Locking versions of node module transitive dependencies (dependencies of dependencies)

user_133906 0
Viewed 100

I'm needing some help locking versions of node module transitive dependencies (dependencies of dependencies).

My company uses a mirror of npmjs.com registry. In light of recent malicious npm packages this mirror has enabled a feature to "quarantine" newly published packages for n-number of days until they have been deemed safe to use. When a newly published package is quarantined in our mirror it is not available for use and will 403 when trying to install.

We've since started to use strong versions of our packages in our package.json file - no range qualifiers are found in our package.json - no *'s - no ~'s - no ^'s.

We use yarn as our package manager. We commit our yarn.lock files to git. Upon looking more closely at our yarn.lock file, we obviously see transitive dependencies using range qualifiers. Transitive dependencies using range qualifiers in combination with our npm mirror's quarantine rules for newly published packages is causing a new yarn install error almost daily.

We're looking for a way to lock down specific versions of our transitive dependencies.

Do we manually update our yarn.lock file removing all range qualifiers? Do we switch to a different package manager? npm? pnpm?

Thoughts?

node-modules npm node.js
1 Answers

Hey in yarn you can specify in the package.json resolutions

"resolutions": {
    "d2/left-pad": "1.1.1",
    "c/**/left-pad": "^1.1.2"
}

You can read more here

user_19591130
Related