Apply compatible vulnerability fixes
Medium risk
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Reviews npm audit findings, then installs advisory fixes that remain within declared dependency ranges without forcing semver-major upgrades.
nodenpmsecurity-fix
Commands
Review vulnerabilities and proposed remediations before changing dependencies
npm auditApply compatible fixes without executing lifecycle scripts
npm audit fix --ignore-scriptsVerification
npm auditFixed advisories disappear; any remaining findings include unresolved remediation guidance.
Undo
Restore tracked dependency declarations and lockfile entries
git restore package.json package-lock.jsonRecreate node_modules without executing lifecycle scripts
npm install --ignore-scriptsPitfalls
- The undo steps require package.json and package-lock.json to be tracked in Git with the desired prior state.
- Lifecycle scripts are disabled during remediation and recovery; packages that depend on them may need separately reviewed setup.
- Do not add --force without separately reviewing semver-major changes and their migration requirements.