How to resolve specific dependency of a dev dependency in a Yarn.lock

Question

Trying to install a dev dependency but one of its dependencies is lodash: 4.17.20 . When Snyk does a scan of my dependencies, it marks this dependency as a high security vulnerability.

How can we have this dev dependency try to resolve a different version of lodash for a dev dependency and pass the Snyk test?

Was thinking that in the yarn.lock file, it somehow needs to resolve a higher version of lodash for this dev dependency, so I've referred to https://classic.yarnpkg.com/en/docs/selective-version-resolutions/

Doing something in my package.json like

  "resolutions": {
    "**/lodash": "^4.17.20"
  }

Or

  "resolutions": {
    "<that dev dependency>/lodash": "^4.17.20"
  }

Seems like it hasn't quite worked, and the Yarn.lock hasn't updated the lodash dependency for that dev dependency. Wanted to see if this was possible without updating the yarn.lock manually as I could see it being re-overwritten in the future. This is done in a Lerna monorepo.

Answer 1

Update from the Snyk team, they do not have monorepo support with Lerna as of 04/05/21