package.json中如何使用override更新子依赖

Question

I am seeing a vulnarability in async and want to update it to 3.2.2 This is the dependency tree if i do npm list async

└─┬ webpack-dev-server@4.8.1
  └─┬ portfinder@1.0.28
    └── async@2.6.4

So looking at the npmdocs I tried to add override in package.json as follows.

{
  "name": "some application",
  "scripts": {...},
  "dependencies": {...},
  "overrides": {
    "webpack-dev-server": {
      "portfinder": {
        "async": "3.2.2"
      }
    }
  },
  "devDependencies": {...}
}

But when I do npm install it didn't update async version to 3.2.2 and still shows older version in pacakge-lock.json. I removed webpack-dev-server package from devDependencies but after running npm install I get empty on npm list async

└── (empty)

Any idea what am i doing wrong?

Answer 1

You need to use NPM version 8.3.0 OR above for "override" to work. you may check the below github issue for more info,

https://github.com/npm/cli/issues/4232

Answer 2

You've got it backwards ... you specify which dependency you want to override the version of (eg async ), then provide the version or list of parents and their versions, so it's like this:

  "overrides": {
     "async": "3.2.2"
  },

OR if being specific:

  "overrides": {
    "async": {
      "portfinder": "3.2.2"
    }
  },