This lesson's interactive features are locked, please to keep using them

Auditing Dependencies

The npm audit command compares the dependency tree in package-lock.json with published security advisories:

npm audit

A clean report is useful: it means no advisory known to the audit service currently matches the locked tree... but it is not proof that the dependencies are safe.

You can also set a threshold for the audit command so that it only fails on "high" or "critical" findings:

{
  "scripts": {
    "audit:security": "npm audit --audit-level=high"
  }
}

This still reports lower-priority findings, but only "high" and "critical" ones cause a nonzero exit status.

When an audit finds a vulnerability, read the dependency path, advisory, available fix, and possible breaking changes before updating.

npm audit fix --force can cross major versions, so don't run it without aggressively testing the updates.

Auditing is a good idea, but it can't find unpublished vulnerabilities, malicious behavior without an advisory, unmaintained design, or risky code outside the locked npm tree, so don't assume a clean report means your app is secure. It's just one of many tools to help you manage risk.

Assignment

Bearly Secure has no reusable dependency-audit policy. Add a named security audit without changing the dependency tree.

Run npm audit and review the reported vulnerabilities. There should be 0.
Add an audit:security package script that runs npm audit --audit-level=high.

Run and submit the CLI tests from the project root.