I have a dependency of a dependency in npm that is vulnerable. I am using the overrides section in package.json to override this with the non-vulnerable version. This seems to be working ok, as npm list -a shows it as overriden. However my security scanner is still complaining because the old package is still on disk, even if it is not being used.
How can I remove the old package completely? npm uninstall does not seem to do do anything. I could just delete the folder, but it feels like that will break things.