transitive-vulnerability-remediation

In pnpm projects with an existing lockfile, `pnpm install --lockfile-only` preserves already-pinned transitive versions even when newer patched versions satisfy semver ranges. To remediate advisories ...