I’m currently using Wiki.js to build a website. I use docker as the primary way of deploying. However, Docker Scout has identified a handful of vulnerabilities in the official image provided by Wiki.js. I did a Trivy scan as well, and it helped to further identify the packages with vulnerabilities, along with the versions which address them.

Since the official image doesn’t work, I decided to fork the github repo in hopes of changing up some of the configuration and rebuilding a new docker image. However, it seems like Wiki.js uses a bunch of libraries which haven’t been updated for years, and they have the older, vulnerable packages as dependencies.

I looked primarily at 2 files, package.json and yarn.lock. package.json lists all the dependencies for wiki.js. The dependencies are also listed in yarn.lock, but inclusive of each libraries own dependencies (or transitive dependencies if that’s the correct term). My understanding is that yarn.lock is automatically managed by yarn and I shouldn’t be manually changing anything within it.

Is there a way to update these packages in the dependencies?