NPM how to update/upgrade transitive dependencies?

Question

I am using express v4.16.4 in my node server.

It has pulled in cookie-signature v1.0.6.

I want to upgrade cookie-signature to v1.1.0 as it has a fix which I require. What is the way to do that ?

I don't think i should do a npm install cookie-signature@1.1.0 as it would list cookie-signature in my app dependencies.

EDIT: this discusses the exact same problem that i am looking to solve. The accepted answer is using npm-shrinkwrap, and another top voted answer using package-lock.json , but both of these seem to have issues as discussed in respective comments.

Happy to close this as a duplicate.

user_6418426 · Answer

You might also be able to solve the issue by adding a resolutions key in the package.json to "enforce" certain versions of dependencies:

{
  "resolutions": {
    "cookie-signature": "^1.1.0"
  }
}

To actually make use of that, you have to use npm-force-resolutions in preinstall:

"scripts": {
  "preinstall": "npx npm-force-resolutions"
}

See this post for further information: https://itnext.io/fixing-security-vulnerabilities-in-npm-dependencies-in-less-than-3-mins-a53af735261d

user_1043288 · Answer

NPM 8 introduced "overrides" which allows you to override specific transitive dependencies of your direct dependency. For your usecase, you would declare something like below in your package.json.

{
  "overrides": {
    "express": {
      "cookie-signature": "1.1.0"
    }
  }
}

More details @ https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides

user_483996 · Answer

We had a very similar problem. Protractor 5.4.2 has a dependency on webdriver-manager@^12.0.6. In package-lock.json webdriver-manager was fixed to 12.1.5. However, we needed 12.1.7 in order to make it work with all the latest chrome versions.

We noticed, that npm would install version 12.1.7 when removing node_modules and package-lock.json, but we did not find a way to automatically update package-lock.json. So these are the steps we took:

Remove node_modules
Remove package-lock.json
Run npm install
Open package-lock.json and copy the webdriver-manager section to another file
Undo (git checkout) all changes in package-lock.json
Copy the saved webdriver-manager part back into package-lock.json
Remove node_modules
Run npm install
Check node_modules/protractor/node_modules/webdriver-manager/package.json that the right version was installed.

I think this workaround should work for express and cookies-signature as well.

NPM how to update/upgrade transitive dependencies?

3 Answers