Skip to content

chore(docusaurus): migrate from npm to Yarn Classic and lock dependencies#67

Merged
lucaaamaral merged 1 commit into
magma:mainfrom
lucaaamaral:chore/migrate-to-yarn
Jun 15, 2026
Merged

chore(docusaurus): migrate from npm to Yarn Classic and lock dependencies#67
lucaaamaral merged 1 commit into
magma:mainfrom
lucaaamaral:chore/migrate-to-yarn

Conversation

@lucaaamaral

Copy link
Copy Markdown
Collaborator

Migrate the Docusaurus site from npm to Yarn Classic (v1) and lock dependencies.

What

  • Dockerfile: bootstrap yarn@1.22.22 (node 26 ships no yarn/corepack), install via yarn install --frozen-lockfile (skips when a cached node_modules is present), build/serve/start via yarn.
  • yarn.lock: committed for reproducible, integrity-verified installs (sha-512 per package) — what makes --frozen-lockfile meaningful and prevents floating-dependency drift.
  • docker-compose.yml: new lockgen service to regenerate the lockfile in a container (docker compose run --rm lockgen) — no host yarn or leftover node_modules.
  • .gitignore / .dockerignore: stop excluding yarn.lock; keep package-lock.json ignored.
  • package.json: resolutions forcing uuid@11, clearing the uuid@8.3.2 deprecation.

Validation (node:26-slim)

  • dev build: yarn install --frozen-lockfile succeeds, no errors, no deprecation warnings
  • prod build (yarn build): all 3 locales (en/es/pt), 0 errors
  • serve: homepage + docs render real static content (200s), no runtime errors
  • docker compose run --rm lockgen regenerates yarn.lock cleanly (uuid -> 11.1.1)

Follow-ups (separate)

  • onBrokenMarkdownLinks is deprecated for Docusaurus v4 (config migration).
  • audit reports transitive vulns (1 high, 21 moderate) — deeper review is its own effort.

…cies

- Dockerfile: bootstrap yarn@1.22.22 (node 26 ships no yarn/corepack), install via
  'yarn install --frozen-lockfile' (skips when a cached node_modules exists), build/serve/start via yarn
- commit yarn.lock for reproducible, integrity-verified installs
- docker-compose.yml: add a 'lockgen' service to regenerate yarn.lock in a container
  (docker compose run --rm lockgen)
- .gitignore/.dockerignore: stop excluding yarn.lock; keep package-lock.json ignored
- package.json: add resolutions forcing uuid@11 (clears the uuid@8.3.2 deprecation)

Validated on node:26-slim: dev + prod builds (3 locales, 0 errors), serve renders.
@lucaaamaral lucaaamaral merged commit 79c1354 into magma:main Jun 15, 2026
6 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant