manage-resolutions

name	manage-resolutions
description	Audit and clean up the resolutions field in package.json — find orphaned pins, verify which are still needed, and safely remove stale ones. Invoke when asked to "check resolutions", "remove stale pins", "clean up package.json resolutions", or after a CVE fix adds a new resolution override that needs validation.

Manage resolutions in package.json

The resolutions field forces yarn to use a specific version of a package across the entire dependency tree. Resolutions serve two purposes:

1. Version floor — prevent a vulnerable or broken version even if a transitive dep requests it
2. Deduplication anchor — collapse conflicting ranges into one version, reducing bundle size

Static analysis of yarn.lock is not enough to decide whether a resolution is safe to remove — it might look redundant but still be acting as a deduplication anchor across hidden transitive deps. Always test removal.

Quick audit

This project has a built-in check script:

yarn resolutions:check

It reads package.json and yarn.lock and prints each resolution with its status:

• ⚠️ KEEP — overrides older ranges that would resolve to a lower version
• ✅ POSSIBLY REMOVABLE — no older ranges found (but still verify before removing)
• ❓ NOT FOUND IN LOCK — package no longer in the tree (orphan — remove immediately)

Detailed audit (alternative)

If you need more detail than the script provides:

python3 << 'EOF'
import re, json

with open('package.json') as f:
    resolutions = json.load(f).get('resolutions', {})
with open() as f:
    lock = f.read()

 res_key, res_val  sorted(resolutions.items()):
    bare = ( + res_key.split()[1])  res_key.startswith() \
            (res_key.split()[0]    res_key  res_key)

    pattern = rf
    matches = re.findall(pattern, lock)

     not matches:
        (f)
        

     descriptor, version  matches:
        ranges = re.findall(rf, descriptor)
        (f)
EOF