I am using express v4.16.4 in my node server.

It has pulled in cookie-signature v1.0.6.

I want to upgrade cookie-signature to v1.1.0 as it has a fix which I require. What is the way to do that ?

I don't think i should do a npm install cookie-signature@1.1.0 as it would list cookie-signature in my app dependencies.

EDIT: this discusses the exact same problem that i am looking to solve. The accepted answer is using npm-shrinkwrap, and another top voted answer using package-lock.json , but both of these seem to have issues as discussed in respective comments.

Happy to close this as a duplicate.