Unused PNPM Overrides

[juanri0s]

what is the best management strategy for pnpm overrides?

We use overrides for quick vuln remediation, but eventually packages get upgraded or dropped and thus the overrides are no longer needed. Its probably not hurting anything but whats the best way to know that an override is no longer needed and will no longer have a vulnerability and thus can be removed?

Im looking for something that can be automated. If i have 30 overrides, removing and checking each one individually is going to be tedious.

[inviy]

There's no built-in command for this as far as I know, but there's a reliable test you can automate: an override is no longer needed if removing it doesn't change the lockfile. If the resolved versions are identical without it, nothing in your tree still pulls the vulnerable version.

One catch: overrides can overlap (e.g. ms and debug>ms pinning the same thing). Removing either one alone changes nothing, but removing both does. So drop them one at a time and keep the dropped ones out while testing the rest.

This script does that (run it from the directory with your package.json / pnpm-lock.yaml; it restores both files when it's done):

// find-unused-overrides.mjs
import { readFileSync, writeFileSync, copyFileSync } from "node:fs";
import { execSync } from "node:child_process";

const pkgPath = "package.json", lockPath = "pnpm-lock.yaml";
const pkgSrc = readFileSync(pkgPath, "utf8");
const pkg = JSON.parse(pkgSrc);
const strip = s => s.replace(/^overrides:\n(?:  .*\n)*/m, ""); // ignore the overrides block itself
const lock = () => strip(readFileSync(lockPath, "utf8"));

copyFileSync(lockPath, lockPath + ".bak");
const base = lock();
const unused = [];
try {
  for (const key of Object.keys(pkg.pnpm?.overrides ?? {})) {
    const value = pkg.pnpm.overrides[key];
    delete pkg.pnpm.overrides[key];
    writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
    execSync("pnpm install --lockfile-only --ignore-scripts", { stdio: "ignore" });
    if (lock() === base) unused.push(key);
    else pkg.pnpm.overrides[key] = value; // still needed, put it back
  }
} finally {
  writeFileSync(pkgPath, pkgSrc);
  copyFileSync(lockPath + ".bak", lockPath);
}
console.log(unused.length ? "No effect (safe to remove together):\n  " + unused.join("\n  ")
                          : "Every override still changes the lockfile.");

Tested on pnpm 10.18 with debug@4.3.4 and overrides { "ms": "2.1.3", "left-pad": "1.3.0", "debug>ms": "2.1.3" }: it reports ms and left-pad, and after removing those two ms still resolves to 2.1.3 (without any overrides it would be 2.1.2).

Notes:

• If your overrides live in pnpm-workspace.yaml (pnpm 10 supports that too), the same idea applies; you'd just edit that file instead of package.json.
• --lockfile-only doesn't touch node_modules, so 30 overrides is ~30 quick resolutions. You could run it in CI on a schedule and open an issue when the list isn't empty.