`ts
import { run, runSync } from 'yarn-audit-fix'

// NOTE actually it's promisified run.sync
await run({
flow: 'patch',
verbose: true
})

// runSync is an alias for run.sync
await runSync({
flow: 'patch',
verbose: true
})
`

Build and run custom flows.
`ts
import {
clear,
exit,
patchLockfile,
yarnInstall
} from 'yarn-audit-fix'

export const flow: TFlow = {
main: [
[
'Patching yarn.lock with audit data...',
patchLockfile,
(...args) => {console.log('Smth interesting:', ...args)},
yarnInstall,
],
['Done'],
],
fallback: [['Failure!', exit]],
}

await run({}, flow)
`

Migration notes

hosted-git-info <3.0.8
Severity: moderate
Regular Expression Deinal of Service - https://npmjs.com/advisories/1677
No fix available
node_modules/normalize-package-data/node_modules/hosted-git-info
normalize-package-data 2.0.0 - 2.5.0
Depends on vulnerable versions of hosted-git-info
node_modules/normalize-package-data
meow 3.4.0 - 9.0.0
Depends on vulnerable versions of normalize-package-data
Depends on vulnerable versions of read-pkg-up
`
No fix available just means that no fix available. If you still doubt the correctness of the output, you can check it by hand.
`shell
npm i --package-lock-only
npm audit fix --package-lock-only --force
`

Same response for alternative patching flow:
`shell
npm_config_yes=true npx yarn-audit-fix --audit-level=moderate --flow=patch
`
`shell
Patching yarn.lock with audit data...
invoke yarn audit --json --level moderate
Can't find patched version that satisfies postcss@^7.0.0 in >=8.2.10
Can't find patched version that satisfies postcss@^7.0.1 in >=8.2.10
Can't find patched version that satisfies postcss@^7.0.27 in >=8.2.10
Can't find patched version that satisfies ws@^7.2.3 in >=6.2.2 <7.0.0 || >=7.4.6
Upgraded deps:
invoke yarn --update-checksums
`
Not everything can be repaired, alack.

$3

The _recommended_ way is to update the runtime version. As a temporary workaround, you can simply pass --ignore-engines flag.
`shell
yarn add yarn-audit-fix -D --ignore-engines
`

$3

In some cases yarn npm audit fails because the yarn.lock file contains a transitive dependency in unreadable format:
`
'example-dependency': 'npm:example-dependency@1.0.0'
`

This will results in:
`shell
invoke yarn npm audit --all --json --recursive
➤ YN0035: Bad Request
➤ YN0035: Response Code: 400 (Bad Request)
➤ YN0035: Request Method: POST
➤ YN0035: Request URL: https://registry.yarnpkg.com/-/npm/v1/security/audits/quick
`
https://github.com/yarnpkg/berry/issues/4117

A workaround is available using the exclude option:
1. Update project yarn to >=3.3.0 (lower version doesn't support this parameter for yarn npm audit).
2. Apply npx yarn-audit-fix --exclude example-dependency. This will cause yarn to ignore example-dependency` while creating the audit report.

Contributing

License