Yarn does not support automatic fix of vulnerabilities (yarnpkg/yarn#7075) so use NPM which does Signed-off-by: Knut Ahlers <knut@ahlers.me>