Editing npm dependencies

Pin a sealed version in package.json, including npm overrides for transitive dependencies.

Direct dependencies

The npm manifest is package.json. Replace the version range with the sealed version:

 "dependencies": {
-  "ejs": "2.7.4",
+  "ejs": "2.7.4-sp1",
   ...
 }

Run npm install (or npm ci against a refreshed lockfile) and the build pulls ejs@2.7.4-sp1 from npm.sealsecurity.io instead of ejs@2.7.4 from the public registry.

Transitive dependencies (overrides)

When the vulnerable package is brought in indirectly by another dependency, editing your own dependencies section does not help: the depending package still asks for the vulnerable version. Use npm's overrides feature in package.json to force the resolved version. Each sealed version is fully compatible with its specific origin version only, so the override has to be version-specific: pair the origin version with its sealed counterpart, leaving other versions of the same package untouched.

{
  "overrides": {
    "ejs@2.7.4": "2.7.4-sp1"
  }
}

This only overrides when the resolved version would be 2.7.4. If another path in the dependency graph asks for ejs@4.0.0, the override does not touch it.

To scope an override even more tightly (only when the package is reached through a particular parent), use the nested form:

{
  "overrides": {
    "some-framework": {
      "ejs@2.7.4": "2.7.4-sp1"
    }
  }
}

Related

• Configuring npm: the package-manager setup that points npm at the Seal Artifact Server.