pnpm install lockfile-only does not advance pinned transitives; use targeted pnpm update for security patches

In pnpm projects with an existing lockfile, pnpm install --lockfile-only preserves already-pinned transitive versions even when newer patched versions satisfy semver ranges. To remediate advisories without broad direct-dependency bumps, run targeted pnpm update --lockfile-only on the affected transitives so the lockfile advances to patched versions. Verified locally in 2026-04 against pnpm v9 lockfiles.

When addressing vulnerable transitive dependencies in pnpm, prefer targeted lockfile updates (pnpm update --lockfile-only <pkg>@<patched-range>) before adding permanent pnpm.overrides; this updates pinned lockfile entries while keeping direct dependency specs unchanged.