Yarn Transitive Dependency Overrides Not Considered

Describe the bug

In a yarn based project, we have several transitive dependencies overridden in the resolutions section of our package.json. Only the version of those tranitives specified in that block are installed. Frogbot still reports vulnerabilities based on the versions in the yarn.lock file.

This might be more feature request than bug.

Current behavior

We have a project that uses typed-scss-modules:2.0.1, which has a dependency of postcss:6.0.1. We also have a resolution set for transitive dependencies to use postcss:8.4.31.

When we lock dependencies with yarn, the dependencies still show the versions according to that dependencie's own packaging. However when we install with yarn, it will install the version specified in the resolutions section of the package.json.

Frogbot reports the vulnerabilities in postcss:6.0.1, despite the fact that we have a manual override and are not using that version.

Reproduction steps

Given a package.json:

{
  ...
  "devDependencies": {
    "typed-scss-modules": "~2.0.1",
    ...
  },
  "resolutions": {
    "postcss": "8.4.31",
    ....
  }
}

Frogbot will identify a vulnerable transitive dependency of postcss:6.0.1, despite the overriding resolutions entry.

Expected behavior

I would have expected Frogbot to take overrides into account.

JFrog Frogbot version

2.22.0

Package manager info

yarn, package.json, yarn.lock

Git provider

GitHub

JFrog Frogbot configuration yaml file

No response

Operating system type and version

Linux, ubuntu-latest on GitHub Actions

JFrog Xray version

3.105.4

Start by reproducing the report with the supplied package.json and yarn.lock, using typed-scss-modules and a postcss resolution of 8.4.31. Trace the Yarn dependency scanning entry point and existing tests for transitive vulnerabilities. Done means Frogbot uses the resolved postcss version rather than reporting vulnerabilities for postcss:6.0.1.