TIL: fix a dev-only Dependabot alert with a pnpm override

Dependabot flagged engine.io below 6.6.10, a denial-of-service issue. I never installed it. It came in through socket.io, and only as a dev dependency.

My first try was the obvious one:

pnpm update engine.io@6.6.10 -r

Nothing moved. socket.io pins engine.io at 6.6.9, so pnpm kept it there.

The fix is an override in package.json, next to the ones I already had:

"pnpm": {
  "overrides": {
    "engine.io@>=6.6.0 <6.6.10": ">=6.6.10"
  }
}

Then reinstall without the frozen lockfile so it can rewrite itself:

pnpm install --no-frozen-lockfile
pnpm why engine.io

pnpm why showed engine.io 6.6.11 under socket.io. The build passed, and GitHub marked the alert fixed with zero open.

Check pnpm why before you trust the alert is gone. The lockfile is the proof, not the green badge.