Kit readyA few weeks
Security & privacy · Anywhere
Yarn users can't block a package update that suddenly arrives without the provenance its earlier versions had.
Solved looks like
A Yarn plugin or patch that, at install time, fails with a clear message when a package that had provenance in earlier versions resolves to a version without it. Tested against a local test registry with a downgrade case and a never-had-provenance case.
Proof2 sources · 3 quoted claims · github.com/axios, github.com/yarnpkg · Apr 2026
Market59 reactions on the issue
Kit5 steps · 21 tools · starter prompt ready
- Sourced (done)
- Kit (done)
- Wanted (next)
- Building
- Solved
Be the first to want this solved. Nobody is building it yet.