How do I fix a vulnerable transitive dependency in Yarn with resolutions?

Add a resolutions entry to the root package.json that names the vulnerable package and the fixed version, then reinstall. Yarn will use that version everywhere instead of the one the resolver would pick. It only works at the project root, and you should remove the pin once the parent package updates.

What resolutions does

The Yarn documentation says the resolutions field forces Yarn to use a specific version instead of the one its resolver would normally pick. It is useful for making all packages share a single copy or for backporting a fix. It is the Yarn counterpart to the npm overrides field covered in pinning a transitive dependency with npm overrides.

The key is a package name, optionally followed by a slash and the dependency it applies to. The docs say it accepts one level of specificity.

{
  "resolutions": {
    "some-package": "3.0.0",
    "parent-pkg/child-dep": "0.4.1",
    "@scope/parent/@scope/child": "7.3.4",
    "parent@npm:7.0.0/child": "7.3.4"
  }
}

The last form pins the parent to a specific version descriptor, so only that parent's copy of the child is overridden.

Rules to remember

The field can only be set at the root of the project. Using it in any other workspace produces a warning. Relative paths with the file and portal protocols resolve relative to the project path.

Steps to apply a fix

1. Find which parent brings in the vulnerable package. Yarn can show this with its why command.
2. Check the advisory for the first fixed version, and confirm it is compatible with the parent's declared range.
3. Add a resolutions entry, scoped to the parent if you can.
4. Run an install and review the lockfile diff. Only the targeted entries should change.
5. Run your tests, since the parent was not built against this version.
6. Add a comment in your pull request describing why the pin exists, and a reminder to remove it.
7. Re-scan to confirm the old version is gone.

When a pin is the wrong tool

Try it yourself

Click through it at your own pace, or open it full screen.

Look at how a finding with a fixed version becomes a proposed change. The same reasoning drives a resolutions pin.

Quick check

Safeguard's autonomous remediation can open fix PRs for vulnerable dependencies. It is off by default, with every category on Manual. The free scan is at gold.safeguard.sh/scan.

Sources

• package.json resolutions, Yarn

Last reviewed: 19 October 2026.