You might previously use commands like npm audit or yarn audit to perform a vulnerability audit against the installed packages. In case any vulnerable dependencies found to update it you could use built-in npm audit fix command. It would automatically install any compatible updates to vulnerable dependencies. Surprisingly, there is no yarn alternative to fix it in the way npm does, yet there are several workarounds which you can do.
The very straight forward option is to use yarn-audit-fix package.
1yarn add yarn-audit-fix -DAlternatively, you can use npx.
1npx yarn-audit-fix1yarn-audit-fixThis is my preferable approach to fix vulnerable dependencies.
package-lock.json file without installing node modules1npm install --package-lock-onlypackage-lock.json file1npm audit fixyarn.lock file and import the package-lock.json file into yarn.lock1rm yarn.lock2
3yarn importpackage-lock.json file1rm package-lock.jsonSign up to get updates when I write something new. No spam ever.
Subscribe to my Newsletter