Editing Yarn dependencies

Pin a sealed version in package.json, including Yarn resolutions for transitive dependencies.

Direct dependencies

The Yarn manifest is package.json. Replace the version range with the sealed version:

 "dependencies": {
-  "ejs": "2.7.4",
+  "ejs": "2.7.4-sp1",
   ...
 }

Run yarn install and the build pulls ejs@2.7.4-sp1 from npm.sealsecurity.io instead of ejs@2.7.4 from the public registry.

Transitive dependencies (resolutions)

When the vulnerable package is brought in transitively, use Yarn's resolutions block in package.json to force the version. Each sealed version is fully compatible with its specific origin version only, so the override should be scoped to the parent that pulls in the vulnerable origin version. The full-path form points at exactly that occurrence in the dependency graph:

{
  "resolutions": {
    "some-framework/ejs": "2.7.4-sp1"
  }
}

To scope an override even more precisely along a longer path:

{
  "resolutions": {
    "some-framework/another-package/ejs": "2.7.4-sp1"
  }
}

The path-scoped form keeps the override targeted to the place in the dependency graph that actually depends on the origin version you are replacing. Other paths that ask for different versions of the same package are not affected.

Related

• Configuring Yarn: the package-manager setup that points Yarn at the Seal Artifact Server.

• Editing npm dependencies: the npm equivalent, which uses overrides instead of resolutions.