[Bug]: Yarn 3.2.0 hangs when diffing lockfiles due to endless-loop bug in `diff` package

Self-service

• I’d be willing to implement a fix

Describe the bug

When I yarn install --immutable inside a container as part of my CI process, Yarn detects that the lockfile would be updated and attempts to show me the diff before exiting with an error.

For the particular lockfile that I am using with my project, the diff never completes: yarn runs forever, using 100% CPU, until I kill it.

To reproduce

I have isolated the problem to the diff package, a dependency of Yarn, and filed an issue with the maintainer of that package, including a self-contained reproduction that does not depend on yarn.

Environment

System:
    OS: Linux 5.10 Debian GNU/Linux 11 (bullseye) 11 (bullseye)
    CPU: (4) x64 unknown
  Binaries:
    Node: 16.14.2 - /tmp/xfs-5c2a3254/node
    Yarn: 4.0.0-rc.3.git.20220426.hash-67ce47fc6 - /tmp/xfs-5c2a3254/yarn
    npm: 8.5.0 - /usr/local/bin/npm

Additional context

I am at an impasse: I can’t upgrade my project to Yarn 2/3 as long as those tools are unstable and prone to disrupt my development workflow. It seems like Yarn’s attempt to provide a UI nicety (colorized diffs) is making it fundamentally unstable.

The hang happens both with diff@4.0.1 (used by yarn@3.2.0) and the most recent build, diff@5.0.0 – so a simple upgrade of diff will not suffice to fix the issue.

Short of fixing the underlying bug, I’m not sure how the Yarn team could proceed. Personally, I don’t need the diff in the environments where this hang occurs – or ever. A .yarnrc.yml flag to disable diffs would be an adequate workaround for me.

I’m happy to attempt whatever feature the team decides is appropriate. Personally, I’m not sure I trust the diff package enough at this point to depend on it for a tool that is a core part of my software development lifecycle. I appreciate that yarn’s goal is to run with no dependencies on the OS, however, and it seems that Yarn patches also use diff – so perhaps the Yarn team can provide some help to the maintainer of diff.

[kpdecker]

5.1.0 just published.

[kpdecker]

Merged PR. Will have to dust off the build toolchain to get a release out. Will try to tackle this weekend.