npm audit
Packages and runtimes
Usage
npm audit [fix] [--audit-level=<level>]Reports known vulnerabilities in the installed tree; fix --force will pull in breaking major versions, and warnings buried in dev-only dependencies often cannot be fixed at all.
Common flags
| Flag | Meaning |
|---|---|
| fix | upgrade what it can inside your version ranges |
| fix --force | allow breaking major upgrades to clear a report |
| --audit-level=high | only fail on high and above |
| --omit=dev | ignore dev-only dependencies |
| --json | machine-readable report |
| --dry-run | show the plan without changing anything |
Examples
npm auditlists known vulnerabilities in the installed tree
npm audit fixupgrades the ones that fit your ranges
npm audit fix --forcemay install major versions that break your build
The question is always what goes where: inside this project, or on the whole machine.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does npm audit do?
Reports known vulnerabilities in the installed tree; fix --force will pull in breaking major versions, and warnings buried in dev-only dependencies often cannot be fixed at all.
Q. How do I type it?
npm audit [fix] [--audit-level=<level>] — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
6 are listed here; the full set is in man npm. This command sits under Packages and runtimes.
Related commands
man page: man npm-audit