OA005: Nested Ineffective Override

Severity: low to critical (sub-code dependent) · Auto-fix: partial

npm supports parent-scoped override syntax where the pin applies only along a specific install path:

{
  "overrides": {
    "@esbuild-kit/core-utils": {
      "esbuild": "^0.25.0"
    }
  }
}

This is more surgical than a top-level "esbuild" override, but it is also fragile. OA005 has five sub-codes covering every way a nested override can fail.

Sub-codes

Sub-code	Severity	What it detects
OA005.a	critical	Project uses pnpm or Yarn - nested-object syntax is silently ignored entirely
OA005.b	high	No version in the resolved tree matches the outer parent
OA005.c	high	The inner key is not in the outer parent's dependencies
OA005.d	medium	Inner dep is also installed via another path that the nested pin does not cover
OA005.e	low	Nested form is valid but a top-level override would be more durable. Not raised for a key carrying a version selector

A key may carry a version selector, and it is read as a range. npm accepts "minimatch@3" as well as "minimatch", and 3 is a range rather than an exact version, so a resolved 3.1.2 satisfies it. OA005.b compares the name against the tree and then checks whether any resolved version matches the selector, using lockfile versions so it works without node_modules. Where the answer is unknown, because the selector will not parse or no versions are known, no finding is raised: saying an override is dead tells you to delete protection that works.

A selector is also the npm way of scoping a pin to one copy, which is why OA005.e withholds its flattening suggestion there. Flattening would apply the pin to every copy in the tree, the same reason the suggestion is never made for pnpm's parent>child form.

The most dangerous sub-code: OA005.a

pnpm silently ignores the nested-object override shape entirely. A critical security pin written in npm's nested syntax has no effect in a pnpm project.

{
  "pnpm": {
    "overrides": {
      "@some/parent": {
        "inner-dep": "1.0.0"
      }
    }
  }
}

This looks like a carefully targeted security pin. It does nothing.

Terminal output

CRITICAL (1)
┌───────┬───────────┬────────────────────────────────────────────────────┐
│ Rule  │ Package   │ Message                                            │
├───────┼───────────┼────────────────────────────────────────────────────┤
│ OA005 │ inner-dep │ Nested override syntax is silently ignored by pnpm │
│       │           │ package.json >                                     │
│       │           │ /pnpm/overrides/@some~1parent/inner-dep            │
└───────┴───────────┴────────────────────────────────────────────────────┘
> cve-lite . overrides --fix --rule OA005

Fix

cve-lite . overrides --fix --rule OA005

--fix applies remove patches for OA005.a, OA005.b, and OA005.c. OA005.d and OA005.e are suggest-only - flattening a nested override is a scope decision that requires manual review.

Sub-codes​

The most dangerous sub-code: OA005.a​

Terminal output​

Fix​

Sub-codes

The most dangerous sub-code: OA005.a

Terminal output

Fix