search

yarnpkg / yarn

The 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry
https://classic.yarnpkg.com
Other
41.4k stars 2.73k forks source link

Pin lodash to version without security risks as reported by governance scans #9031

Open JosephNero1 opened 7 months ago

JosephNero1 commented 7 months ago

Yarn classic seems to depend on versions of lodash that are <4.17.21, which are being flagged by our governance scan checker on deploy as security risks. As a result, we can not use yarn classic. This will pin lodash to version >= 4.17.21, which is free of security vulnerabilities as reported by the governance scan.