> For AI agents: the complete documentation index is available at https://nhanbe.id.vn/llms.txt, the full documentation bundle is available at https://nhanbe.id.vn/llms-full.txt.

# Fixing NPM Dependencies

## Inspect

```bash
npm audit                          # full report
npm audit --omit=dev               # production only
npm audit --json > audit.json      # for CI
npm why <package>                  # why is this here
npm ls <package>                   # which versions, via which parent
npm audit --omit=dev --audit-level=high
```

## Fix (safest first)

**1. Non-breaking**

```bash
npm audit fix
```

Semver-compatible only. Commit `package-lock.json`.

**2. Bump the parent**

```bash
npm outdated
npm update <parent-package>
npm install <parent-package>@latest
```

**3. Parent unmaintained → `overrides`**

```json
{
  "overrides": {
    "serialize-javascript": "^6.0.2",
    "some-parent": {
      "nested-vuln-pkg": "^2.1.1"
    }
  }
}
```

```bash
rm -rf node_modules package-lock.json
npm install
npm audit
```