yarn

This page explains how Bomly builds a dependency graph for yarn projects: the detector chain it runs, what that chain needs, and what it can report.

How yarn resolves

The chain is lockfile-first. The yarn detector parses yarn.lock (classic version 1, or Berry versions 2 to 4) and produces a full transitive graph. The build-tool strategy runs yarn list instead. The Syft fallback runs only when neither strategy produces a graph.

The lockfile strategy reads one file and runs nothing, so it never uses the network. The build-tool strategy reads local state when the lockfile is complete and node_modules is installed. See Network and privacy for the shared rule.

Prerequisites

• A committed yarn.lock. Both the classic format (the # yarn lockfile v1 header) and Berry lockfiles are supported.
• No Node.js or Yarn installation is required to scan. Bomly parses the lockfile directly.
• For --install-first: yarn on PATH.

Examples

Pin a transitive vulnerability

Use resolutions in package.json:

{
  "resolutions": {
    "**/lodash": "4.17.21"
  }
}

Re-lock with yarn install and re-scan.

Workspaces

Bomly walks Berry workspaces and scans each as a subproject. Plug'n'Play projects (.pnp.cjs) are read through the lockfile, not the runtime resolver, so graph detail matches the lockfile.

--install-first

With --install-first, Bomly runs yarn install before resolving the graph. That downloads packages from the npm registry. Use it only when the lockfile is missing or stale:

bomly scan --install-first

To append flags to that command, repeat --install-arg. This requires --detectors yarn:

# Refuse to update the lockfile and skip optional dependencies
bomly scan --install-first --detectors yarn \
  --install-arg --frozen-lockfile --install-arg --ignore-optional

Reachability (experimental)

With --analyze, the jsreach analyzer reports a Yarn package as reachable when app source imports it, directly or through the dependency graph. It reads workspace arrays and workspaces.packages objects and follows imports between sibling packages by package name. Unreachable is a triage signal, not proof of safety; see Reachability.

Limitations

• Dependencies marked injected: true in Berry workspaces are followed as regular edges.
• The portal: and link: protocols point to local checkouts. Their internal dependencies come from the local package, not the registry.
• Subpath imports collapse to the package name for reachability.

Configuration

yarn is one detector with two internal strategies, lockfile and buildtool. Its config block controls their order and whether --install-first applies to it:

plugins:
  detectors:
    yarn:
      # Reorder or subset the strategies (default: lockfile, buildtool)
      strategy: [lockfile, buildtool]
      # Set to false to skip this detector when --install-first is passed
      installFirst: true

The older detector names yarn-detector and yarn-native still work as selector aliases of yarn.