/opt/homebrew/lib/node_modules/corepack/dist/yarn.js warns about url.parse() deprecation, seems to be outdated

[rgoldberg]

Output of brew config

HOMEBREW_VERSION: 5.0.4-68-g70badad
ORIGIN: https://github.com/Homebrew/brew
HEAD: 70badad488056fb48cf687aa777f2880aac58fe9
Last commit: 12 hours ago
Branch: main
Core tap HEAD: e90f78726244236a45a34f84fcde79098c1c54c5
Core tap last commit: 87 minutes ago
Core tap JSON: 08 Dec 07:07 UTC
Core cask tap HEAD: 7ef2459dbb550b098ce1d8516381584dddc09ed7
Core cask tap last commit: 66 minutes ago
Core cask tap JSON: 08 Dec 07:07 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 28
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 14
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.4.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.7/bin/ruby
CPU: 14-core 64-bit arm_brava
Clang: 17.0.0 build 1700
Git: 2.52.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.1-arm64
CLT: 26.1.0.0.1.1761104275
Xcode: 26.1.1
Metal Toolchain: N/A
Rosetta 2: false

Output of brew doctor

Your system is ready to brew.

Description of issue

/opt/homebrew/lib/node_modules/corepack/dist/yarn.js seems to be outdated (it's 1.22.22, while current is 4.12.0).

What installs it? I haven't installed any of the formulae listed by brew which-formula yarn.

I noticed yarn being outdated because I sometimes get the following warning when topgrade (current from homebrew-core) runs /opt/homebrew/bin/yarn global upgrade (/opt/homebrew/bin/yarn is a symlink to /opt/homebrew/lib/node_modules/corepack/dist/yarn.js):

(node:31370) [DEP0169] DeprecationWarning: url.parse() behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for url.parse() vulnerabilities.

yarn seems to warn about this only once, then not again for a while, which I assumed was due to caching with infrequent cache invalidation, but /opt/homebrew/bin/yarn cache clean didn't cause the warning to be displayed again.

Simplest reproduction, if yarn decides to give the warning:

topgrade --skip-notify --only yarn --verbose

[Swotboysandy]

[SMillerDev]

So many repeating statements. If you're not gonna answer yourself, at least ask your AI for a short answer.

[p-linnane]

Posting AI generated responses to topics you don't understand is not helpful.

[cho-m]

One thing to check is ls -l /opt/homebrew/lib/node_modules/corepack. If this is:

• ... a real directory, then it was installed outside of Homebrew. npm install -g corepack or other commands would create this. The node_modules directory is intended to be managed by user (other than npm) so Homebrew will not delete stuff inside it.
• ... a symlink, then it should point to Formula path.
  • Note this should only happen with core formulae if you haven't upgraded node (to 25+) or you ran brew link --force node@X.

---

As of Node.js 25, the upstream has decided to no longer bundle corepack inside node and thus we brought back the separate formula:

• corepack 0.34.2 (new formula) homebrew-core#252890

However, due to how we install npm packages' executables, brew install corepack will only provide /opt/homebrew/bin/{corepack,yarn,...} but nothing inside /opt/homebrew/lib/node_modules. So, corepack formula should never add the files you are mentioning.