Is there a way to check for vulnerabilities in Yarn 2 dependencies? In Yarn 1.x, you could run yarn audit
, similar to npm audit
. However, this command is not available in Yarn 2. According to this issue on the Yarn berry Github, it may not be implemented (project maintainers prefer a plugin approach).
I attempted to use
npm install --package-lock-only && npm audit
, but it encountered issues with my local packages listed as link:
in package.json.
Building a plugin wouldn't be difficult, although it's more fun to simply install something and move on with my day. I've searched but keep coming across outdated repositories.
Could there be an undocumented method or trick I'm missing? That's why I'm asking :)
As a workaround, I can temporarily remove the local packages using link:
while running npm install
and npm audit
, but automating this process for CI isn't ideal.