Editing pnpm dependencies

Pin a sealed version in package.json, including pnpm.overrides for transitive dependencies.

Direct dependencies

The pnpm manifest is package.json. Replace the version range with the sealed version:

 "dependencies": {
-  "ejs": "2.7.4",
+  "ejs": "2.7.4-sp1",
   ...
 }

Run pnpm install and the build pulls ejs@2.7.4-sp1 from npm.sealsecurity.io instead of ejs@2.7.4 from the public registry.

Transitive dependencies (pnpm.overrides)

pnpm supports overrides under the pnpm key in package.json. Each sealed version is fully compatible with its specific origin version only, so the override has to be version-specific: pair the origin version with its sealed counterpart, leaving other versions of the same package untouched.

{
  "pnpm": {
    "overrides": {
      "ejs@2.7.4": "2.7.4-sp1"
    }
  }
}

This only overrides when the resolved version would be 2.7.4. If another path in the dependency graph asks for ejs@4.0.0, the override does not touch it.

Related

• Configuring pnpm: the package-manager setup that points pnpm at the Seal Artifact Server.

• Editing npm dependencies: the npm equivalent.