Skip to content

Conversation

@remypar5
Copy link

What's the problem this PR addresses?

Allowing users to specify a version or range for yarn why to find out why a specific version appears in the dependency tree. This is particularly useful if you want to address CVEs.

Closes #6859

How did you fix it?

  • Check if a version/range is specified and handling it accordingly
  • For both simple and recursive mode

Checklist

  • I have set the packages that need to be released for my changes to be effective.
  • I will check that all automated PR checks pass before the PR gets reviewed.

Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com>
Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com>
@remypar5
Copy link
Author

@arcanis are you available to review this? You refactored yarn why some time ago

Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com>
Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com>
Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com>
Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com>
@remypar5 remypar5 requested a review from clemyan January 6, 2026 15:39
Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com>
Comment on lines +190 to +193
// We don't want to print the full path if it doesn't transitively depend on targetPkg.range
if (structUtils.areIdentsEqual(pkg, targetPkg) && !structUtils.isPackageInRange(pkg, targetPkg.range))
return;

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this can also be removed? dependents already only contains packages that transitively depend on the specified name and range. Again, not sure if I'm missing an edge case

@clemyan clemyan dismissed their stale review January 19, 2026 16:51

Requested changes have been made

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature] yarn why for specific package version

2 participants