<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">This issue exists in the latest npm version</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I am using the latest npm</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">Override replaces some but not all instances of overriden dependency. In this example, I have a dependency on a package which has a dependency on <code class="notranslate">npm</code> which contains a vulnerable version of <code class="notranslate">ansi-regex</code>. I tried to fix this via an override but <code class="notranslate">npm audit</code> still complains and searching through package-lock.json shows various version numbers before my overriden value.</p>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">According to docs, <code class="notranslate">overrides</code> should ensure all installed instances of a dependency conform to the given value so I expect my override version 5.0.1 only to exist.</p>
<h3 dir="auto">Steps To Reproduce</h3>
<ol dir="auto">
<li>Clone <a href="https://github.com/melink14/rikaikun">https://github.com/melink14/rikaikun</a></li>
<li>Modify package.json with:</li>
</ol>
<div class="highlight highlight-source-json notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="&quot;overrides&quot;: {
    &quot;ansi-regex&quot;: &quot;5.0.1&quot;,
  },"><pre class="notranslate"><span class="pl-ent">"overrides"</span>: {
    <span class="pl-ent">"ansi-regex"</span>: <span class="pl-s"><span class="pl-pds">"</span>5.0.1<span class="pl-pds">"</span></span>,
  },</pre></div>
<ol start="3" dir="auto">
<li>Delete package-lock.json and run <code class="notranslate">npm install</code></li>
<li>Run <code class="notranslate">npm audit</code> and see that vulnerable older versions of <code class="notranslate">ansi-regex</code> still exist..</li>
</ol>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>npm: 8.3.2</li>
<li>Node.js: 16</li>
<li>OS Name: WSL Pengwin</li>
<li>System Model Name:</li>
<li>npm config:</li>
</ul>
<div class="highlight highlight-source-ini notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="; node bin location = /home/espeed/n/bin/node
; cwd = /home/espeed/projects/rikaikun
; HOME = /home/espeed
; Run `npm config ls -l` to show all defaults."><pre class="notranslate"><span class="pl-c"><span class="pl-c">;</span> node bin location = /home/espeed/n/bin/node</span>
<span class="pl-c"><span class="pl-c">;</span> cwd = /home/espeed/projects/rikaikun</span>
<span class="pl-c"><span class="pl-c">;</span> HOME = /home/espeed</span>
<span class="pl-c"><span class="pl-c">;</span> Run `npm config ls -l` to show all defaults.</span></pre></div>
<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">This issue exists in the latest npm version</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I am using the latest npm</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">After updating the overrides, <code class="notranslate">npm install</code> is not updating the <code class="notranslate">package.lock</code> or <code class="notranslate">node_modules</code>.</p>
<p dir="auto">To make it work I had to remove both <code class="notranslate">package.lock</code> and <code class="notranslate">node_modules</code>, then the overrides have been applied.</p>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">Change in <code class="notranslate">overrides</code> should update <code class="notranslate">package.lock</code> and <code class="notranslate">node_modules</code> after running <code class="notranslate">npm install</code></p>
<h3 dir="auto">Steps To Reproduce</h3>
<ol dir="auto">
<li>Add a dependency</li>
<li>npm install</li>
<li>Add override</li>
<li>npm install</li>
</ol>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>npm: &gt;=8.3.0</li>
<li>Node.js: 16.13.2</li>
<li>OS Name: macOS 12</li>
<li>System Model Name:</li>
<li>npm config:</li>
</ul>
<div class="highlight highlight-source-ini notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="; copy and paste output from `npm config ls` here"><pre class="notranslate"><span class="pl-c"><span class="pl-c">;</span> copy and paste output from `npm config ls` here</span></pre></div>