yarn-audit

Yarn Audit

Resolve dependency audit findings with the smallest safe change.

Workflow

1. Reproduce the dependency-only audit issue with yarn audit --groups dependencies.
2. Identify the affected package names, severities, advisory paths, and whether the vulnerable package is direct or transitive.
3. Check whether the problem is actually workspace version drift before changing versions:
   • Run yarn sync:check.
   • Search manifests with rg -n '"<package-name>"' package.json packages/*/package.json.
4. Choose the least invasive fix:
   • If the same dependency or devDependency has inconsistent ranges across workspace manifests, use syncpack first.
   • If a direct dependency is vulnerable, bump the direct dependency to the minimum safe range.
   • If the vulnerable package is transitive and the parent can be bumped safely, upgrade the parent package instead of adding a broad override.
   • If the vulnerable package is transitive and no safe parent bump is available, add or tighten a root resolutions entry for the minimum fixed version.
5. Regenerate the lockfile with yarn install after manifest changes.
6. Re-run yarn audit --groups dependencies.
7. Report what changed, what advisory path was addressed, and any remaining findings.

Use Syncpack When Applicable

Treat syncpack as the first fix when audit work reveals monorepo drift rather than a true package-selection problem.

Use it when:

• Multiple workspaces declare the same package with different semver ranges and the audit fix needs them aligned.
• A package upgrade was applied in one workspace but other workspaces still pin an older vulnerable range.
• The repo already exposes yarn sync:check and yarn sync:fix, which this repository does.

Do not use it when:

• The issue is isolated to one package by design.
• The fix requires changing a root resolutions entry for a transitive dependency.
• The audit finding is caused only by the lockfile selecting an old transitive version while manifest ranges are already aligned.