Proper way to fix potential security vulnerability in a dependency defined in package-lock.json

github npm package-lock.json
Kaito picture Kaito · Mar 31, 2018 · Viewed 31.2k times · Source

Github has given me this error on one of my repositories.

We found a potential security vulnerability in one of your dependencies.
A dependency defined in ./package-lock.json has known security vulnerabilities 
and should be updated.

The dependency is not defined in our package.json file. To my understanding it isn't good practice to delete the package-lock.json file and regenerate it. However, I cannot see any other way to fix this issue. If I dismiss this security vulnerability it will appear again a couple of days later. Any ideas? Thanks!

Answer

DevTheJo picture DevTheJo · May 31, 2018

New: now, with npm@6 you can directly run

npm audit fix

Old answer:

You should try to identify the problematic package's name, and then run

npm install package-name

replacing package-name, obviously.

This will install the latest version of the package, and very often, the latest version has fixed the security issue. If you have a constraint on version (eg: 1.2), you can always try to:

npm install package-name@^1.2

and the latest patched version will be installed

Related questions

How to install an npm package from GitHub directly?

Trying to install modules from github results in: ENOENT error on package.json. Easily reproduced using express: npm install https://github.com/visionmedia/express throws error. npm install express works. Why can't I install from github? Here is the console …

Read More
npm install private github repositories by dependency in package.json

I'm trying to install github private repository by npm that includes other private github repositories as dependency. Have tried a lot of ways and posts but none is working. Here is what i'm doing : npm install git+https://github.com/…

Read More
How to use private Github repo as npm dependency

How do I list a private Github repo as a "dependency" in package.json? I tried npm's Github URLs syntaxes like ryanve/example, but doing npm install in the package folder gives "could not install" errors for the private dependencies. …

Read More