Pin Transitive Dependencies with Overrides
Identify a vulnerable transitive package, add a pnpm override or npm resolution that forces a safe version, and verify the lockfile no longer contains the bad release.
Task
Force a vulnerable transitive dependency to a patched version without waiting for the direct dependency to release an update.
When to use this
A CVE in ansi-regex 5.0.0 reaches the app through three layers of transitive deps. The direct maintainer will not ship a fix for weeks. The team needs the vulnerable version out of the lockfile now.
Prerequisites
- pnpm 9 or npm 10 with overrides support
- A lockfile committed to the repo
- The patched version number of the vulnerable package
Steps
1. Find every path in the dependency tree that pulls in the vulnerable version.
pnpm why [email protected]Expected output: A list of dependency paths from the root to ansi-regex 5.0.0, showing which direct packages introduce it.
2. Add an override that forces the patched version for every consumer.
// package.json
"pnpm": {
"overrides": { "[email protected]": "5.0.1" }
}
Expected output: A fresh pnpm install resolves every ansi-regex 5.0.0 to 5.0.1, and pnpm why ansi-regex shows only the patched version.
3. Re-run the audit to confirm the CVE no longer appears in the report.
pnpm audit --prodExpected output: The audit report has zero high or critical findings for ansi-regex, and the override is recorded in the lockfile.
Troubleshooting
Problem
The override breaks a direct dependency that relied on the old behavior
Solution
Run the test suite after the override and, on failure, narrow the override to the specific parent package rather than applying it globally.
Problem
npm overrides syntax differs from pnpm
Solution
Use the overrides field under the package manager you actually use; the npm form lives at the top level of package.json, the pnpm form under a pnpm key.
Limitations
- An override pins the version but does not backport the fix to a different major; a breaking change in the patched release can still break consumers.
- The override must be removed once the direct dependency ships a fix, or it becomes hidden technical debt.
Find the path, then cut it
A transitive vulnerability reaches you through a chain of dependencies. Use pnpm why to see the chain, then add an override that forces the patched version for every consumer in the tree.
{
"pnpm": {
"overrides": { "[email protected]": "5.0.1" }
}
}Verify and audit
Reinstall, confirm pnpm why shows only the patched version, and re-run the audit. The override is recorded in the lockfile, so every install from now on gets the safe version without further action.
pnpm install && pnpm why ansi-regex && pnpm audit --prodExpected outcome
The lockfile contains no copy of the vulnerable version, the audit is clean for that package, and the tests still pass. Remove the override once the direct dependency ships a fix, so it does not become hidden debt.