security: migrate from yarn to npm and resolve 15 security vulnerabilities#78
Merged
Connor Power (connorpower) merged 3 commits intomasterfrom Mar 10, 2026
Merged
Conversation
…rn to npm Yarn v1 lacks tooling to bump transitive dependency versions — there is no equivalent of `npm audit fix`. The only mechanism (resolutions) is limited and cannot handle exact-pinned transitive deps or scoped version ranges reliably. This made security patching a recurring manual burden. Switching to npm gives us `npm audit fix` for automated transitive dep patching, `overrides` for the remaining edge cases, and consistency with other Ditto JS repositories (e.g. quickstart). Changes: - Delete yarn.lock files, generate package-lock.json via npm install - Replace yarn `resolutions` with npm `overrides` in root package.json - Add overrides for serialize-javascript (7.0.4) and minimatch (9.0.9) via prettier-eslint path - Update example app link: protocol from yarn-only `link:` to `file:` - Update CI workflow from yarn to npm commands Resolves 18 Dependabot alerts (all high/critical). Remaining are 5 low severity (elliptic via karma-typescript) that require a breaking major downgrade to fix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Connor Power (connorpower)
requested review from
Alyssa Evans (alycda) and
Daniel Henry-Mantilla (danielhenrymantilla)
There was a problem hiding this comment.
Pull request overview
Migrates the repo from Yarn to npm to improve vulnerability remediation (via npm audit fix + overrides) and to update CI/example app workflows accordingly.
Changes:
- Replaced Yarn
resolutionswith npmoverridesfor vulnerable transitive dependencies. - Updated the Vite TypeScript example to use npm-compatible local dependency specifiers (
file:). - Updated GitHub Actions CI to run npm commands instead of Yarn.
Reviewed changes
Copilot reviewed 3 out of 7 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| package.json | Removes Yarn resolutions and adds npm overrides for transitive dependency patching. |
| examples/vite-typescript-example/package.json | Switches local dependency protocol to file: and adds npm overrides. |
| .github/workflows/ci.yml | Replaces Yarn commands with npm equivalents in CI. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Add engines.node >= 20 constraint to align with serialize-javascript@7.0.4 - Use npm ci instead of npm install in CI for reproducible builds - Switch example app react/react-dom/@dittolive/ditto to semver ranges Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The lockfile still referenced the old file: paths for react/react-dom, causing npm ci to fail in CI due to version mismatch. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Connor Power (connorpower)
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes SPO-79
Closes SPO-80
Closes SPO-81
Closes SPO-82
Closes SPO-86
Closes SPO-94
Closes SPO-100
Closes SPO-103
Closes SPO-104
Closes SPO-105
Closes SPO-106
Closes SPO-107
Closes SPO-108
Closes SPO-109
Closes SPO-110
Summary
npm audit fixandoverrides(replacing yarn'sresolutions), allowing us to directly resolve Dependabot alerts for transitive dependencies.minimatch,serialize-javascript, etc.) through npm overrides..github/workflows/ci.yml) to usenpmcommands instead ofyarn.link:protocol to npm-compatiblefile:protocol for local dependencies.Why npm?
Yarn's
resolutionsfield has limited support for patching nested transitive dependencies flagged by Dependabot/GitHub security alerts. npm'soverridesprovides more granular control over the dependency tree, making it significantly easier to address security vulnerabilities without waiting for upstream package updates.