> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/using-platform/working-with-seal-apps/artifact-server/yarn.md).

# Editing Yarn dependencies

## Direct dependencies

The Yarn manifest is `package.json`. Replace the version range with the sealed version:

```diff
 "dependencies": {
-  "ejs": "2.7.4",
+  "ejs": "2.7.4-sp1",
   ...
 }
```

Run `yarn install` and the build pulls `ejs@2.7.4-sp1` from `npm.sealsecurity.io` instead of `ejs@2.7.4` from the public registry.

## Transitive dependencies (`resolutions`)

When the vulnerable package is brought in transitively, use Yarn's `resolutions` block in `package.json` to force the version. Each sealed version is fully compatible with its specific origin version only, so the override should be scoped to the parent that pulls in the vulnerable origin version. The full-path form points at exactly that occurrence in the dependency graph:

```json
{
  "resolutions": {
    "some-framework/ejs": "2.7.4-sp1"
  }
}
```

To scope an override even more precisely along a longer path:

```json
{
  "resolutions": {
    "some-framework/another-package/ejs": "2.7.4-sp1"
  }
}
```

The path-scoped form keeps the override targeted to the place in the dependency graph that actually depends on the origin version you are replacing. Other paths that ask for different versions of the same package are not affected.

## Related

* [Configuring Yarn](/setup-apps-os/artifact-server/configuring-package-managers/yarn.md): the package-manager setup that points Yarn at the Seal Artifact Server.
* [Editing npm dependencies](/using-platform/working-with-seal-apps/artifact-server/npm.md): the npm equivalent, which uses `overrides` instead of `resolutions`.