We are currently getting a vulnerability that is being flagged in our Dockerfile several times - each time that the word ‘yarn’ appears within the Dockerfile.
The recommendation is to append --ignore-scripts to disable the execution of post-install scripts - however - as far as I can tell the --ignore-scripts can only be appended to the yarn install command, not other commands such as apk add yarn or yarn test:coverage
Is this a bug in the scanner itself?
