Optional inclusion of overrides in "pnpm outdated" output.

[pleunv]

I use resolutions/overrides quite extensively, both for forcing single versions of transient dependencies across packages, but also to lock a specific dependency while i.e. waiting for a bug fix to land. If in the latter use-case you're dealing with a transient dependency, it can be hard to find out when a new version has landed and your override needs to be removed or updated since it won't be included in the output of pnpm outdated. This means custom scripts or having to individually look up overrides one by one.

Yarn v1 used to include resolutionDependencies in the output of yarn outdated so there's definitely a precedent for this. None of the package managers or standalone version checker tools appear to support this functionality today, however. Personally I found this extremely useful since overrides need to be handled with care so should also be visible (if desired) when reviewing dependencies.

[iwan-uschka]

In my project i added trustPolicy: no-downgrade to my pnpm-workspace.yaml for better protection against supply chain attacks.

I now run into the problem that pnpm install yields

High-risk trust downgrade for "semver@6.3.1" (possible package takeover)

This error happened while installing the dependencies of eslint-plugin-import@2.32.0

and stops.

I checked https://github.com/npm/node-semver/blob/main/CHANGELOG.md to make sure that it's safe to use more up to date version of that package (no breaking changes). So i added

"pnpm": {
    "overrides": {
      "semver": "7.7.3"
    }
  }

to my package.json. I know, 7.7.3 is not the latest version. I did this on purpose.

When i now run pnpm outdated the package semver@7.7.3 is not listed. The latest version is 7.7.4 at the moment.

So my question is if overrides should be taken into account by pnpm outdated?

---

I am aware of https://github.com/un-ts/eslint-plugin-import-x as an up to date alternative to eslint-plugin-import. I am curious about this pnpm issue in general. Thanks!