How do I fix a vulnerable npm package in my package-lock.json that isn't listed in the package.json?

node.js npm package.json package-lock.json
Raph117 picture Raph117 · May 14, 2018 · Viewed 35.2k times · Source

Github is telling me that a dependency in my package-lock.json file is vulnerable and outdated. The problem is that if I do npm install or npm update, neither of them update the dependency in the package-lock.json file.

I've done a lot of googling on this, as well as deleted the file and done npm install.

If anyone can help resolve this I'd hugely appreciate it. The package in question is Hoek, which I don't actually have in my package.json file.

Many thanks in advance.

Answer

Alex Mulchinock picture Alex Mulchinock · May 14, 2018

It sounds like Hoek is a dependency of one of your dependencies (so, a package you have in your package.json is requiring it from it's own package.json).

You've already tried deleting/reinstalling and updating your project dependencies without success, so it seems that the package dependency in question has an explicit or max version specified.

Without seeing the package.json for each of your dependencies, it would be difficult to advise further on how to force an update.

Edit: To help you identify which packages are using which dependencies, you can use NPM's ls command: https://docs.npmjs.com/cli/ls

For example, to see which packages are using Hoek: npm ls hoek

Edit 2: As Ulysse BN correctly points out, if you have NPM version 6 or later, you can use npm audit fix to ask NPM to attempt to fix the vulnerabilities for you.

Edit 3: Those reading this should also check out JBallin's answer below. It expands on information I have given here, and is (in my opinion) a more structured answer that addresses OP's question better. However - if you want a quick fix - this answer should suffice.

Related questions

What's the difference between tilde(~) and caret(^) in package.json?

After I upgraded to latest stable node and npm, I tried npm install moment --save. It saves the entry in the package.json with the caret ^ prefix. Previously, it was a tilde ~ prefix. Why are these changes made in npm? …

Read More
What's the difference between dependencies, devDependencies and peerDependencies in npm package.json file?

This documentation answers my question very poorly. I didn't understand those explanations. Can someone say in simpler words? Maybe with examples if it's hard to choose simple words? EDIT also added peerDependencies, which is closely related and might cause confusion.

Read More
How to set environment variables from within package.json

How to set some environment variables from within package.json to be used with npm start like commands? Here's what I currently have in my package.json: { ... "scripts": { "help": "tagove help", "start": "tagove start" } ... } I want to set environment variables (…

Read More