NPM Audit Fix Workflow
Run npm audit to identify vulnerabilities and apply fixes in a controlled manner with testing after each fix.
Objective
Resolve known vulnerabilities in project dependencies without breaking the build.
Environment
- A Node.js project with package-lock.json
- NPM version 7 or later
- CI pipeline that runs tests on push
Steps
1. Run npm audit
Execute npm audit to get a report of all vulnerabilities.
Expected state: A vulnerability report is generated with severity levels.
2. Apply audit fix
Run npm audit fix to apply non-breaking fixes automatically.
Expected state: Non-breaking vulnerabilities are patched in package-lock.json.
3. Run tests
Execute the full test suite to verify that fixes did not break anything.
Expected state: All tests pass with no regressions.
4. Review remaining
Run npm audit again to check for remaining vulnerabilities that need manual attention.
Expected state: A reduced list of vulnerabilities requiring manual fixes is shown.
Decision points
Should you use --force?
- Yes, for breaking fixes
- No, only non-breaking fixes
Start without --force; use it only if you have reviewed the breaking changes and have a rollback plan.
Expected outcome
All automatically fixable vulnerabilities are resolved, tests pass, and remaining vulnerabilities are documented for manual review.
Verification
Run npm audit and confirm zero high or critical vulnerabilities; run the test suite and confirm all tests pass.
Cleanup
Commit the updated package-lock.json and package.json if changed.
Audit first, fix second
Always review the audit report before applying fixes. Some fixes may introduce breaking changes.
npm audit
npm audit fix
npm testImplementation Notes
This workflow provides a structured approach to ensure consistent results across team members and environments.
Common Pitfalls
Skipping verification steps or rushing through the process can lead to incomplete results. Always follow each step in order and verify before proceeding.