A big part of the problem is there is no reliably way to "just upgrade it" today in npm:

- `npm audit fix --force`, which is supposed to do that, is buggy and doesn't work

- There is no way to override a transitive dependency with npm (there is with Yarn though, so hopefully this feature will come to npm soon)

- Sometimes the fix in transitive dependency _also_ includes breaking changes (e.g. because it wasn't backported), and so updating it subtly breaks the logic

>Asking vulnerability databases to judge whether vulnerabilities are safe in devDependencies or not is a ridiculous idea

I don't think databases can do it, but what I'd like to be able to do is to be able to provide advisory that the way _my package_ uses a concrete transitive dependency is not affected by that vulnerability. Because as the package owner I _do_ have that context. I understand there may be significant issues with this approach though!