Auditing packages brings back more errors

user_19727374 0
Viewed 10

I tried to fix some issues in my project by running npm audit fix

which didn't do much, however when I append --force flag the return result is worse than previously:

fix available via `npm audit fix`

10 vulnerabilities (2 moderate, 8 high) ‍

using the --force

fix available via `npm audit fix --force`

79 vulnerabilities (14 low, 23 moderate, 38 high, 4 critical)

I'd use yarn if I could however I can't. How else would one fix these with npm or do I need to go into each one and do it manually?

Thanks in advance

npm package-managers javascript
1 Answers

First up, reason you can see more issues when you force is that updated package might legit still have more audit findings.

Please note that using --force is not always a good option, especially on an existing older code base, since forcing the dependency updates might introduce breaking change which will need code changes. If you are up for those then by all means force it.

Finally, there's no silver bullet approach to updating dependencies with audit findings. There may or may not be actual fixes available.

Generally speaking, yes auditing them one at a time, is a good idea. This way you can read the details of findings. Look at the repos and see what the fixes or repercussions of updating are.

Also, using Yarn doesn't necessarily help you with audit findings. Since yarn is just another tool to pull down the exact same lib versions.

user_7262390
Related