Announcement: new major version of @oclif/plugin-plugins

[mdonnalley]

On 3/14/2024 we are going to switch to a new major version of @oclif/plugin-plugins which will use npm instead of yarn (v1) for installing and updating user plugins (PR).

Why is Salesforce making this change?

For a number of reasons:

• yarn (v1) no longer receives bug fixes or security patches. This makes it difficult to address some of our user’s issues (such as https://github.com/forcedotcom/cli/issues/2540) because the bugs exist in yarn and not Salesforce CLI.
• npm is the most commonly used package manager. As a result, we can count on npm to continue releasing bug fixes, features, and security patches.
• The latest version of npm is significantly faster than yarn (v1).
• Switching to npm simplifies environment setup for users behind company firewalls and who use private registries, because there won't be any conflict between global .yarnrc and .npmrc files.

What do I need to do?

In most cases, you don’t need to do anything. Any installed plugins will continue to work and will be updatable using sf plugins update.

If, however, you experience issues, we recommend running sf plugins reset --reinstall --hard, which will completely uninstall all your plugins and then reinstall them on your behalf. If you continue to experience issues, create a new GitHub issue and we'll do our best to help you.

These are some specific use cases in which you do need to do something:

• If you rely on a .yarnrc file to configure the behavior of plugin installation (such as from a private registry), then you must migrate those settings to a .npmrc file.
• If you rely on yarn-specific environment variables, then you must switch to their npm equivalents.
• If you have npm environment variables set in your environment, they might affect the plugin installation behavior. We recommend that you review those environment variables and make any necessary adjustments.

Can I test the changes early?

Yes! And we highly encourage it.

Run sf plugins install @oclif/plugin-plugins@beta to install the new version. Let us know if you experience any issues.

[ethan-sargent]

Hey @mdonnalley - curious whether this has been delayed due to any issues found?

I've delayed a change I was planning to my build container to install plugins via npm (and then install them as dev plugins) to work around the issue where yarn doesn't respect private registry / proxy configuration.

Hoping this will land soon and I don't have to pick that change back up?

[mdonnalley]

@ethan-sargent Yes, sorry - this was delayed by TDX.

@iowillhoit is currently doing a lot of great testing on the PR to ensure everything is good to go. At this point I'd say it's likely to make into this week's release candidate - but I'll post back if that's not the case.

[ethan-sargent]

@mdonnalley No need to apologise! Was mostly just looking to check if there was an 11th hour blocker.

Looking forward to this getting merged - thanks for the update.

Will have a crack at running a test once the rc is out to confirm all's with installs behind a proxy - hoping I get some time.

[mdonnalley]

Update: This weeks's release candidate (2.35.6) has the new major of @oclif/plugin-plugins 🎉

Let us know if you encounter any issues!

[nvuillam]

I'm blocked since today :(

Please can someone check my issue ? ❤️

https://github.com/forcedotcom/cli/issues/2818

cc @mdonnalley

[RupertBarrow]

Hi @nvuillam @mdonnalley Same here.

[iowillhoit]

This will be promoted to latest today (in less than 2 hours). It should be fixed in latest-rc @RupertBarrow

https://github.com/forcedotcom/cli/issues/2818#issuecomment-2061945120