title: How to update dependencies of dependencies using npm
body: <p>I'm very wondered that I can't find an answer to this simple question. Also I'm very wondered that <code>npm update</code> does not solve this.</p>
  
  <p>I can't post my complete dependency tree here but let me describe my issue anyway:</p>
  
  <p>minimist is outdated (version 1.2.0) and has a security vulnerability in this version. The packages require minimist define the dependency as ^1.2.0 - so it is compatible with 1.2.2.</p>
  
  <p>The common solution is to put it to <code>package.json</code> within <code>devDependencies</code> or <code>dependencies</code> with <code>^1.2.2</code>. I don't want to put it into <code>package.json</code>. I feel like <code>npm update</code> should also update indirect dependencies.</p>
  
  <p>Am I missing something?</p>
  
  <p>Here you can see my package-lock.json: <a href="https://github.com/tflori/riki-community/blob/master/package-lock.json" rel="noreferrer">https://github.com/tflori/riki-community/blob/master/package-lock.json</a></p>
  
  <p>And the output of <code>npm ls minimist</code>:</p>
  
  <pre><code>riki-community@ /home/iras/work/projects/riki/community
  ├─┬ awesome-typescript-loader@5.2.1
  │ ├─┬ loader-utils@1.2.3
  │ │ └─┬ json5@1.0.1
  │ │   └── minimist@1.2.0  deduped
  │ └─┬ mkdirp@0.5.1
  │   └── minimist@0.0.8 
  ├─┬ jest@25.1.0
  │ └─┬ @jest/core@25.1.0
  │   ├─┬ @jest/transform@25.1.0
  │   │ └─┬ @babel/core@7.8.7
  │   │   └─┬ json5@2.1.2
  │   │     └── minimist@1.2.5 
  │   └─┬ jest-haste-map@25.1.0
  │     └─┬ sane@4.1.0
  │       ├─┬ @cnakazawa/watch@1.0.4
  │       │ └── minimist@1.2.0  deduped
  │       └── minimist@1.2.0  deduped
  ├─┬ node-sass@4.13.1
  │ └─┬ meow@3.7.0
  │   └── minimist@1.2.0 
  ├─┬ ts-jest@25.2.1
  │ └─┬ json5@2.1.2
  │   └── minimist@1.2.5 
  ├─┬ tsconfig-paths-webpack-plugin@3.2.0
  │ └─┬ tsconfig-paths@3.8.0
  │   └── minimist@1.2.0  deduped
  └─┬ webpack@4.42.0
    └─┬ watchpack@1.6.0
      └─┬ chokidar@2.1.8
        └─┬ UNMET OPTIONAL DEPENDENCY fsevents@1.2.9
          └─┬ UNMET OPTIONAL DEPENDENCY node-pre-gyp@0.12.0
            ├─┬ UNMET OPTIONAL DEPENDENCY mkdirp@0.5.1
            │ └── UNMET OPTIONAL DEPENDENCY minimist@0.0.8 
            └─┬ UNMET OPTIONAL DEPENDENCY rc@1.2.8
              └── UNMET OPTIONAL DEPENDENCY minimist@1.2.0 
  </code></pre>