I'm trying to create a "BOM" library that other projects can include, so that dependencies can be managed in a single place.

The BOM library includes a number of libraries, and I need to override some of their dependencies to resolve CVEs. However, I can't figure out how to get those overrides to propagate through to the repos setting this BOM library as a dependency.

I've tried the following:

BOM:

"dependencies": {
  "libraryA": "1.0"
},
"resolutions": {
  "libraryB": "1.5"
}

Running yarn in the BOM repo correctly does not include the original version of libraryB, only the resolutions version.

However, adding BOM as a dependency to a repo and running yarn does not, and installs the original version of libraryB specified by libraryA.

If I instead specify the version I want as an explicit dependency:

BOM:

"dependencies": {
  "libraryA": "1.0",
  "libraryB": "1.5"
}

Then both versions of libraryB are included in the yarn.lock.

How can I force my repo to respect the resolutions specified in the BOM repo?