The problem

I recently found myself in a position needing to resolve dependency issues caught by dependabot in a project using Yarn. Initally I thought, this will be easy... I'll just run yarn audit as I figured it would be the same as npm audit. However, after some quick scattering around the internet, I found that this feature doesn't exist in Yarn (yet).

After some research into the missing feature I came across this GitHub issue which explained all.

The solution

First, we need to use npm to create a temporary package-lock.json file. We'll use the --package-lock-only flag we don't actually install any packages, as that's what we're using Yarn for after all.

npm i --package-lock-only

Then, delete your yarn.lock file:

rm yarn.lock

Now we need to run audit fix to actually fix all vulnerabilities:

npm audit fix

We can now bring things back to Yarn by letting it import the npm lock file and create a new yarn.lock file:

yarn import

Finally, you can now safely delete the package-lock.json file again:

rm package-lock.json

Done! Commit your changes, and you can go back to using Yarn.

Don't forget

Always remember to check that the updated packages work as expected!