Stop using yarn@1 in DCR

[sndrs]

Yarn 1 is 6 years old and went into maintenance mode 3.5 years ago.

it also hoists dependencies, which makes it very hard to know which version of a dep you'll be using, and makes transitive deps available to everyone.

we should move to a more modern package manager, in particular one that doesn't need to hoist deps, like pnpm or yarn 4

Tasks

Beta Give feedback

1. investigate yarn@3/yarn@4
2. [Bug?]: Fail to install turbo when using nodeLinker: pnpm with v4 yarnpkg/berry#5165
   bug reproducible +2
3. Rationalise DCR's env checking scripts #9400
   dotcom-rendering run_chromatic +2
4. Provide the full hash for prebid in dependencies commercial#1133
   dependencies +1
5. Upgrade Yarn to v4 #9466
   apps-rendering dotcom-rendering run_chromatic +3
   
6. yarn → pnpm #9476
   DevX Seen-on-PROD apps-rendering dotcom-rendering +4
   
7. 👋 yarn@1: remove use of @yarnpkg/lockfile from check-deps #9576
   Dependencies DevX dotcom-rendering +3
   
8. 👋 yarn@1: align some DCR deps #9565
   DevX dotcom-rendering +2
   
9. 👋 yarn@1: bump/pin some AR deps #9562
   DevX apps-rendering +2
   
10. 👋 yarn@1: set max-old-space-size size for chromatic in CI config #9559
    DevX apps-rendering dotcom-rendering +3
    
11. Use corepack instead of committing a version of yarn #9610
    DevX apps-rendering dotcom-rendering +3
    

[sndrs]

tried out yarn@4 in DCR. it's a lot nicer than 1, especially in terms of reporting inconsistencies between peerdeps etc.

you can set it up to only hoist deps to the package level too, and to link to packages via a central store, which brings a lot of the benefits of pnpm's package management:

# .yarnrc.yml
nodeLinker: pnpm
nmMode: hardlinks-global

it fails installing esbuild for some reason i can't work out. have raised an issue: yarnpkg/berry#5914 (closed because it dupes an exiting one).