Override a transitive dependency instead of waiting

The advisory names a package you never installed. pnpm why tar-fs prints the chain that pulls it in, and usually the parent has no release with the fix yet. An override pins the version across the workspace anyway.

{
  "pnpm": {
    "overrides": {
      "tar-fs": "^2.1.3"
    }
  }
}

npm takes the same shape in a top-level overrides. Install so the lockfile moves, keep the advisory link in the commit message, and delete the entry once the parent catches up, because an override nobody remembers is a pin to a version nobody tests.

npmmaintenance

.tip

Override a transitive dependency instead of waiting