Process on resolving pnpm audit findings

[simhnna]

We're currently using npm pretty much everywhere at my company. I'm exploring pnpm as an alternative.

I'm not sure what the equivalent of npm audit fix is in pnpm. Coming from npm I'm used to being able to update what's needed to remove known security issues. AFAIK there's no single command that accomplishes the same in pnpm.

The closest I got was to

1. pnpm audit --fix to populate overrides,
2. pnpm install to persist changes in lockfile,
3. remove overrides
4. pnpm install
   That way the dependencies that were overridden stay there as long as they comply with all specified version ranges. Remaining audits need to be looked at again

How do others handle that? Just live with the overrides?