Audit and read the result
npm audit --omit=dev
npm outdatedFocus on what runs in production
- Fix high and critical issues in packages that ship to users first.
- Development-only issues matter less but can affect your build machine.
- A finding with no fix available may need a replacement package.
Before you install a name you do not know
- Check the package's repository, download history and publish date.
- Watch for names that differ by one character from a popular package.
- Remove dependencies the app no longer imports.
Keep the lockfile
Commit the lockfile, install with a clean install command in CI, and enable automated pull requests for updates so you patch in small steps.
Frequently asked questions
Is npm audit enough?
It covers known advisories only. Combine it with keeping the dependency list short and reviewing new packages.