> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/using-platform/working-with-seal-apps/artifact-server/npm.md).

# Editing npm dependencies

## Direct dependencies

The npm manifest is `package.json`. Replace the version range with the sealed version:

```diff
 "dependencies": {
-  "ejs": "2.7.4",
+  "ejs": "2.7.4-sp1",
   ...
 }
```

Run `npm install` (or `npm ci` against a refreshed lockfile) and the build pulls `ejs@2.7.4-sp1` from `npm.sealsecurity.io` instead of `ejs@2.7.4` from the public registry.

## Transitive dependencies (`overrides`)

When the vulnerable package is brought in indirectly by another dependency, editing your own `dependencies` section does not help: the depending package still asks for the vulnerable version. Use npm's `overrides` feature in `package.json` to force the resolved version. Each sealed version is fully compatible with its specific origin version only, so the override has to be version-specific: pair the origin version with its sealed counterpart, leaving other versions of the same package untouched.

```json
{
  "overrides": {
    "ejs@2.7.4": "2.7.4-sp1"
  }
}
```

This only overrides when the resolved version would be `2.7.4`. If another path in the dependency graph asks for `ejs@4.0.0`, the override does not touch it.

To scope an override even more tightly (only when the package is reached through a particular parent), use the nested form:

```json
{
  "overrides": {
    "some-framework": {
      "ejs@2.7.4": "2.7.4-sp1"
    }
  }
}
```

## Related

* [Configuring npm](/setup-apps-os/artifact-server/configuring-package-managers/npm.md): the package-manager setup that points npm at the Seal Artifact Server.