Fill install-required fields the patched graph still lacks, so the written
lockfile needs no reconcile yarn install. Today that's only the yarn-berry
zip checksum: completeTransitives resolves new nodes' integrity from the
packument, but the berry checksum is a hash of yarn's own zip, derivable
only from the tarball bytes — so refurbish fetches them and recomputes
(byte-identical to what yarn install would write). yarn-classic nodes are
already complete (resolved + integrity), so it's a no-op there. Async (HTTP).
Scoped to what the patch introduced (base = the pre-patch graph). A checksum
missing from the INPUT lock is yarn's own doing, not a gap to close: yarn only
records checksums for packages it actually fetched, so a platform-gated optional
dep (conditions: os=… & cpu=…) is deliberately left bare. Filling those makes
the next yarn install strip them right back out — a dirty lockfile for no gain.
Omit base to refurbish every node (standalone use).
Fill install-required fields the patched graph still lacks, so the written lockfile needs no reconcile
yarn install. Today that's only the yarn-berry zipchecksum:completeTransitivesresolves new nodes'integrityfrom the packument, but the berrychecksumis a hash of yarn's own zip, derivable only from the tarball bytes — sorefurbishfetches them and recomputes (byte-identical to whatyarn installwould write). yarn-classic nodes are already complete (resolved + integrity), so it's a no-op there. Async (HTTP).Scoped to what the patch introduced (
base= the pre-patch graph). A checksum missing from the INPUT lock is yarn's own doing, not a gap to close: yarn only records checksums for packages it actually fetched, so a platform-gated optional dep (conditions: os=… & cpu=…) is deliberately left bare. Filling those makes the nextyarn installstrip them right back out — a dirty lockfile for no gain. Omitbaseto refurbish every node (standalone use).