Yarn is a bit more sophisticated and has a concept of "resolutions" which would be great for the security use case of forcing a particular version. Even if B an

Yarn is a bit more sophisticated and has a concept of "resolutions" which would be great for the security use case of forcing a particular version. Even if B and C need different major versions, say D@v1-with-security-fix and D@v2-with-security fix, yarn supports that too, since resolutions can be nested. https://yarnpkg.com/lang/en/docs/selective-version-resolutions/ https://yarnpkg.com/lang/en/docs/selective-version-resolutio...