npm / audit-fix

npm audit fix — resolve security vulnerabilities

Quick Answer

# Show all vulnerabilities
npm audit

# Apply updates that stay within declared dependency ranges
npm audit fix

Usage

npm audit reports known security vulnerabilities in your dependencies.

Other causes & fixes

Review breaking updates before using --force

npm audit fix --force may install dependencies outside the ranges declared in package.json, including major-version upgrades. Review the proposed changes and run the test suite.

# Preview the changes first
npm audit fix --force --dry-run

# Apply only after reviewing the proposed dependency changes
npm audit fix --force

Audit output explained

npm audit
# Severity levels: critical, high, moderate, low, info
#
# ┌─────────────────────────────────────────────────────────────┐
# │                       === npm audit ===                     │
# │  found 3 vulnerabilities (1 moderate, 2 high)              │
# └─────────────────────────────────────────────────────────────┘

Audit only prod dependencies

npm audit --omit=dev

Manually fix a specific vulnerable package

# Upgrade a specific package
npm install lodash@latest

# Or pin to a patched version
npm install [email protected]

Get JSON output for CI

npm audit --json | jq '.metadata.vulnerabilities'
# {info: 0, low: 0, moderate: 1, high: 2, critical: 0, total: 3}

# Fail CI on high+ severity
npm audit --audit-level=high

Related