yarn audit

yarn audit --level high

Analyze project dependencies with yarn audit, detecting known vulnerabilities with the manager's severity gate.

Run it in the pipeline of projects using yarn when you want the manager's native dependency analysis: yarn audit queries the advisory database with the dependency tree and reports findings — packages with vulnerabilities and severity, with --level for the gate. It's the SCA of the yarn ecosystem: the pipeline check with the team's manager. In Node/yarn DevSecOps, yarn audit is the pipeline filter: a high severity finding (--level high) blocks the merge.

Don't use it as a complete analysis: yarn audit covers the database advisories — code and runtime vulnerabilities are out of scope. The database is updated: new CVEs require re-scanning. And beware: yarn audit's fix (yarn upgrade) updates dependencies — in pinned projects, breaking changes must be reviewed. For commercial coverage (with reachability), Snyk (019); yarn audit is the native manager check (like npm audit for npm, 020).