What does "npm audit fix" exactly do?

npm package.json npm-audit
Sampo picture Sampo · Apr 24, 2020 · Viewed 42.3k times · Source

npm audit fix is intended to automatically upgrade / fix vulnerabilities in npm packages. However, I haven't found out what it exactly does to fix those vulnerabilities.

I assumed that npm audit fix would upgrade dependencies and dependencies' dependencies to the latest versions that are allowed by the semver-definitions of the packages – effectively the same as rm package-lock.json; npm install. However npm audit fix still performs a lot of changes after lock file removal + reinstall.

What exactly does npm audit fix do? Does it for example install versions of dependencies newer than those allowed by the corresponding package.json (but still semver-compatible)?

Answer

Noah May picture Noah May · Apr 24, 2020

From NPM's site on their audit command:

npm audit fix runs a full-fledged npm install under the hood

And it seems that an audit fix only does semver-compatible upgrades by default. Listed earlier in the document:

Have audit fix install semver-major updates to toplevel dependencies, not just semver-compatible ones:

$ npm audit fix --force

As for the lock file, it is regenerated each time you run a command that changes package.json. There is more information about that in an answer here as well as in the official documentation.

Related questions

What's the difference between tilde(~) and caret(^) in package.json?

After I upgraded to latest stable node and npm, I tried npm install moment --save. It saves the entry in the package.json with the caret ^ prefix. Previously, it was a tilde ~ prefix. Why are these changes made in npm? …

Read More
What's the difference between dependencies, devDependencies and peerDependencies in npm package.json file?

This documentation answers my question very poorly. I didn't understand those explanations. Can someone say in simpler words? Maybe with examples if it's hard to choose simple words? EDIT also added peerDependencies, which is closely related and might cause confusion.

Read More
How to set environment variables from within package.json

How to set some environment variables from within package.json to be used with npm start like commands? Here's what I currently have in my package.json: { ... "scripts": { "help": "tagove help", "start": "tagove start" } ... } I want to set environment variables (…

Read More