From c9adf5eebbc2bf76eabc9d5953ccb1f6aff73007 Mon Sep 17 00:00:00 2001 From: Conduction Release Bot Date: Mon, 31 Aug 2026 17:58:32 +0200 Subject: [PATCH] fix(deps): make the npm overrides follow their direct dependency Dependabot cannot update these packages. Its npm updater fails with: npm error code EOVERRIDE npm error Override for conflicts with direct dependency The package is listed BOTH as a direct dependency and as a literal overrides entry pinned to the same range. Dependabot bumps the direct dependency and does not move the override, npm rejects the mismatched pair, and the update is abandoned -- so these packages can never be updated, security advisories included. npm's self-reference is the idiom for exactly this: $ tells the override to follow whatever the direct dependency resolves to, instead of a range that has to be kept in lockstep by hand. This repo already uses it (see the vue entry under @vue/test-utils). Transitive consumers still get pinned to one version -- the direct dependency's -- which is what the override was there to do. What changes is that the pin tracks the dependency instead of duplicating it. Verified in a clean container: bumping the direct dependency with the literal override reproduces the EOVERRIDE above; with the self-reference the same bump resolves. --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index c372d5f6..79bad8c1 100644 --- a/package.json +++ b/package.json @@ -85,7 +85,7 @@ "extends @nextcloud/browserslist-config" ], "overrides": { - "pinia": "~2.1.7", + "pinia": "$pinia", "@vueuse/core": "^14.0.0", "@vueuse/shared": "^14.0.0" },