For AI agents: the complete documentation index is available at https://nhanbe.id.vn/llms.txt, the full documentation bundle is available at https://nhanbe.id.vn/llms-full.txt, and this page is available as Markdown at https://nhanbe.id.vn/others/posts/security/fixing-npm-dependencies.md.
Nhan AEM Notes

How to fix NPM dependencies

Fixing NPM Dependencies Security

Inspect

npm audit                          # full report
npm audit --omit=dev               # production only
npm audit --json > audit.json      # for CI
npm why <package>                  # why is this here
npm ls <package>                   # which versions, via which parent
npm audit --omit=dev --audit-level=high

Fix (safest first)

1. Non-breaking

npm audit fix

Semver-compatible only. Commit package-lock.json.

2. Bump the parent

npm outdated
npm update <parent-package>
npm install <parent-package>@latest

3. Parent unmaintained → overrides

{
  "overrides": {
    "serialize-javascript": "^6.0.2",
    "some-parent": {
      "nested-vuln-pkg": "^2.1.1"
    }
  }
}
rm -rf node_modules package-lock.json
npm install
npm audit