Make sure that minimist gets bumped past the vulnerable version

[freben]

History revisionism: Did this by only touching the affected packages.

[Rugvip]

I guess it works until it doesn't? 😁

Never actually tried yarn.lock regeneration as a strategy in any project, kinda hoping it would work though.

Can't find much on the web btw, some discussion here https://stackoverflow.com/questions/52928016/is-there-an-appropriate-time-to-routinely-delete-yarn-lock-package-lock-json

[freben]

Yeah. The thing here, if I understand it correctly, is that we depend on A which depends on B@^1.1.1 which depends on C@badversion, and B comes out with a new patch version that depends on C@goodversion. And we want to sort of update "in the middle of" the tree.

[freben]

more context: eslint/eslint#13050

[Rugvip]

Hmm, solved that before just modifying yarn.lock. In this case you should be able to just delete the bad entries from yarn.lock and re-run yarn