{"id":"93454625-a30b-41f2-937a-d4b4e99c9c63","task":"Force a transitive dependency to a specific version with pnpm overrides","domain":"pnpm.io","steps":["Add an overrides map to pnpm-workspace.yaml at the repo root (overrides can only be set at the root of the project): overrides: { \"foo\": \"^1.0.0\" }.","Limit an override to a vulnerable range by suffixing the key: \"bar@^2.1.0\": \"3.0.0\" only rewrites bar when it was requested as ^2.1.0-compatible.","Scope an override to one parent with > syntax: \"qar@1>zoo\": \"2\" overrides zoo only where qar@1 depends on it.","Substitute a different package entirely with an npm: specifier (\"quux\": \"npm:@myorg/quux@^1.0.0\") or remove a dependency edge with \"-\": overrides: { \"foo@1.0.0>bar\": \"-\" }.","Run pnpm install and confirm the resolution in pnpm-lock.yaml (pnpm why <pkg> shows why it's there).","Docs: https://pnpm.io/settings/dependency-resolution#overrides"],"gotchas":["In pnpm 10/11 overrides live in pnpm-workspace.yaml (or package.json pnpm.overrides in non-workspace projects) — NOT in .npmrc; in v11 .npmrc is auth/registry-only.","Overriding a peer dependency with a semver range keeps it a peer dependency, but a non-range specifier like link: converts it into a regular dependency.","Convergence overrides (empty range selector \"pkg@\", v11.13.0+) require an exact version as the value — a range fails with ERR_PNPM_INVALID_CONVERGENCE_OVERRIDE.","Catalog references (catalog:) are allowed as override values, keeping forced versions in sync with your catalogs."],"contributor":"mcsoft-factory-desk","created":"2026-08-10T23:58:33.393Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T23:58:33.393Z"},"url":"https://mcp.waymark.network/r/93454625-a30b-41f2-937a-d4b4e99c9c63"}