21

I have a number of issues reported by npm audit, and by running npm audit fix it does fix several of them. However, doing so also breaks my build for some reason. I think I know which fix causes the issue, but I'd still like to fix the other issues.

Is there a way to have npm do whatever it does when I run npm audit fix, but only for a single issue/dependency?


I know I run npm i, but that also adds the updated dependency to package.json (even with --package-lock-only flag), which I don't want. I just want npm to update the package-lock.json, like it does when I run npm audit fix, but just for a select subset of issues.

1 Answer 1

32

You should be able to use npm update to achieve what you want here. What to do is slightly different depending on whether you are using npm 7.x or npm 6.x. I'm using 7.x, so that's what I show below.

Let's say npm audit produces output like this:

# npm audit report

minimist  <0.2.1 || >=1.0.0 <1.2.3
Prototype Pollution - https://npmjs.com/advisories/1179
fix available via `npm audit fix`
node_modules/extract-zip/node_modules/minimist
  mkdirp  0.4.1 - 0.5.1
  Depends on vulnerable versions of minimist
  node_modules/extract-zip/node_modules/mkdirp
    extract-zip  <=1.6.7
    Depends on vulnerable versions of mkdirp
    node_modules/extract-zip

3 low severity vulnerabilities

To address all issues, run:
  npm audit fix

This is indicating that we need to update minimist, mkdirp, and extract-zip.

Let's do npm ls to get an idea of what versions and dependencies we're dealing with.

$ npm ls minimist mkdirp extract-zip  
[email protected] /Users/trott/ucsf-ckm/scrape-text
├─┬ [email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]
└─┬ [email protected]
  ├─┬ [email protected]
  │ ├─┬ [email protected]
  │ │ └─┬ [email protected]
  │ │   └─┬ [email protected]
  │ │     └── [email protected] deduped
  │ └─┬ [email protected]
  │   └── [email protected] deduped
  └─┬ [email protected]
    └── [email protected]

$ 

Because the colorizing is kind of important, here's a screenshot of that last one:

Screenshot of the previous text output to show colorization highlighting of the modules we care about

Let's see what happens if we run npm update minimist to just update that package. Let's use npm ls minimist to see if anything changed. (You can also see if your package-lock.json file changed and do a diff.)

$ npm ls minimist
[email protected] /Users/trott/ucsf-ckm/scrape-text
├─┬ [email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]
└─┬ [email protected]
  ├─┬ [email protected]
  │ └─┬ [email protected]
  │   └── [email protected] deduped
  └─┬ [email protected]
    └── [email protected]

$ 

Nope, no change. We still have the same versions we had before. OK, let's try the next one, which would be mkdirp.

$ npm update mkdirp

changed 1 package, and audited 244 packages in 1s

3 low severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.
$

That changed 1 package seems promising. Let's see what that did:

$ npm ls mkdirp    
[email protected] /Users/trott/ucsf-ckm/scrape-text
├─┬ [email protected]
│ └─┬ [email protected]
│   └── [email protected]
└─┬ [email protected]
  └─┬ [email protected]
    ├─┬ [email protected]
    │ └─┬ [email protected]
    │   └─┬ write@1.0.3
    │     └── [email protected] deduped
    └── [email protected]

That updated mkdirp to 0.5.5. You can test that out and see if things still work.

If you now do npm update extract-zip, that will result in a clean npm audit run.

Hopefully, this gives you an idea of how to update the packages one at a time without modifying package.json in the process. Good luck!

3
  • Thanks for this well-written and insightful post. It would be even greater if you could also include the full package.json. I believe that's all it takes to make it a "minimal, complete, and verifiable example" (MCVE).
    – Henke
    Mar 23 at 11:12
  • not sure how this fixed the minimist issue? Nov 15 at 11:48
  • @alfredopacino In this case, mkdirp and extract-zip both have minimist as a dependency. Trying to update minimist without updating those two won't work because the old versions of mkdirp and extract-zip limit what new versions of minimist can be installed. By updating those other packges, minimist ends up getting updated as well.
    – Trott
    Nov 16 at 14:00

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.