yarn.lock with Bomdesk
This opens a small Yarn classic lockfile. Press Scan to add licences and known advisories to every package, then download the SBOM or the CSV licence table.
- Paste yarn.lock or drop the file.
- Press Scan to look up licences and advisories.
- Download the SBOM or the CSV licence table.
- Compare against last release's lockfile in the Compare tab (Pro).
What to know
Yarn classic (v1) and Yarn Berry (2 and later) write different files. Classic lists entries such as lodash@^4.17.15 with a version line; Berry quotes each entry and adds a resolution such as lodash@npm:4.17.21. Bomdesk reads both, keeps the real package name when a Berry entry uses an alias, and skips workspace and portal entries because they are your own code.
yarn.lock holds neither licences nor the direct/dev split. Licences come from the lookup, and the direct and dev counts are left out instead of guessed. On a test project the classic file produced 250 packages and every one was present in node_modules; the Berry file produced 270 and matched its resolution lines one for one.
If you need to know which packages are direct, check package.json: those names are the ones to review first. The Berry parser also reads the real name of an aliased package from its resolution line, so an npm: alias is listed under the package it points to.
Updated · Cosmovex
Questions
Does it read Yarn Berry lockfiles?
Yes. The __metadata block marks a Berry file.
Why are licences empty before I press Scan?
yarn.lock does not store them. The lookup fetches them from deps.dev by name and version.
Are patched or aliased packages handled?
Aliases are read by their real name. Packages resolved from a local workspace, portal or file path are skipped.
Can it tell me which packages are dev-only?
Not from yarn.lock alone, because the file does not record it. Use package.json for that split.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
