node.jsnpmnpm-installnpm-audit

npm audit fix vs npm install


There is something I don't understand with how npm audit fix works. From the docs:

npm audit fix runs a full-fledged npm install under the hood

So why when I run npm install and see audit vulnerabilities do I have to run npm audit fix manually to fix them?


Solution

  • npm install without any arguments will just install the dependencies in your package-lock.json (assuming it exists). npm audit fix will use the audit information to figure out what dependencies need to be upgraded and install them, as long as they don't conflict with your package.json.