Part of #9608.
Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
When an override forces a transitive dependency to a version outside the dependent's declared range, the override is applied (the store contains the overridden version), but under install-strategy=linked npm ls --all reports the edge as invalid: "<range>" and exits 1 (ELSPROBLEMS). The hoisted strategy reports the same edge as overridden and exits 0.
Expected Behavior
An applied override should be reported as overridden (not invalid) under the linked strategy, and npm ls should exit 0, matching the hoisted strategy.
Steps To Reproduce
cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
cat > package.json <<'EOF'
{ "name": "ov", "version": "1.0.0",
"dependencies": { "minimatch": "3.0.4" },
"overrides": { "brace-expansion": "2.0.1" } }
EOF
# 2.0.1 is outside minimatch@3.0.4's declared range (brace-expansion ^1.1.7)
npm install >/dev/null
npm ls --all
# linked: brace-expansion@2.0.1 invalid: "^1.1.7" from .../minimatch -> ELSPROBLEMS, exit 1
# hoisted: brace-expansion@2.0.1 overridden -> exit 0
Environment
- npm: 12.0.0-pre.1 (
latest)
- Node.js: v24.17.0
- OS Name: macOS (Darwin 25.5.0)
- System Model Name: MacBook (arm64)
- npm config:
Part of #9608.
Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
When an override forces a transitive dependency to a version outside the dependent's declared range, the override is applied (the store contains the overridden version), but under
install-strategy=linkednpm ls --allreports the edge asinvalid: "<range>"and exits 1 (ELSPROBLEMS). The hoisted strategy reports the same edge asoverriddenand exits 0.Expected Behavior
An applied override should be reported as
overridden(notinvalid) under the linked strategy, andnpm lsshould exit 0, matching the hoisted strategy.Steps To Reproduce
Environment
latest)install-strategy=linked