> ## Documentation Index
> Fetch the complete documentation index at: https://bun.manicule.dev/llms.txt
> Use this file to discover all available pages before exploring further.
> For every page in one file, fetch https://bun.manicule.dev/llms-full.txt (large).
> To search and read these docs as tools, connect the MCP server at https://bun.manicule.dev/api/mcp.
> Every agent surface: https://bun.manicule.dev/.well-known/llms-manifest.json

# Overrides and resolutions (/pm/overrides)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 553 · updated: 2026-08-02 -->
Related: [bunx](/pm/bunx.md), [Workspaces](/pm/workspaces.md), [Catalogs](/pm/catalogs.md), [bun --filter](/pm/filter.md), [Global cache](/pm/global-cache.md), [Global virtual store](/pm/global-store.md)

> Control metadependency versions with npm overrides and Yarn resolutions

Bun supports npm's `"overrides"` and Yarn's `"resolutions"` in `package.json`. Both specify a version range for *metadependencies*, the dependencies of your dependencies.

```json icon="file-json" title="package.json"
{
  "name": "my-app",
  "dependencies": {
    "foo": "^2.0.0"
  },
  "overrides": { // [!code ++]
    "bar": "~4.4.0" // [!code ++]
  } // [!code ++]
}
```

By default, Bun installs the latest version of all dependencies and metadependencies, according to the ranges specified in each package's `package.json`. Say your project has one dependency, `foo`, which in turn depends on `bar`. That makes `bar` a *metadependency* of your project.

```json icon="file-json" title="package.json"
{
  "name": "my-app",
  "dependencies": {
    "foo": "^2.0.0"
  }
}
```

When you run `bun install`, Bun installs the latest version of each package.

```txt icon="list-tree" title="tree layout of node_modules"
node_modules
├── foo@1.2.3
└── bar@4.5.6
```

If a security vulnerability is introduced in `bar@4.5.6`, you may want to pin `bar` to an older version that doesn't have it. That's what `"overrides"` and `"resolutions"` are for.

***

## `"overrides"`

Add `bar` to the `"overrides"` field in `package.json`. Bun defers to the specified version range when determining which version of `bar` to install, whether it's a dependency or a metadependency.

<Note>Bun only supports top-level `"overrides"`, not [nested
overrides](https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides).</Note>

```json icon="file-json" title="package.json"
{
  "name": "my-app",
  "dependencies": {
    "foo": "^2.0.0"
  },
  "overrides": { // [!code ++]
    "bar": "~4.4.0" // [!code ++]
  } // [!code ++]
}
```

## `"resolutions"`

`"resolutions"` is Yarn's alternative to `"overrides"`, with similar syntax. Bun supports it to make migration from Yarn easier.

As with `"overrides"`, *nested resolutions* are not supported.

```json icon="file-json" title="package.json"
{
  "name": "my-app",
  "dependencies": {
    "foo": "^2.0.0"
  },
  "resolutions": { // [!code ++]
    "bar": "~4.4.0" // [!code ++]
  } // [!code ++]
}
```