Yarn support for security alerts
Yarn now supports security alerts for public and private repositories.
GitHub security alerts help developers stay on top of vulnerabilities that impact their dependencies. JavaScript developers already receive alerts for their NPM-based projects that use package.json and package-lock.json manifests. Now developers who use Yarn for dependency management will also receive security alerts for any vulnerable dependencies listed in their yarn.lock manifests.
How to enable security alerts for Yarn
- If you have a public repository, you’ll start receiving these alerts automatically—no need to change anything.
- If you have a private repository or if you previously opted out of receiving these alerts, just enable the dependency graph to start receiving alerts.
Learn more about security alerts
Tags:
Written by
Related posts
Racing into 2025 with new GitHub Innovation Graph data
Discover the latest trends and insights on public software development activity on GitHub with the quarterly release of data for the Innovation Graph, updated through December 2024.
GitHub Availability Report: March 2025
In March, we experienced one incident that resulted in degraded performance across GitHub services.
Vibe coding with GitHub Copilot: Agent mode and MCP support rolling out to all VS Code users
In celebration of MSFT’s 50th anniversary, we’re rolling out Agent Mode with MCP support to all VS Code users. We are also announcing the new GitHub Copilot Pro+ plan w/ premium requests, the general availability of models from Anthropic, Google, and OpenAI, next edit suggestions for code completions & the Copilot code review agent.