check-dep-pins

name	check-dep-pins
description	Audit security-pinned dependency overrides in package.json. Checks whether each pinned version can be safely removed because the natural resolution now satisfies the minimum safe version. Triggered when the user asks to audit, review, or unlock pinned/locked dependencies, or check if overrides are still needed.

Check Dependency Pins

Audit pnpm.overrides (or resolutions for yarn/npm) to find version pins that were added for security reasons and determine which can now be removed.

Steps

1 — Read current overrides

cat package.json | jq '.pnpm.overrides // .resolutions // {}'

List every entry. Note the key (package name + optional version range) and pinned value.

2 — Check what pnpm would resolve without the pin

For each pinned package, temporarily check what version pnpm actually installs:

pnpm why < package-name > 2 > /dev/null | grep -E "└──|├──" | grep "<package-name>"

This shows the resolved version(s) in the current lockfile (which includes the pin).

3 — Check latest published version on npm

pnpm info < package-name > version 2> /dev/null

Or for a specific range:

pnpm info version < package-name > @"<range>" 2> /dev/null

4 — Determine if the pin is still needed

For each override, assess:

Condition	Action
Latest version in the requested range is already >= pinned version	Can remove — pnpm will naturally resolve to a safe version
Latest version is below pinned version (upstream hasn't released a fix yet)	Keep pin — removing it would regress to a vulnerable version
Override key uses a version constraint (e.g., axios@1.14.1) that no longer matches any installed package	Dead override — safe to remove (the constraint never fires)

5 — Report findings

For each override, output one line:

✅ REMOVE  picomatch@2        pin=2.3.2  latest-in-range=2.3.2  (range already satisfies fix)
🔒 KEEP    some-pkg           pin=1.2.3  latest-in-range=1.2.2  (upstream not yet patched)
🧹 DEAD    axios@1.14.1       pin=1.14.0  (version constraint matches nothing installed)

Then list the exact lines to remove from package.json.

6 — Apply removals (if user confirms)

Use Edit to remove the lines from package.json pnpm.overrides, then run:

pnpm install

Verify no new vulnerabilities appear after unlocking.

Notes

• A pin added as "pkg@X" (exact upstream version constraint) fires only when that exact version is requested transitively. Check pnpm why pkg to confirm it's still relevant.
• A pin added as "pkg@major" (e.g., "picomatch@2") overrides all v2.x resolutions — remove it only when the natural resolution already picks a version >= the fix.
• After removing overrides, re-run the CI security scan or pnpm audit to confirm no regressions.