_npm_subdependency_updater(sub_dependencies:)
           if npm8?
-            run_npm8_subdependency_updater
+            run_npm8_subdependency_updater(sub_dependencies: sub_dependencies)
           else
             SharedHelpers.run_helper_subprocess(
               command: NativeHelpers.helper_path,
@@ -206,7 +221,7 @@ module Dependabot
           end
         end
 
-        def run_npm8_subdependency_updater
+        def run_npm8_subdependency_updater(sub_dependencies:)
           dependency_names = sub_dependencies.map(&:name)
           SharedHelpers.run_shell_command(NativeHelpers.npm8_subdependency_update_command(dependency_names))
           { lockfile_basename => File.read(lockfile_basename) }
@@ -414,10 +429,9 @@ module Dependabot
           reg = NpmAndYarn::UpdateChecker::RegistryFinder.new(
             dependency: missing_dep,
             credentials: credentials,
-            npmrc_file: dependency_files.
-                        find { |f| f.name.end_with?(".npmrc") },
-            yarnrc_file: dependency_files.
-                         find { |f| f.name.end_with?(".yarnrc") }
+            npmrc_file: dependency_files. find { |f| f.name.end_with?(".npmrc") },
+            yarnrc_file: dependency_files. find { |f| f.name.end_with?(".yarnrc") },
+            yarnrc_yml_file: dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
           ).registry
 
           return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")

data/lib/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb

@@ -13,7 +13,7 @@ module Dependabot
           registry.yarnpkg.com
         ).freeze
 
-        SCOPED_REGISTRY = /^\s*@(?<scope>\S+):registry\s*=\s*(?<registry>\S+)/.freeze
+        SCOPED_REGISTRY = /^\s*@(?<scope>\S+):registry\s*=\s*(?<registry>\S+)/
 
         def initialize(dependency_files:, credentials:)
           @dependency_files = dependency_files
@@ -42,7 +42,9 @@ module Dependabot
           return unless yarn_lock || package_lock
           return unless global_registry
 
-          "registry = https://#{global_registry['registry']}\n" \
+          registry = global_registry["registry"]
+          registry = "https://#{registry}" unless registry.start_with?("http")
+          "registry = #{registry}\n" \
             "#{global_registry_auth_line}" \
             "always-auth = true"
         end
@@ -113,8 +115,10 @@ module Dependabot
           return initial_content unless yarn_lock || package_lock
           return initial_content unless global_registry
 
+          registry = global_registry["registry"]
+          registry = "https://#{registry}" unless registry.start_with?("http")
           initial_content +
-            "registry = https://#{global_registry['registry']}\n" \
+            "registry = #{registry}\n" \
             "#{global_registry_auth_line}" \
             "always-auth = true\n"
         end

data/lib/dependabot/npm_and_yarn/file_updater/package_json_updater.rb

@@ -183,8 +183,8 @@ module Dependabot
           end
 
           original_line.gsub(
-            %(\##{old_req.dig(:source, :ref)}"),
-            %(\##{new_req.dig(:source, :ref)}")
+            %(##{old_req.dig(:source, :ref)}"),
+            %(##{new_req.dig(:source, :ref)}")
           )
         end
 

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -4,10 +4,12 @@ require "uri"
 
 require "dependabot/npm_and_yarn/file_updater"
 require "dependabot/npm_and_yarn/file_parser"
+require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/update_checker/registry_finder"
 require "dependabot/npm_and_yarn/native_helpers"
 require "dependabot/shared_helpers"
 require "dependabot/errors"
+require "dependabot/experiments"
 
 # rubocop:disable Metrics/ClassLength
 module Dependabot
@@ -17,9 +19,10 @@ module Dependabot
         require_relative "npmrc_builder"
         require_relative "package_json_updater"
 
-        def initialize(dependencies:, dependency_files:, credentials:)
+        def initialize(dependencies:, dependency_files:, repo_contents_path:, credentials:)
           @dependencies = dependencies
           @dependency_files = dependency_files
+          @repo_contents_path = repo_contents_path
           @credentials = credentials
         end
 
@@ -35,12 +38,11 @@ module Dependabot
 
         private
 
-        attr_reader :dependencies, :dependency_files, :credentials
+        attr_reader :dependencies, :dependency_files, :repo_contents_path, :credentials
 
-        UNREACHABLE_GIT = /ls-remote --tags --heads (?<url>.*)/.freeze
-        TIMEOUT_FETCHING_PACKAGE =
-          %r{(?<url>.+)/(?<package>[^/]+): ETIMEDOUT}.freeze
-        INVALID_PACKAGE = /Can't add "(?<package_req>.*)": invalid/.freeze
+        UNREACHABLE_GIT = /ls-remote --tags --heads (?<url>.*)/
+        TIMEOUT_FETCHING_PACKAGE = %r{(?<url>.+)/(?<package>[^/]+): ETIMEDOUT}
+        INVALID_PACKAGE = /Can't add "(?<package_req>.*)": invalid/
 
         def top_level_dependencies
           dependencies.select(&:top_level?)
@@ -51,13 +53,14 @@ module Dependabot
         end
 
         def updated_yarn_lock(yarn_lock)
-          SharedHelpers.in_a_temporary_directory do
+          base_dir = dependency_files.first.directory
+          SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
             write_temporary_dependency_files
             lockfile_name = Pathname.new(yarn_lock.name).basename.to_s
             path = Pathname.new(yarn_lock.name).dirname.to_s
             updated_files = run_current_yarn_update(
               path: path,
-              lockfile_name: lockfile_name
+              yarn_lock: yarn_lock
             )
             updated_files.fetch(lockfile_name)
           end
@@ -65,7 +68,7 @@ module Dependabot
           handle_yarn_lock_updater_error(e, yarn_lock)
         end
 
-        def run_current_yarn_update(path:, lockfile_name:)
+        def run_current_yarn_update(path:, yarn_lock:)
           top_level_dependency_updates = top_level_dependencies.map do |d|
             {
               name: d.name,
@@ -76,12 +79,12 @@ module Dependabot
 
           run_yarn_updater(
             path: path,
-            lockfile_name: lockfile_name,
+            yarn_lock: yarn_lock,
             top_level_dependency_updates: top_level_dependency_updates
           )
         end
 
-        def run_previous_yarn_update(path:, lockfile_name:)
+        def run_previous_yarn_update(path:, yarn_lock:)
           previous_top_level_dependencies = top_level_dependencies.map do |d|
             {
               name: d.name,
@@ -94,22 +97,29 @@ module Dependabot
 
           run_yarn_updater(
             path: path,
-            lockfile_name: lockfile_name,
+            yarn_lock: yarn_lock,
             top_level_dependency_updates: previous_top_level_dependencies
           )
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
-        def run_yarn_updater(path:, lockfile_name:,
-                             top_level_dependency_updates:)
+        def run_yarn_updater(path:, yarn_lock:, top_level_dependency_updates:)
           SharedHelpers.with_git_configured(credentials: credentials) do
             Dir.chdir(path) do
               if top_level_dependency_updates.any?
-                run_yarn_top_level_updater(
-                  top_level_dependency_updates: top_level_dependency_updates
-                )
+                if yarn_berry?(yarn_lock)
+                  run_yarn_berry_top_level_updater(top_level_dependency_updates: top_level_dependency_updates,
+                                                   yarn_lock: yarn_lock)
+                else
+
+                  run_yarn_top_level_updater(
+                    top_level_dependency_updates: top_level_dependency_updates
+                  )
+                end
+              elsif yarn_berry?(yarn_lock)
+                run_yarn_berry_subdependency_updater(yarn_lock: yarn_lock)
               else
-                run_yarn_subdependency_updater(lockfile_name: lockfile_name)
+                run_yarn_subdependency_updater(yarn_lock: yarn_lock)
               end
             end
           end
@@ -133,6 +143,50 @@ module Dependabot
 
         # rubocop:enable Metrics/PerceivedComplexity
 
+        def yarn_berry?(yarn_lock)
+          return false unless Experiments.enabled?(:yarn_berry)
+
+          yaml = YAML.safe_load(yarn_lock.content)
+          yaml.key?("__metadata")
+        rescue StandardError
+          false
+        end
+
+        def run_yarn_berry_top_level_updater(top_level_dependency_updates:, yarn_lock:)
+          # If the requirements have changed, it means we've updated the
+          # package.json file(s), and we can just run yarn install to get the
+          # lockfile in the right state. Otherwise we'll need to manually update
+          # the lockfile.
+
+          command = if top_level_dependency_updates.all? { |dep| requirements_changed?(dep[:name]) }
+                      "yarn install"
+                    else
+                      updates = top_level_dependency_updates.collect do |dep|
+                        dep[:requirements].map { |req| "#{dep[:name]}@#{req[:requirement]}" }.join(" ")
+                      end
+                      "yarn up #{updates.join(' ')}"
+                    end
+          Helpers.run_yarn_commands(command)
+          { yarn_lock.name => File.read(yarn_lock.name) }
+        end
+
+        def requirements_changed?(dependency_name)
+          dep = top_level_dependencies.first { |d| d.name == dependency_name }
+          dep.requirements != dep.previous_requirements
+        end
+
+        def run_yarn_berry_subdependency_updater(yarn_lock:)
+          dep = sub_dependencies.first
+          update = "#{dep.name}@#{dep.version}"
+
+          Helpers.run_yarn_commands(
+            "yarn add #{update}",
+            "yarn dedupe #{dep.name}",
+            "yarn remove #{dep.name}"
+          )
+          { yarn_lock.name => File.read(yarn_lock.name) }
+        end
+
         def run_yarn_top_level_updater(top_level_dependency_updates:)
           SharedHelpers.run_helper_subprocess(
             command: NativeHelpers.helper_path,
@@ -144,7 +198,8 @@ module Dependabot
           )
         end
 
-        def run_yarn_subdependency_updater(lockfile_name:)
+        def run_yarn_subdependency_updater(yarn_lock:)
+          lockfile_name = Pathname.new(yarn_lock.name).basename.to_s
           SharedHelpers.run_helper_subprocess(
             command: NativeHelpers.helper_path,
             function: "yarn:updateSubdependency",
@@ -259,12 +314,11 @@ module Dependabot
 
           @resolvable_before_update[yarn_lock.name] =
             begin
-              SharedHelpers.in_a_temporary_directory do
+              base_dir = dependency_files.first.directory
+              SharedHelpers.in_a_temporary_repo_directory(base_dir, repo_contents_path) do
                 write_temporary_dependency_files(update_package_json: false)
-                lockfile_name = Pathname.new(yarn_lock.name).basename.to_s
                 path = Pathname.new(yarn_lock.name).dirname.to_s
-                run_previous_yarn_update(path: path,
-                                         lockfile_name: lockfile_name)
+                run_previous_yarn_update(path: path, yarn_lock: yarn_lock)
               end
 
               true
@@ -420,7 +474,8 @@ module Dependabot
             dependency: missing_dep,
             credentials: credentials,
             npmrc_file: npmrc_file,
-            yarnrc_file: yarnrc_file
+            yarnrc_file: yarnrc_file,
+            yarnrc_yml_file: yarnrc_yml_file
           ).registry
 
           return if UpdateChecker::RegistryFinder.central_registry?(reg) && !package_name.start_with?("@")
@@ -524,6 +579,10 @@ module Dependabot
         def npmrc_file
           dependency_files.find { |f| f.name == ".npmrc" }
         end
+
+        def yarnrc_yml_file
+          dependency_files.find { |f| f.name.end_with?(".yarnrc.yml") }
+        end
       end
     end
   end