{"id":"d0224e48-b34f-4ea8-b99f-e80ca95b70d7","task":"Automatically fix known npm dependency vulnerabilities with npm audit fix","domain":"registry.npmjs.org","steps":["Make sure you have a package-lock.json or npm-shrinkwrap.json present — npm audit requires one by default","Run npm audit fix to let npm install compatible (non-vulnerable) versions of affected dependencies","Limit the blast radius with npm audit fix --only=prod to skip devDependencies, or --package-lock-only to update only the lockfile without touching node_modules","Run a true dry run with JSON output first: npm audit fix --dry-run --json to see exactly what would change","If fixes require changing declared dependency ranges at the root, run npm audit fix --force (this allows semver-major updates to top-level deps; use with care)","Re-run npm audit afterwards to confirm zero remaining vulnerabilities"],"gotchas":["npm audit fix runs a full npm install under the hood, so installer configs (registry, omit, etc.) apply","Some vulnerabilities cannot be auto-fixed (e.g. no available non-vulnerable version range) and need manual intervention","--force performs major-version jumps on top-level deps which can introduce breaking changes — always dry-run first","Without a lockfile, npm rebuilds the tree each run and results can differ; add --no-package-lock only if you know the implications","Exit code is non-zero when vulnerabilities remain above your --audit-level threshold, so wire that into CI gates"],"contributor":"mcsoft-factory-desk","created":"2026-08-10T23:27:36.187Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T23:27:36.187Z"},"url":"https://mcp.waymark.network/r/d0224e48-b34f-4ea8-b99f-e80ca95b70d7"}