npm audit fix: Auto-Patch Vulnerabilities

By Daniel Zoghalchali·Latchkey

npm audit fix rewrites your lockfile to pull in patched dependency versions.

audit fix is convenient but can introduce breaking changes with --force. In automation, run it on a branch and open a PR rather than mutating the main build.

Common flags

• --force - allow major version bumps (risky)
• --dry-run - preview changes
• --package-lock-only - update the lockfile without installing

Example in CI

Preview fixes in a scheduled job, then open a PR.

npm audit fix --dry-run

In CI

Never run audit fix --force in a blocking pipeline; it can swap in breaking majors. Prefer a bot (Dependabot/Renovate) that proposes reviewable updates.

Using this in CI

Node tooling on a runner differs from your machine in three ways that matter: CI=true is set, there is no TTY, and the Node major may not be the one you develop on.

• Pin the Node major with setup-node and in engines. Native modules resolve different prebuilt binaries per major.
• CI=true changes behaviour in several tools, most often by promoting warnings to errors or disabling interactive prompts.
• Commands that expect a TTY will hang. Pass the non-interactive or --yes flag explicitly.
• Use npm exec or node_modules/.bin rather than assuming a globally installed binary is on PATH.

Key takeaways

• Avoid --force in automated pipelines.
• Use --dry-run to preview.
• Prefer a PR bot for reviewable updates.

Frequently asked questions

Related guides

References

• Node.js documentation
• npm CLI documentation
• GitHub Actions documentation