My software application contains a vulnerability related to a package that has different versions available (1.x, 2.x, 3.x). Since many other packages rely on this particular one as a dependency, updating each one individually is not a viable solution at the moment. I am considering using yarn resolutions
, but some packages have the version 1.x as a dependency while others require 2.x. If I try to force a resolution to 2.x, it might cause conflicts with those relying on 1.x.
Is there a way for yarn resolutions to handle multiple versions of a package? For example:
"resolutions": {
"foo": "~1.0.5 || ~2.0.5",
}
If that's not possible, what alternative options are available?