{"id":15408915,"url":"https://github.com/antongolub/yarn-audit-fix","last_synced_at":"2025-05-15T11:01:53.459Z","repository":{"id":37055835,"uuid":"278132529","full_name":"antongolub/yarn-audit-fix","owner":"antongolub","description":"The missing `yarn audit fix`","archived":false,"fork":false,"pushed_at":"2025-04-05T19:31:42.000Z","size":5275,"stargazers_count":186,"open_issues_count":20,"forks_count":9,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-07T08:12:22.237Z","etag":null,"topics":["lockfile","security","vulnerability","yarn"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/antongolub.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-07-08T15:53:33.000Z","updated_at":"2025-04-05T19:31:04.000Z","dependencies_parsed_at":"2024-04-05T01:06:13.248Z","dependency_job_id":"6a3a538b-6362-450f-9ac9-07ecdb46db0b","html_url":"https://github.com/antongolub/yarn-audit-fix","commit_stats":{"total_commits":705,"total_committers":9,"mean_commits":78.33333333333333,"dds":"0.21702127659574466","last_synced_commit":"1eb222079e9c1ecfed5f2ff6787c5a6e51deb0e6"},"previous_names":[],"tags_count":176,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antongolub%2Fyarn-audit-fix","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antongolub%2Fyarn-audit-fix/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antongolub%2Fyarn-audit-fix/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/antongolub%2Fyarn-audit-fix/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/antongolub","download_url":"https://codeload.github.com/antongolub/yarn-audit-fix/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248911623,"owners_count":21182123,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["lockfile","security","vulnerability","yarn"],"created_at":"2024-10-01T16:35:53.268Z","updated_at":"2025-04-14T15:53:47.342Z","avatar_url":"https://github.com/antongolub.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://yarnpkg.com/\"\u003e\n    \u003cimg alt=\"Yarn audit fix\" src=\"https://github.com/antongolub/yarn-audit-fix/blob/master/img/yarn-audit-fix.png?raw=true?raw=true\" width=\"546\"\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n\u003ch1 align=\"center\"\u003e\n  yarn-audit-fix\n\u003c/h1\u003e\n\n[![CI](https://github.com/antongolub/yarn-audit-fix/actions/workflows/ci.yaml/badge.svg?event=push)](https://github.com/antongolub/yarn-audit-fix/actions/workflows/ci.yaml)\n[![Maintainability](https://api.codeclimate.com/v1/badges/1ace18434c46fe1a47fe/maintainability)](https://codeclimate.com/github/antongolub/yarn-audit-fix/maintainability)\n[![Test Coverage](https://api.codeclimate.com/v1/badges/1ace18434c46fe1a47fe/test_coverage)](https://codeclimate.com/github/antongolub/yarn-audit-fix/test_coverage)\n[![Sonar](https://sonarcloud.io/api/project_badges/measure?project=antongolub_yarn-audit-fix\u0026metric=alert_status)](https://sonarcloud.io/dashboard?id=antongolub_yarn-audit-fix)\n[![Known Vulnerabilities](https://snyk.io/test/github/antongolub/yarn-audit-fix/badge.svg)](https://snyk.io/test/github/antongolub/yarn-audit-fix)\n[![Downloads](https://img.shields.io/npm/dt/yarn-audit-fix)](https://www.npmjs.com/package/yarn-audit-fix)\n[![npm (tag)](https://img.shields.io/npm/v/yarn-audit-fix)](https://www.npmjs.com/package/yarn-audit-fix)\n\nThe missing `yarn audit fix`\n\n- [Digest](#digest)\n   - [Problem](#problem)\n   - [Solution](#solution)\n   - [Key features](#key-features)\n- [Getting started](#getting-started)\n   - [Requirements](#requirements)\n   - [Install](#install)\n   - [CLI](#cli)\n   - [ENV](#env)\n   - [JS API](#js-api)\n- [Migration notes](#migration-notes)\n   - [^10.0.0](#1000)\n   - [^9.0.0](#900)\n   - [^8.0.0](#800)\n   - [^7.0.0](#700)\n   - [^6.0.0](#600)\n   - [^4.0.0](#400)\n- [⚠️ Troubleshooting](#troubleshooting)\n- [Contributing](#contributing)\n- [License](#license)\n\n## Digest\n### Problem\n1. `yarn audit` detects vulnerabilities, but cannot fix them.\nAuthors suggest using [Dependabot](https://dependabot.com/) or [Snyk](https://snyk.io/) for security patches. Well, it is very inconvenient in some situations, to say the least of it.\nThe discussion: [yarn/issues/7075](https://github.com/yarnpkg/yarn/issues/7075).\n2. `yarn audit` does not support custom (in-house, internal) registries. Here are the [issue](https://github.com/yarnpkg/yarn/issues/7012) \u0026 [PR](https://github.com/yarnpkg/yarn/pull/6484) which have not yet received the green light.\n\n### Solution\nFortunately, there are several workarounds:\n1. Compose `npm audit fix` with lockfile converter (thanks to [Gianfranco P.](https://github.com/gianpaj), [stackoverflow/60878037](https://stackoverflow.com/a/60878037)).\n   `yarn-audit-fix --flow=convert` just reproduces these steps with minimal changes. More details: [dev.to/yarn-audit-fix-workaround](https://dev.to/antongolub/yarn-audit-fix-workaround-i2a)\n2. Fetch `yarn/npm audit --json` advisories and patch lockfile inners (kudos to [G. Kosev](https://github.com/spion), [code reference](https://github.com/hfour/yarn-audit-fix-ng/blob/main/src/index.ts)). `yarn-audit-fix --flow=patch`. Full description: [dev.to/yarn-audit-fix-for-yarn-2-berry](https://dev.to/antongolub/the-missing-yarn-audit-fix-for-yarn-2-berry-1p8)\n\n### Key features\n* Works with Yarn 1 Classic \u0026 Yarn v2+ lockfiles (⚠️ experimental)\n* A couple of strategies to fix security issues\n* macOS / Linux / Windows support\n* CLI / JS API\n* TS and flow typings\n\n## Getting started\n### Requirements\nNode.js: `\u003e=16.0.0`\n\n### Install\n```shell script\n$ yarn add yarn-audit-fix -D\n```\nor even better\n```\nnpm_config_yes=true npx yarn-audit-fix\n```\n\n### CLI\n\u003cpre\u003e\n$ yarn-audit-fix [--opts]\n\n\u003cb\u003ePreparing temp assets...\u003c/b\u003e\n\u003cb\u003eGenerating package-lock.json from yarn.lock...\u003c/b\u003e\n\u003cb\u003eApplying npm audit fix...\u003c/b\u003e\n\u003cb\u003einvoke\u003c/b\u003e npm audit fix --package-lock-only\nadded 14 packages, removed 195 packages and updated 1245 packages in 4.795s\nfixed 3 of 26 vulnerabilities in 1370 scanned packages\n  23 vulnerabilities required manual review and could not be updated\n\u003cb\u003eUpdating yarn.lock from package-lock.json...\u003c/b\u003e\n\u003cb\u003einvoke\u003c/b\u003e yarn import\ninfo found npm package-lock.json, converting to yarn.lock\nwarning synp \u003e request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142\nwarning tslint-config-qiwi \u003e tslint-react@5.0.0: tslint-react is deprecated along with TSLint\nwarning @qiwi/libdefkit \u003e @types/read-pkg@5.1.0: This is a stub types definition. read-pkg provides its own type definitions, so you do not need this installed.\n...\nsuccess Saved lockfile.\n\u003cb\u003einvoke\u003c/b\u003e yarn\n[1/4] 🔍  Resolving packages...\nsuccess Already up-to-date.\n\u003cb\u003eDone\u003c/b\u003e\n\u003c/pre\u003e\n| Option                | Description                                                                                                                                                             | Default                                    | with `--flow=convert` only | \n|-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|----------------------------|\n| `--flow`              | Define how `yarn.lock` is modified. `convert` — to compose `npm audit fix` with two-way lockfile conversion (legacy flow). `patch` — to directly inject audit json data | `patch`                                    |                            |\n| `--audit-level`       | Include a vulnerability with a level as defined or higher. Supported values: low, moderate, high, critical                                                              | `low`                                      |                            |\n| `--cwd`               | Current working dir                                                                                                                                                     | `process.cwd()`                            |                            |\n| `--dry-run`           | Get an idea of what audit fix will do                                                                                                                                   |                                            |                            |\n| `--force`             | Have audit fix install semver-major updates to toplevel dependencies, not just semver-compatible ones                                                                   | `false`                                    |                            |\n| `--help/-h`           | Print help message                                                                                                                                                      |                                            |                            |\n| `--legacy-peer-deps`  | Accept an incorrect (potentially broken) deps resolution                                                                                                                |                                            | ✔                          |\n| `--loglevel`          | Set custom [log level](https://docs.npmjs.com/cli/v7/using-npm/config#loglevel)                                                                                         |                                            | ✔                          |\n| `--npm-path`          | Switch to project's local **npm** version instead of system default. Or provide a custom path. `system / local / \u003ccustom path\u003e`                                         | `system`                                   |                            |\n| `--only`              | Set package [update scope](https://docs.npmjs.com/cli/v7/using-npm/config#only): `dev`/`prod`                                                                           |                                            |                            |\n| `--package-lock-only` | Run audit fix without modifying `node_modules`. Highly recommended to **enable**.                                                                                       | `true`                                     | ✔                          |\n| `--registry`          | Custom registry url                                                                                                                                                     |                                            | ✔                          |\n| `--silent`            | Disable log output                                                                                                                                                      | `false`                                    |                            |\n| `--symlink`           | Symlink type for `node_modules` ref                                                                                                                                     | `junction` for Windows, `dir` otherwise    |                            |\n| `--temp`              | Directory for temporary assets                                                                                                                                          | `\u003ccwd\u003e/node_modules/.cache/yarn-audit-fix` |                            |\n| `--verbose`           | Switch log level to verbose/debug                                                                                                                                       | `false`                                    |                            |\n| `--exclude`           | Array of glob patterns of packages to exclude from audit                                                                                                                |                                            |                            |\n| `--ignore`            | Array of glob patterns of advisory IDs to ignore in the audit report                                                                                                    |                                            |                            |\n\n### ENV\nAll mentioned above CLI options can be replaced with the corresponding env variables with leading **YAF** prefix. For example:\n* `YAF_FORCE` equals `--force`\n* `YAF_ONLY=prod` — `--only=prod`\n\n### JS API\n**yarn-audit-fix** is a naive and optimistic workaround, so it exposes all of its inners to give anybody a chance to tweak up and find a better steps combination.\nTypedoc: [https://antongolub.github.io/yarn-audit-fix/modules/](https://antongolub.github.io/yarn-audit-fix/modules/)\n\n```ts\nimport { run, runSync } from 'yarn-audit-fix'\n\n// NOTE actually it's promisified `run.sync`\nawait run({\n   flow: 'patch',\n   verbose: true\n})\n\n// `runSync` is an alias for `run.sync`\nawait runSync({\n  flow: 'patch',\n  verbose: true\n})\n```\n\nBuild and run custom flows.\n```ts\nimport {\n   clear,\n   exit,\n   patchLockfile,\n   yarnInstall\n} from 'yarn-audit-fix'\n\nexport const flow: TFlow = {\n  main: [\n    [\n      'Patching yarn.lock with audit data...',\n      patchLockfile,\n      (...args) =\u003e {console.log('Smth interesting:', ...args)},\n      yarnInstall,\n    ],\n    ['Done'],\n  ],\n  fallback: [['Failure!', exit]],\n}\n\nawait run({}, flow)\n```\n\n## Migration notes\n### ^10.0.0\nv10 bumps the pkg deps and requires NodeJS v14.\n\n### ^9.0.0\nv9 brings experimental Yarn 2+ lockfiles support, so the previous behaviour (when `yaf` parsing failure may be used to detect them) has been changed.\n\n### ^8.0.0\nFrom v8 the library does not contain **npm** dependency, so the system default is used instead. If necessary you can:\n* Install the required npm version and provide a custom path via [CLI](#cli) / [ENV](#env) / [JS API](#js-api)\n* Use a pinch of **npx** magic: `npm_config_yes=true YAF_NPM_PATH=local npx -p yarn-audit-fix -p npm@8 -c yarn-audit-fix`\n\n### ^7.0.0\nFollowing the deps, converted to ESM. So legacy `require` API has been dropped since v7.0.0. Use the shiny new `import` instead or try your luck with [esm-hook](https://www.npmjs.com/package/@qiwi/esm). CLI works as before.\n```js\n// const {run} = require('yarn-audit-fix') turns into\nimport {run} from 'yarn-audit-fix'\n```\n\n### ^6.0.0\nDefault fix strategy [has been changed](https://github.com/antongolub/yarn-audit-fix/releases/tag/v6.0.0) to direct lockfile patching with `yarn audit --json` data. To use the previous _legacy_ flow, pass `--flow=convert` option to CLI.\n\n### ^4.0.0\n`--npm-v7` flag is redundant. From v4.0.0 package's own version of **npm** is used by default. But you're still able to invoke system default with `--npm-path=system` or define any custom `--npm-path=/another/npm/bin`.\n\n## Troubleshooting\n### DoS vulnerability for colors 1.4.x\nIf you have installed yaf between 7...11 of Jan 2022 and ran it with `--flow=convert` option, you might see an endless garbage loop in stdout.\nThe problem was caused by the transitive dep: `yarn-audit-fix → synp → colors@^1.4.0`. Reasons and details: [issues/218](https://github.com/antongolub/yarn-audit-fix/issues/218), [snykvuln/2331906](https://security.snyk.io/vuln/SNYK-JS-COLORS-2331906).  \nHow to fix? There are 3 ways:\n* Update yarn-audit-fix to `\u003e=9.0.5`\n* Pin `colors` version in your lockfile to `1.4.0`\n* Reinstall yarn-audit-fix. It looks like npm has already removed the vulnerable versions of `colors` from the registry, 2022-01-11.\n\n### yarn-audit-fix version x.x.x is out of date\n```\nnpm_config_yes=true npx yarn-audit-fix --audit-level=moderate\nRuntime digest\nyarn-audit-fix version 4.3.6 is out of date. Install the latest 6.0.0 for better results\n```\n**npx** caches previously loaded packages, so you need one of:\n1. Define version to load: `npm yarn-audit-fix@6.0.0`\n2. Reset npx cache. For Mac/Linux: `rm -rf ~/.npm/_npx`\n\n### yarn-audit-fix command not found\nAfter installation, the package may not be found. This is probably an issue with $PATH finding `node_modules/.bin` contents or smth like that ([npm/issues/957](https://github.com/npm/npm/issues/957)).\nA bit annoying, but it's easy to handle in several ways.\n* You're able to run the cmd through **yarn**: `yarn yarn-audit-fix`.\n* Simply invoke `node_modules/.bin/yarn-audit-fix` script.\n\n### enoent: no such file or directory\nIn some cases **npm audit fix** makes `node_modules` to become inconsistent. This is expected. **yarn** and **npm** organize the directory space slightly differently.\n```\nnpm WARN rm not removing /Users/antongolub/projects/queuefy/node_modules/.cache/yarn-audit-fix/node_modules/npm/node_modules/.bin/node-gyp as it wasn't installed by /Users/antongolub/projects/queuefy/node_modules/.cache/yarn-audit-fix/node_modules/npm/node_modules/node-gyp\nnpm WARN rm not removing /Users/antongolub/projects/queuefy/node_modules/.cache/yarn-audit-fix/node_modules/npm/node_modules/.bin/uuid as it wasn't installed by /Users/antongolub/projects/queuefy/node_modules/.cache/yarn-audit-fix/node_modules/npm/node_modules/uuid\nnpm ERR! code ENOENT\nnpm ERR! syscall chmod\nnpm ERR! path /Users/antongolub/projects/queuefy/node_modules/.cache/yarn-audit-fix/node_modules/@qiwi/libdefkit/node_modules/flowgen/lib/cli/index.js\nnpm ERR! errno -2\nnpm ERR! enoent ENOENT: no such file or directory, chmod '/Users/antongolub/projects/queuefy/node_modules/.cache/yarn-audit-fix/node_modules/@qiwi/libdefkit/node_modules/flowgen/lib/cli/index.js'\nnpm ERR! enoent This is related to npm not being able to find a file.\nnpm ERR! enoent \nnpm ERR!     /Users/antongolub/.npm/_logs/2020-08-23T07_09_26_924Z-debug.log\n{\n  status: 254,\n  signal: null,\n  output: [ null, null, null ]\n```\nLet's try this workaround:\n1. Restore the original `node_modules` state. `yarn --force` or `rm-rf node_modules \u0026\u0026 yarn`.\n2. Apply `npx yarn-audit-fix --package-lock-only`. The last param should instruct **npm** not to modify `node_modules` contents.\n\n### --force did not force the update\nThe problem only concerns repositories with `workspaces` (monorepos). \n`npm audit fix --force` throws 1 status code and suggests running `npm audit fix --force`. This quite ironic behaviour is exactly what **npm** (arborist) [does now](https://github.com/npm/arborist/blob/5b550501f50d6489d7e5f7598a97a5cf4cc5cc8a/lib/arborist/build-ideal-tree.js#L373). \n```\n$$ yarn-audit-fix --force          \n Preparing temp assets...\n Generating package-lock.json from yarn.lock...\n Applying npm audit fix...\n invoke /home/qwelias/.nvm/versions/node/v12.18.1/lib/node_modules/yarn-audit-fix/node_modules/.bin/npm audit fix --package-lock-only --force --prefix=/home/qwelias/prj/stuff/test-yarn-audit-fix/node_modules/.cache/yarn-audit-fix\n npm WARN using --force Recommended protections disabled.\n npm WARN audit Updating lodash to 4.17.20,which is outside your stated dependency range.\n npm WARN audit Manual fix required in linked project at ./packages/bar for lodash@\u003c=4.17.18.\n npm WARN audit 'cd ./packages/bar' and run 'npm audit' for details.\n npm WARN audit Manual fix required in linked project at ./packages/foo for lodash@\u003c=4.17.18.\n npm WARN audit 'cd ./packages/foo' and run 'npm audit' for details.\n \n up to date, audited 7 packages in 2s\n \n # npm audit report\n \n lodash  \u003c=4.17.18\n Severity: high\n Prototype Pollution - https://npmjs.com/advisories/782\n Prototype Pollution - https://npmjs.com/advisories/1065\n fix available via `npm audit fix --force`\n Will install lodash@4.17.20, which is outside the stated dependency range\n packages/bar/node_modules/lodash\n packages/foo/node_modules/lodash\n \n 1 high severity vulnerability\n \n To address all issues, run:\n   npm audit fix --force\n {\n   status: 1,\n   signal: null,\n   output: [ null, null, null ],\n   pid: 176019,\n   stdout: null,\n   stderr: null\n }\n```\nSo you need, as the message says, to manually change the dependency versions. **npm@7** ~~is still in beta~~, perhaps this logic will be changed later.\nIn some cases **npm@6** works better, so if you have such a version installed on your system, you may try:\n```shell\nnpx yarn-audit-fix --npm-path=system --flow=convert\n```\nYou may also try to cast _the optimistic flags combo_\n```shell\nnpx yarn-audit-fix --package-lock-only=false --force --legacy-peer-deps --flow=convert\n```\nUnfortunately, even this invocation may return something like:\n```shell\n# npm audit report\n\nhosted-git-info  \u003c3.0.8\nSeverity: moderate\nRegular Expression Deinal of Service - https://npmjs.com/advisories/1677\nNo fix available\nnode_modules/normalize-package-data/node_modules/hosted-git-info\n  normalize-package-data  2.0.0 - 2.5.0\n  Depends on vulnerable versions of hosted-git-info\n  node_modules/normalize-package-data\n    meow  3.4.0 - 9.0.0\n    Depends on vulnerable versions of normalize-package-data\n    Depends on vulnerable versions of read-pkg-up\n```\n**No fix available** just means that no fix available. If you still doubt the correctness of the output, you can check it by hand.\n```shell\nnpm i --package-lock-only\nnpm audit fix --package-lock-only --force\n```\n\nSame response for alternative patching flow:\n```shell\nnpm_config_yes=true npx yarn-audit-fix --audit-level=moderate --flow=patch\n```\n```shell\nPatching yarn.lock with audit data...\ninvoke yarn audit --json --level moderate\nCan't find patched version that satisfies postcss@^7.0.0 in \u003e=8.2.10\nCan't find patched version that satisfies postcss@^7.0.1 in \u003e=8.2.10\nCan't find patched version that satisfies postcss@^7.0.27 in \u003e=8.2.10\nCan't find patched version that satisfies ws@^7.2.3 in \u003e=6.2.2 \u003c7.0.0 || \u003e=7.4.6\nUpgraded deps: \u003cnone\u003e\ninvoke yarn --update-checksums\n```\nNot everything can be repaired, alack.\n\n### Cannot install package despite being on correct node version\nyarn-audit-fix is compatible with any NodeJS version which supports ESM, but the nested packages can define their own engine requirements.\n```shell\npkg-dir@7.0.0: The engine \"node\" is incompatible with this module. Expected version \"\u003e=14.16\". Got \"14.15.1\"\n```\n\nThe _recommended_ way is to update the runtime version. As a temporary workaround, you can simply pass `--ignore-engines` flag.\n```shell\nyarn add yarn-audit-fix -D --ignore-engines\n```\n\n### Response Code: 400 (Bad Request)\n\nIn some cases **yarn npm audit** fails because the `yarn.lock` file contains a transitive dependency in unreadable format:\n```\n  'example-dependency': 'npm:example-dependency@1.0.0'\n```\n\nThis will results in:\n```shell\ninvoke yarn npm audit --all --json --recursive\n➤ YN0035: Bad Request\n➤ YN0035:   Response Code: 400 (Bad Request)\n➤ YN0035:   Request Method: POST\n➤ YN0035:   Request URL: https://registry.yarnpkg.com/-/npm/v1/security/audits/quick\n```\nhttps://github.com/yarnpkg/berry/issues/4117\n\nA workaround is available using the `exclude` option:\n1. Update project **yarn** to \u003e=3.3.0 (lower version doesn't support this parameter for **yarn npm audit**).\n2. Apply `npx yarn-audit-fix --exclude example-dependency`. This will cause **yarn** to ignore `example-dependency` while creating the audit report.\n\n## Contributing\nFeel free to open any issues: bugs, feature requests or other questions.\nYou're always welcome to suggest a PR. Just fork this repo, write some code, add some tests and push your changes.\nAny feedback is appreciated.\n\n## License\n[MIT](./LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fantongolub%2Fyarn-audit-fix","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fantongolub%2Fyarn-audit-fix","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fantongolub%2Fyarn-audit-fix/lists"}