What happened
PR #3199 bumped e2e-test-utils from 2.1.6 to 2.1.8 across 3 workspaces. The package was published at 09:51 UTC on 2026-08-07. run-e2e.sh generates a root package.json, writes a .yarnrc.yml containing only nodeLinker: node-modules, deletes the root yarn.lock, and runs yarn install — a fresh resolution. Yarn 4.17's npmMinimalAgeGate (default 1440 minutes) quarantined the 2.1.8 version, failing the install with YN0016: All versions satisfying "2.1.8" are quarantined. This blocked every workspace's nightly e2e, not just the three bumped ones. The PR was reverted 3.5 hours later. The author noted: "nothing in the repo defends against this."
What could go better
The run-e2e.sh script generates .yarnrc.yml at runtime but does not configure npmMinimalAgeGate. Any workspace dependency bumped to a version published within the last 24 hours will break all nightly e2e tests repo-wide, because the fresh resolution fails on the quarantined package. The committed per-workspace lockfiles do not help — run-e2e.sh deletes the root lockfile and resolves from scratch. This is a latent vulnerability affecting any future dependency bump to a recently-published package. Confidence: high — the root cause is well-understood and explicitly documented in the revert PR.
Proposed change
In run-e2e.sh, when generating the runtime .yarnrc.yml, either: (a) set npmMinimalAgeGate: 0 to disable quarantine for the e2e install (simplest fix, trades supply-chain protection for reliability), or (b) add a pre-install check that detects workspace dependencies published within the last 24h and warns/fails-fast with a clear message instead of an opaque YN0016 error. Option (a) is appropriate because run-e2e.sh already operates in a CI-only context where packages are pinned by workspace lockfiles in the committed tree — the fresh resolution is an artifact of the unified test runner, not a signal of untrusted dependencies. If supply-chain protection is desired, option (b) provides a better failure mode. The relevant code is the section that writes .yarnrc.yml in run-e2e.sh.
Validation criteria
After the fix: (1) A workspace that pins a dependency published within the last 24h should not cause run-e2e.sh to fail at the install step. (2) The nightly e2e run should not be blocked by quarantine when a same-day dependency bump is present. Test by temporarily pinning a recently-published package version and running run-e2e.sh --list (dry run) or the full install step.
Generated by retro agent from #3206
What happened
PR #3199 bumped
e2e-test-utilsfrom 2.1.6 to 2.1.8 across 3 workspaces. The package was published at 09:51 UTC on 2026-08-07.run-e2e.shgenerates a rootpackage.json, writes a.yarnrc.ymlcontaining onlynodeLinker: node-modules, deletes the rootyarn.lock, and runsyarn install— a fresh resolution. Yarn 4.17'snpmMinimalAgeGate(default 1440 minutes) quarantined the 2.1.8 version, failing the install withYN0016: All versions satisfying "2.1.8" are quarantined. This blocked every workspace's nightly e2e, not just the three bumped ones. The PR was reverted 3.5 hours later. The author noted: "nothing in the repo defends against this."What could go better
The
run-e2e.shscript generates.yarnrc.ymlat runtime but does not configurenpmMinimalAgeGate. Any workspace dependency bumped to a version published within the last 24 hours will break all nightly e2e tests repo-wide, because the fresh resolution fails on the quarantined package. The committed per-workspace lockfiles do not help —run-e2e.shdeletes the root lockfile and resolves from scratch. This is a latent vulnerability affecting any future dependency bump to a recently-published package. Confidence: high — the root cause is well-understood and explicitly documented in the revert PR.Proposed change
In
run-e2e.sh, when generating the runtime.yarnrc.yml, either: (a) setnpmMinimalAgeGate: 0to disable quarantine for the e2e install (simplest fix, trades supply-chain protection for reliability), or (b) add a pre-install check that detects workspace dependencies published within the last 24h and warns/fails-fast with a clear message instead of an opaqueYN0016error. Option (a) is appropriate becauserun-e2e.shalready operates in a CI-only context where packages are pinned by workspace lockfiles in the committed tree — the fresh resolution is an artifact of the unified test runner, not a signal of untrusted dependencies. If supply-chain protection is desired, option (b) provides a better failure mode. The relevant code is the section that writes.yarnrc.ymlinrun-e2e.sh.Validation criteria
After the fix: (1) A workspace that pins a dependency published within the last 24h should not cause
run-e2e.shto fail at the install step. (2) The nightly e2e run should not be blocked by quarantine when a same-day dependency bump is present. Test by temporarily pinning a recently-published package version and runningrun-e2e.sh --list(dry run) or the full install step.Generated by retro agent from #3206