To avoid breaking the internet, use strong dependency versioning

[jdbevan]

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
When installing yarn via npm (which I know is not the official way but is still in significant usage) the install can break if a dependency releases a patch or minor change. See #3850, #3851 and omnidan/node-emoji#45

Given that part of the point of using yarn is to avoid this kind of problem, it would be nice if yarn did actually avoid this kind of problem :)

If the current behavior is a bug, please provide the steps to reproduce.
Release a broken patch or minor release of a dependency, install yarn via npm

What is the expected behavior?
Yarn installs successfully

Please mention your node.js, yarn and operating system version.
OS agnostic
Node agnostic
Yarn >= 0.24.0

[MikeN123]

Yarn 0.21.3 broke as well, with a different error.

[hbeachey]

Any version (we had all the way back to 0.16.1) which depend on the updating package breaks. Not sure previous versions really need the fix, but it's something to mention.

[bestander]

As described here #3854 (comment).

We need to publish only the single-file-build yarn.js to npm.
Looking forward for a PR

[Daniel15]

We need to publish only the single-file-build yarn.js to npm.

Publishing the dist directory after running scripts/build-dist.sh should be sufficient, we'd just need to have a modified package.json that removes all dependencies (since we'd no longer need any of the dependencies).

[Daniel15]

#3866