OA011: Exceeds Declared Range

Severity: medium  ·  Auto-fix: no (suggest-only)

An override floor is a range - ^X or >=X, optionally capped with <Y. Once an override is in place it wins dependency resolution outright, so the resolver picks the highest version the override's range admits regardless of what any individual parent's own package.json declares. A floor with no ceiling, or a ceiling set above every parent's own major, quietly authorizes the resolver to cross a major boundary nothing in the project actually asked for.

OA009 asks whether a floor is already redundant - met by every parent, safe to remove. OA011 asks the opposite: can the floor resolve to something no parent permits at all.

---

Example

{
  "pnpm": {
    "overrides": {
      "@hono/node-server": ">=1.19.13"
    }
  }
}

This is the motivating real-world case, from CopilotKit/CopilotKit:

• The root pnpm.overrides entry floors @hono/node-server to >=1.19.13 - no ceiling.
• Ten manifests across the repo declare the package, all on the 1.x line: packages/runtime (^1.13.5), several examples/* workspaces (^1.13.6, ^1.13.7, ^1.13.8, ^1.14.0).
• Not one of them permits 2.x.
• pnpm-lock.yaml on main resolved @hono/node-server@2.0.0 anyway - the override's unbounded floor let it happen.
• A maintainer found this by reading manifests by hand during review (CopilotKit#7167).

OA011 flags the entry and names the gap: nothing that depends on the package asked for major 2.

Contrast with a floor that stays inside what its parent already permits - this does not fire:

{
  "pnpm": {
    "overrides": {
      "hono": ">=4.13.5 <5"
    }
  }
}

packages/runtime declares hono as ^4.11.4 - major 4, matching the override's <5 ceiling exactly. The override cannot resolve above what the parent already allows.

---

Terminal output

MEDIUM (1)

Rule	Package	Message
OA011	@hono/node-server	Override floor exceeds every declaring package's range package.json > /pnpm/overrides/@hono/node-server

cve-lite . overrides --rule OA011

---

Scope

OA011 evaluates the same floor shapes as OA009 and OA010:

Pattern	Handled by
">=1.19.13" (unbounded floor)	OA011
"^1.13.5" (caret range)	OA011
">=4.13.5 <5" (range floor and ceiling)	OA011
"1.13.5" (exact pin)	OA004 / OA008
"~1.13.5" (tilde)	out of scope, same as OA009
"latest", "workspace:*", "file:../x", "link:../x"	not a floor

OA011 also requires at least one parent declaration for the package - an orphaned override (nothing depends on it) is OA001's territory, not this rule's.

When any parent's declared range can't be reduced to a single major (an unrecognized shape), OA011 stays silent for that package entirely rather than risk asserting an overlap that might exist.

---

Fix

There is no auto-fix. --fix will not touch an OA011 finding - the correct resolution is one of two judgement calls only a maintainer can make:

1. Lower the override to stay within the major every parent already declares.
2. Raise the declaring package(s) if the newer major is genuinely intended - once every parent permits it, the finding clears on its own (and the override may then become OA009's territory: redundant).

---

Known limitation

parentDeclarations is built from the root manifest plus an installed node_modules walk. It does not yet read workspace member manifests directly, so on an uninstalled monorepo a member's own declaration can be invisible to the audit, and OA011 will not fire on the case it exists to catch. This is the same gap OA009 documents, and it closes as workspace-aware declaration resolution lands.

---

Complementary rules

Rule	Question
OA009	Is this floor redundant, already met by every parent?
OA011	Can this floor resolve above what every parent permits?
OA010	Is the range this floor admits safe (no known vulnerability inside it)? (also requires --check-network)
OA006	Does this override fight a parent's exact pin?