overrides doesn't work if hasShrinkwrap is true for a library that requires a library to be overridden

[grenik]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

overrides doesn't work if hasShrinkwrap is true for a library that requires a library to be overridden.

E.g. @sap/logging depends on moment@2.29.2 and it also hasShrinkwrap. If I try to override moment version to 2.29.4 via overrides, it doesn't work.

Expected Behavior

The moment version is overridden

Steps To Reproduce

1. With this package.json:

{
  "name": "overrides-issue",
  "version": "1.0.0",
  "dependencies": {
    "@sap/logging": "6.1.2"
  },
  "overrides": {
    "moment": "2.29.4"
  }
}

2. Run npm i && npm ll moment
3. See moment version 2.29.2 (not 4 as requested to be overridden)

As a wokaround, one can open package-lock.json, remove hasShrinkwrap from the @sap/logging dependency and rerun npm i

Environment

• npm: 8.13.2
• Node.js: 16.14.0
• OS Name: Windows 10 20H2
• System Model Name: Lenovo T560
• npm config:

; node bin location = C:\Users\GDPR\AppData\Local\nvs\default\node.exe
; node version = v16.14.0
; npm local prefix = C:\dev\npm-overrides-issue
; npm version = 8.13.2
; cwd = C:\dev\npm-overrides-issue
; HOME = C:\Users\GDPR

[wraithgar]

This is by design. Overrides do not work on bundled or shrinkwrapped dependencies. Those are explicit directives from the source package.

If you think this behavior should be changed feel free to suggest it via an rfc or rrfc