---
name: Vulnerability fix strategy — upgrade first, resolve last
description: When fixing npm vulnerabilities, always try upgrading the direct dependency that brings in the vulnerable package before adding a yarn resolution
type: feedback
---

Always try upgrading the direct dependency that pulls in a vulnerable package before adding a `resolutions` entry. Only add a resolution if no direct upgrade path exists.

**Why:** Resolutions are a blunt tool — they override all installs globally and can mask whether the real source was fixed. Upgrading the direct dep is cleaner, more maintainable, and makes the dependency tree more accurate.

**How to apply:** For each vulnerability, run `yarn why <package>` to find the chain. If the top-level package in the chain is a direct dep, try bumping it first. Only fall back to a resolution if the top-level dep can't be upgraded (e.g. no newer version, major breaking change, or it's a `@theorchard` internal package).