I am seeing a vulnarability in async and want to update it to 3.2.2 This is the dependency tree if i do npm list async

└─┬ webpack-dev-server@4.8.1
  └─┬ portfinder@1.0.28
    └── async@2.6.4

So looking at the npmdocs I tried to add override in package.json as follows.

{
  "name": "some application",
  "scripts": {...},
  "dependencies": {...},
  "overrides": {
    "webpack-dev-server": {
      "portfinder": {
        "async": "3.2.2"
      }
    }
  },
  "devDependencies": {...}
}

But when I do npm install it didn't update async version to 3.2.2 and still shows older version in pacakge-lock.json. I removed webpack-dev-server package from devDependencies but after running npm install I get empty on npm list async

└── (empty)

Any idea what am i doing wrong?