A dependency override that fixed nothing
A plain npm `overrides` block in package.json is silently ignored by pnpm, which reads `pnpm.overrides`, so multer and ws stayed installed at vulnerable versions.
It said it worked
Green, 200, saved, “already handled” — and wrong. No error anywhere to go on.
package.json had an overrides block pinning multer and ws to patched versions, which reads as already handled. pnpm audit --audit-level=high disagreed: both were installed at their old vulnerable versions.
overrides is npm-specific. pnpm uses pnpm.overrides and silently ignores the plain top-level key — no warning, no error. This project is pnpm-only, so the override had never done anything, possibly since the day it was written. Moving both entries took the audit from 6 high-severity findings to 0.
Verify an override actually took effect by checking the installed version, not by trusting a plausible-looking key, especially when the format differs between package managers with nothing to flag the mismatch.