Upgrade every vulnerable node to the lowest published version that clears its
advisory — then pull in that version's new transitive dependency closure so
the lockfile stays complete. Versions resolve from the registry packument
(no shell-out); replaceVersion rebinds, completeTransitives fills the new
deps, pruneOrphans retires the old closure the upgrade stranded. Async since
the registry is hit over HTTP.
Upgrade every vulnerable node to the lowest published version that clears its advisory — then pull in that version's new transitive dependency closure so the lockfile stays complete. Versions resolve from the registry packument (no shell-out);
replaceVersionrebinds,completeTransitivesfills the new deps,pruneOrphansretires the old closure the upgrade stranded. Async since the registry is hit over HTTP.