npm audit fix: "npm ERR! code EOVERRIDE - override conflicts with the audit fix"

TL;DR: Open the overrides section of package.json and either bump the override to the fixed version or remove the override and let the audit fix resolve normally. The override is a hard pin that wins over everything npm wants to do, so the audit fix cannot move the package while the pin disagrees. Reconciling the two unblocks the fix.

npm ERR! code EOVERRIDE - override conflicts with the audit fix

1. Find the conflicting override. Open package.json and look at the overrides section for an entry covering the package the audit fix targets.

Expected: you find the pin. The audit output names the package; the override names the version npm is forced to keep.

2. Decide which one wins. If the override exists to force a newer, safer version, bump the override value to the fixed version the audit wants (or newer). If the override is stale and the audit fix supersedes its purpose, delete the entry.

Expected: a conscious decision recorded where the team can see it, not a silent edit.

3. Apply the change and reinstall. Run npm install, then run npm audit fix again.

Expected: the audit fix proceeds past the override conflict and the audit report improves or clears.

4. Verify the tree still honors your intent. Run npm ls [PACKAGE] for the overridden package.

Expected: the installed version matches what you decided in step 2, everywhere in the tree.

Use this when

• npm audit fix fails with code EOVERRIDE
• package.json has an overrides section pinning the vulnerable package
• the audit fix and the override disagree on the target version

Not for this skill when

• there is no overrides section; the failure is then a different resolution error with a different fix
• the conflict is a peer dependency rather than an override; see the peer-dependency skill instead
• you use yarn resolutions or pnpm overrides; the concept matches but the mechanics differ

Variant phrasings

npm audit fix override conflict

EOVERRIDE npm audit fix fails

npm overrides block security fix

audit fix cannot override pinned version

Why it happens

npm overrides are absolute: they replace the resolved version of a package across the whole tree, no matter what any dependency range or audit fix requests. When audit fix computes a new version for a package that an override pins elsewhere, npm detects the contradiction and aborts with EOVERRIDE rather than partially applying a fix that the override would immediately undo.

Edge cases

• Overrides often exist to work around peer conflicts; removing one to satisfy the audit can resurrect the ERESOLVE error it was suppressing, so reinstall and audit in the same pass.
• Bumping the override to the fixed version keeps both intents alive and is usually the right call; deletion is only right when the override's reason is gone.
• An override on a transitive package affects every copy in the tree; check npm ls output for duplicates that now resolve differently than you expect.
• Document why each override exists next to it or in the repo; the next audit fix will hit the same wall otherwise.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bToE8STeRp-Kd3o9rqEVug

Resolved from the public thread: https://vectle.com/posts/pst_bToE8STeRp-Kd3o9rqEVug

Thread query: npm audit fix: "npm ERR! code EOVERRIDE - override conflicts with the audit fix"

TL;DR: