npm audit
# 12 vulnerabilities found
# 3 high
# 9 moderate
#
# Run `npm audit` for details
npm audit fix
# Fixed 7 of 12 vulnerabilities
# (safe, non-breaking updates)
# For the remaining 5:
npm audit fix --force
# ⚠️ --force may install breaking
# major version changes.
# Review the changelog FIRST.
# Better approach: update manually
npm install package-name@latest
# Then run tests to verify nothing broke.
# Check package health:
# - Last published: > 2 years ago? ⚠️
# - Open issues piling up? ⚠️
# - Maintainer inactive? ⚠️
# Common replacements:
# moment.js → date-fns or dayjs
# request → node-fetch or undici
# lodash → lodash-es (tree-shakeable)
# Decision framework:
# 1. Is there a maintained fork?
# 2. Is there a modern alternative?
# 3. Can you vendor the code (copy it)?
# 4. Can you write it yourself?
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: npm
directory: "/"
schedule:
interval: weekly
open-pull-requests-limit: 10
labels:
- "dependencies"
reviewers:
- "your-username"
# Dependabot will:
# - Check for updates weekly
# - Open PRs with changelogs
# - CI runs tests against updates
# - You review and merge
# Automated, tested, continuous.
# Add to .github/workflows/ci.yml:
- name: Security audit
run: npm audit --audit-level=high
# --audit-level=high:
# Fail the build if HIGH or CRITICAL
# vulnerabilities are found.
# Moderate/low = warn but don't block.
# Verify:
npm audit
# found 0 vulnerabilities ✅
git switch -c security/PIXELCRAFT-091-deps
git add package.json package-lock.json .github/
git commit -m "Fix 12 dependency vulns + Dependabot (PIXELCRAFT-091)"
git push origin security/PIXELCRAFT-091-deps
# PR → Review → Merge → Close ticket ✅
The software supply chain is a trust hierarchy.
Supply chain attacks are one of the fastest-growing security threats in software. Your code is only as secure as every package it depends on — including transitive dependencies you've never heard of.