Bug
BLEnder's yarn-bump remediation has never produced a PR on a Yarn Berry repo (e.g. mozilla/fxa). The bump step passes the target package via YARN_PACKAGE/YARN_VERSION env vars, but Yarn Berry reads any YARN_<NAME> env var as a config setting, so every yarn call in yarn-fix.sh aborts:
Usage Error: Unrecognized or legacy configuration settings found: package
yarn up never runs → resolution fallback finds no change → "nothing to open". No error surfaces except in the run log, so it looked like BLEnder simply wasn't remediating.
Evidence
mozilla/fxa alert #913 (@simplewebauthn/server), run https://github.com/mozilla/blender/actions/runs/33902016880 — verdict not affected / bump_pr, then the Usage Error and "no changes produced … nothing to open."
Impact
No yarn bump PR has ever been opened; only dismissals + Dependabot auto-merges worked on fxa.
Fix
Rename the env vars off the YARN_ prefix (BUMP_PACKAGE/BUMP_VERSION). Fixed in #151.
Bug
BLEnder's yarn-bump remediation has never produced a PR on a Yarn Berry repo (e.g. mozilla/fxa). The bump step passes the target package via
YARN_PACKAGE/YARN_VERSIONenv vars, but Yarn Berry reads anyYARN_<NAME>env var as a config setting, so everyyarncall inyarn-fix.shaborts:yarn upnever runs → resolution fallback finds no change → "nothing to open". No error surfaces except in the run log, so it looked like BLEnder simply wasn't remediating.Evidence
mozilla/fxa alert #913 (@simplewebauthn/server), run https://github.com/mozilla/blender/actions/runs/33902016880 — verdict
not affected / bump_pr, then the Usage Error and "no changes produced … nothing to open."Impact
No yarn bump PR has ever been opened; only dismissals + Dependabot auto-merges worked on fxa.
Fix
Rename the env vars off the
YARN_prefix (BUMP_PACKAGE/BUMP_VERSION). Fixed in #151.