taopaic/Yarn CVE Auto-Upgrade

Automatically upgrades yarn packages to resolve CVE vulnerabilities, commits the yarn.lock changes to a new branch, and opens a pull request.

Trust Signals

name	description	required	default
module_list	Comma-separated list of npm module names to upgrade (e.g. "lodash,axios"). If omitted, the action runs `yarn npm audit` to discover vulnerable packages automatically.	no	""
workdir	Working directory in which to run yarn and git commands. Defaults to the repository root.	no	""
base_branch	Target branch for the pull request. Defaults to the branch the action is running on when left empty.	no	""
pr_prefix	Prefix used in the pull request title (e.g. "CHORE", "fix", "deps").	no	CHORE
labels	Comma-separated list of labels to apply to the pull request (e.g. "dependencies,security"). Leave empty to add no labels.	no	""
npmMinimalAgeGate	Minimum package publish age required before a version is accepted. Accepts a plain number or a number with a time unit suffix (ms, s, m, h, d, w) — e.g. "72h" or "3d". Only applies to Yarn Berry (v2+); has no effect on Yarn v1. Leave empty to skip setting this value.	no	""
severity	Minimum severity level to include in the audit. When set, limits the audit to vulnerabilities of the corresponding severity and above. Valid values are `info`, `low`, `moderate`, `high`, `critical`. Leave empty to report all severities.	no	""
github_token	GitHub token used to create the pull request. Typically `secrets.GITHUB_TOKEN`.	yes	—

name	description
report	Human-readable upgrade summary listing which modules were upgraded, left unchanged, or failed.
pr_url	URL of the pull request created with the yarn.lock changes. Empty if no modules were upgraded.