fix: yarn up now updates catalog entries instead of rewriting package…

[emiliosheinz]

Problem

yarn up <pkg>@<version> was rewriting catalog: and catalog:<name> references in package.json with resolved version strings (e.g. "react": "19.2.4") instead of updating the source-of-truth entry in .yarnrc.yml.

Fixes #7084.

Approach

In executeUpClassic(), before writing to a workspace manifest, the code now checks whether the current dependency range starts with catalog:. If it does, the update is routed to a separate catalogUpdates map (keyed by catalog name + package name) rather than mutating the manifest.

After processing all suggestions, two things happen:

1. Disk write — Configuration.updateConfiguration() patches .yarnrc.yml with the new ranges. This is the same mechanism used throughout Yarn for config mutations.

2. In-memory update — configuration.values is patched directly so that the installWithNewReport() call that follows resolves against the new ranges without needing to re-read the file from disk.

The catalogUpdates map deduplicates by ${catalogName}\0${entryName} so that packages referenced across multiple workspaces are only written once.

Known limitations

Configuration.updateConfiguration() round-trips .yarnrc.yml through Yarn's own parseSyml / stringifySyml serializer, which has two trade-offs:

• Comments are stripped. Any # comments in .yarnrc.yml are lost on the first yarn up that touches a catalog entry.
• Keys are reordered. stringifySyml sorts keys according to a fixed priority list, so the order of entries in catalog: and catalogs: may change.

These are accepted limitations consistent with how every other Yarn command that modifies .yarnrc.yml behaves (e.g. yarn config set). A comment-preserving surgical text editor was prototyped but discarded in favour of consistency with the existing serialization path.

[emiliosheinz]

There are a few failing CI checks in this PR that I believe need to be addressed before we can merge. I'd love to help get them green, but I'm not familiar enough with the project's conventions to fix them confidently. Could you point me in the right direction?

[emiliosheinz]

Hi @arcanis, @clemyan, and @merceyz. Just a quick ping on this PR when you have a moment.

We’d really appreciate any feedback or review so we can move this forward, as it would unlock significant value for us.

Thanks!