diff --git a/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/core-js/.snyk b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/core-js/.snyk
new file mode 100644
index 0000000000000..e8c2e3f5cd66b
--- /dev/null
+++ b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/core-js/.snyk
@@ -0,0 +1,20 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.1
+ignore: {}
+# patches apply the minimum changes required to fix a vulnerability
+patch:
+  'npm:debug:20170905':
+    - promises-aplus-tests > mocha > debug:
+        patched: '2024-10-21T16:23:19.857Z'
+        id: 'npm:debug:20170905'
+        path: promises-aplus-tests > mocha > debug
+  'npm:minimatch:20160620':
+    - promises-aplus-tests > mocha > glob > minimatch:
+        patched: '2024-10-21T16:23:19.857Z'
+        id: 'npm:minimatch:20160620'
+        path: promises-aplus-tests > mocha > glob > minimatch
+  'npm:ms:20170412':
+    - promises-aplus-tests > mocha > debug > ms:
+        patched: '2024-10-21T16:23:19.857Z'
+        id: 'npm:ms:20170412'
+        path: promises-aplus-tests > mocha > debug > ms
diff --git a/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/core-js/package.json b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/core-js/package.json
index e5760f4540682..9d7406304bd8e 100644
--- a/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/core-js/package.json
+++ b/workspaces/arborist/test/fixtures/tap-with-yarn-lock/node_modules/core-js/package.json
@@ -10,17 +10,17 @@
   "devDependencies": {
     "LiveScript": "1.3.x",
     "es-observable-tests": "0.2.x",
-    "eslint": "4.19.x",
+    "eslint": "9.0.0",
     "eslint-plugin-import": "2.12.x",
     "grunt": "^1.0.2",
     "grunt-cli": "^1.2.0",
     "grunt-contrib-clean": "^1.1.0",
     "grunt-contrib-copy": "^1.0.0",
-    "grunt-contrib-uglify": "3.3.x",
+    "grunt-contrib-uglify": "5.2.1",
     "grunt-contrib-watch": "^1.0.0",
-    "grunt-karma": "^2.0.0",
+    "grunt-karma": "^3.0.0",
     "grunt-livescript": "0.6.x",
-    "karma": "^2.0.0",
+    "karma": "^6.4.3",
     "karma-qunit": "^2.1.0",
     "karma-chrome-launcher": "^2.2.0",
     "karma-firefox-launcher": "^1.0.1",
@@ -28,9 +28,9 @@
     "karma-phantomjs-launcher": "1.0.x",
     "phantomjs-prebuilt": "2.1.x",
     "promises-aplus-tests": "^2.1.2",
-    "qunit": "2.6.x",
+    "qunit": "2.9.0",
     "temp": "^0.8.3",
-    "webpack": "^3.11.0"
+    "webpack": "^5.94.0"
   },
   "scripts": {
     "grunt": "grunt",
@@ -38,7 +38,9 @@
     "promises-tests": "promises-aplus-tests tests/promises-aplus/adapter",
     "observables-tests": "node tests/observables/adapter && node tests/observables/adapter-library",
     "test": "npm run grunt clean copy && npm run lint && npm run grunt livescript client karma:default && npm run grunt library karma:library && npm run promises-tests && npm run observables-tests && lsc tests/commonjs",
-    "postinstall": "node scripts/postinstall || echo \"ignore\""
+    "postinstall": "node scripts/postinstall || echo \"ignore\"",
+    "prepublish": "npm run snyk-protect",
+    "snyk-protect": "snyk-protect"
   },
   "license": "MIT",
   "keywords": [
@@ -69,5 +71,9 @@
     "Dict",
     "polyfill",
     "shim"
-  ]
+  ],
+  "snyk": true,
+  "dependencies": {
+    "@snyk/protect": "latest"
+  }
 }