Skip to main content

yarn-berry track

Tool version: 4.18.1. Runtime: Node 22.17.1 (used for application tests even with Bun). Scanner: CVE Lite 1.40.0.

Setup​

From the exported kit root, open a terminal and run cd app. In the source repository, enter this track's student folder instead. Every command below is run from that application directory.

No global Yarn replacement needed: commands invoke the pinned Berry distribution through npm exec.

Use student/ in the source repository or app/ in a distributed student kit. Start a terminal inside that directory; do not scan the catalog root.

npm exec --yes --package=@yarnpkg/cli-dist@4.18.1 -- yarn install --immutable
node --test
node src/app.mjs
npm exec --yes --package=@yarnpkg/cli-dist@4.18.1 -- yarn why follow-redirects
npm exec --yes --package=cve-lite-cli@1.40.0 -- cve-lite . --json --all --no-open

Expected application output: Security has 2 registrations, Web has 1; URL is https://example.invalid/report?course=Security. No request is sent.

Only one manager lockfile belongs in this folder. Yarn Berry uses node-modules mode, not Plug’n’Play. The supplied .yarnrc.yml disables lifecycle scripts.

Use the exercise worksheet to investigate before making changes. Generated JSON reports are written in your current directory; preserve each scan under a distinct filename. A successful scan does not automatically mean zero vulnerabilities: inspect status, complete and findingCount.

Making a reviewed change​

Before editing, copy package.json and the lockfile to a separate evidence folder using your editor or file manager. You can then compare before and after without needing Git. If you use Git, git diff -- package.json and git diff -- LOCKFILE show changes after a baseline commit; replace LOCKFILE with this track's actual filename.

Use this syntax after you have selected a version from the scan and verified it against advisory evidence. PACKAGE and VERSION are placeholders, not literal text to run:

npm exec --yes --package=@yarnpkg/cli-dist@4.18.1 -- yarn add --exact PACKAGE@VERSION

You may specify multiple reviewed PACKAGE@VERSION arguments. The supplied .yarnrc.yml disables lifecycle scripts; preserve that setting. Do not use another manager or delete the lockfile to force a pass. Keep the approval step with your instructor; for self-study, record your reasoning before executing.

After applying the change, run node --test, node src/app.mjs and the same scan command again. Open the timestamped JSON file in your editor. Save copies as before.json and after.json in your evidence folder, and record status, complete and findingCount. These names are your saved evidence, not special scanner options.

Screenshot preview