I tried to fix some issues in my project by running npm audit fix
which didn't do much, however when I append --force flag the return result is worse than previously:
fix available via `npm audit fix`
10 vulnerabilities (2 moderate, 8 high) 😮💨
using the --force
fix available via `npm audit fix --force`
79 vulnerabilities (14 low, 23 moderate, 38 high, 4 critical) 🤯
I'd use yarn if I could however I can't. How else would one fix these with npm
or do I need to go into each one and do it manually?
Thanks in advance 🌚
First up, reason you can see more issues when you force is that updated package might legit still have more audit findings.
Please note that using --force is not always a good option, especially on an existing older code base, since forcing the dependency updates might introduce breaking change which will need code changes. If you are up for those then by all means force it.
Finally, there's no silver bullet approach to updating dependencies with audit findings. There may or may not be actual fixes available.
Generally speaking, yes auditing them one at a time, is a good idea. This way you can read the details of findings. Look at the repos and see what the fixes or repercussions of updating are.
Also, using Yarn doesn't necessarily help you with audit findings. Since yarn is just another tool to pull down the exact same lib versions.