BLEnder's alert remediation only knows npm. JS alerts (Dependabot ecosystem npm_and_yarn) are mapped to npm (ECOSYSTEM_MAP in automerge_dependabot.py) and routed to action=npm_bump, whose only mechanism is:
npm audit fix --package-lock-only
That rewrites package-lock.json. yarn/pnpm repos don't have one, so on those repos remediation does nothing.
Since #119, the step skips gracefully instead of erroring (no more re-investigation loop) — but "skip" means the alert is never actually fixed. So on a yarn repo like mozilla/fxa, BLEnder can investigate, dismiss unaffected low/medium, and open advisories for affected alerts, but it cannot bump a yarn dependency.
Feature request
A yarn remediation path parallel to the existing npm and pip paths:
- direct deps: bump in
package.json + regenerate yarn.lock
- transitive deps:
resolutions (yarn) / overrides override + lockfile regen
- ideally pnpm too (
pnpm.overrides)
Detect the package manager from the lockfile present and dispatch accordingly.
BLEnder's alert remediation only knows npm. JS alerts (Dependabot ecosystem
npm_and_yarn) are mapped tonpm(ECOSYSTEM_MAPinautomerge_dependabot.py) and routed toaction=npm_bump, whose only mechanism is:That rewrites
package-lock.json. yarn/pnpm repos don't have one, so on those repos remediation does nothing.Since #119, the step skips gracefully instead of erroring (no more re-investigation loop) — but "skip" means the alert is never actually fixed. So on a yarn repo like mozilla/fxa, BLEnder can investigate, dismiss unaffected low/medium, and open advisories for affected alerts, but it cannot bump a yarn dependency.
Feature request
A yarn remediation path parallel to the existing npm and pip paths:
package.json+ regenerateyarn.lockresolutions(yarn) /overridesoverride + lockfile regenpnpm.overrides)Detect the package manager from the lockfile present and dispatch accordingly.