Cypress: [Security] issues with linting yarn-lock after updating cypress to 4.2.0 with lockfile-lint

[JustFly1984]

Our build pipeline lint yarn.lock file for security issues.

We have allowed only yarn as dependency source, and getting next error at build time:

yarn run v1.22.4
$ lockfile-lint --path yarn.lock --allowed-hosts yarn --validate-https
detected invalid host(s) for package: request@cypress-io/request#b5af0d1fa47eec97ba980cde90a13e69a2afcd16
    expected: registry.yarnpkg.com
    actual: codeload.github.com

error: command failed with exit code 1 

error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
##[error]Process completed with exit code 1.

can you please confirm that it is a safe and intended change in source?

meanwhile downgrading cypress to 4.1.0

[JustFly1984]

https://github.com/lirantal/lockfile-lint/issues/79

[lencioni]

I think this was fixed in https://github.com/cypress-io/cypress/pull/6777 but that change has not been published yet.

[jennifer-shehane]

Duplicate of #6752

[lirantal]

@jennifer-shehane perhaps consider adding lockfile-lint to this repo as well to set a security policy for cypress's nested dependencies and avoid it in the future? why it's important

/plug :-)

[jennifer-shehane]

@lirantal Yeah this is pretty interesting. Will take a look.

[lirantal]

@jennifer-shehane cool. I'm happy to assist if there's anything to help with.