How do I override nested NPM dependency versions?

Question

I would like to use the grunt-contrib-jasmine NPM package. It has various dependencies. Part of the dependency graph looks like this:

─┬ grunt-c         


        

Answer 1

I had an issue where one of the nested dependency had an npm audit vulnerability, but I still wanted to maintain the parent dependency version. the npm shrinkwrap solution didn't work for me, so what I did to override the nested dependency version:

1. Remove the nested dependency under the 'requires' section in package-lock.json
2. Add the updated dependency under DevDependencies in package.json, so that modules that require it will still be able to access it.
3. npm i