ELIFECYCLE policy build_error ai_generated partial

npm ERR! code ELIFECYCLE npm ERR! errno 1 npm ERR! audit: `npm audit` npm ERR! Exit status 1 npm ERR! Found 1 high severity vulnerability

ID: policy/npm-audit-fails-on-high-severity-vulnerability

Also available as: JSON · Markdown · 中文

80%Fix Rate

85%Confidence

1Evidence

2023-06-15First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
npm 8.x	active	—	—	—
npm 9.x	active	—	—	—
npm 10.x	active	—	—	—

Root Cause

The project's npm audit policy (configured in .npmrc or package.json) treats high-severity vulnerabilities as build failures, blocking CI/CD pipelines.

generic

中文

项目的 npm audit 策略（在 .npmrc 或 package.json 中配置）将高严重性漏洞视为构建失败，从而阻止 CI/CD 流水线。

Official Documentation

https://docs.npmjs.com/cli/v10/commands/npm-audit

Workarounds

75% success Update the vulnerable package to a patched version using 'npm audit fix --force' (if breaking changes are acceptable) or manually upgrade the dependency in package.json. Example: npm audit fix --force # Or manually: npm install [email protected] --save-exact
```
Update the vulnerable package to a patched version using 'npm audit fix --force' (if breaking changes are acceptable) or manually upgrade the dependency in package.json.
Example:
  npm audit fix --force
  # Or manually:
  npm install [email protected] --save-exact
```
60% success Override the audit policy in .npmrc to allow high-severity vulnerabilities temporarily by setting 'audit-level=high' to 'audit-level=critical'. This is a workaround for development, not production. Example: echo "audit-level=critical" >> .npmrc npm audit
```
Override the audit policy in .npmrc to allow high-severity vulnerabilities temporarily by setting 'audit-level=high' to 'audit-level=critical'. This is a workaround for development, not production.
Example:
  echo "audit-level=critical" >> .npmrc
  npm audit
```
85% success Use a vulnerability management tool like Snyk or Dependabot to automatically fix vulnerabilities and update PRs, bypassing npm audit's strict exit code. Example: # Install Snyk CLI npm install -g snyk snyk test --severity-threshold=high
```
Use a vulnerability management tool like Snyk or Dependabot to automatically fix vulnerabilities and update PRs, bypassing npm audit's strict exit code.
Example:
  # Install Snyk CLI
  npm install -g snyk
  snyk test --severity-threshold=high
```

中文步骤

使用 'npm audit fix --force'（如果可接受破坏性更改）更新易受攻击的包到修补版本，或手动在 package.json 中升级依赖。
示例：
  npm audit fix --force
  # 或手动：
  npm install [email protected] --save-exact

在 .npmrc 中覆盖审计策略，临时允许高严重性漏洞，将 'audit-level=high' 设置为 'audit-level=critical'。这仅适用于开发环境，不适用于生产。
示例：
  echo "audit-level=critical" >> .npmrc
  npm audit

使用第三方漏洞管理工具如 Snyk 或 Dependabot 自动修复漏洞并更新 PR，绕过 npm audit 的严格退出代码。
示例：
  # 安装 Snyk CLI
  npm install -g snyk
  snyk test --severity-threshold=high

Dead Ends

Common approaches that don't work:

Running 'npm audit fix' blindly 35% fail
Running 'npm audit fix' without understanding the dependency tree can introduce breaking changes or remove necessary packages, leading to runtime errors.
Deleting node_modules and reinstalling 50% fail
Deleting node_modules and package-lock.json then reinstalling does not resolve the vulnerability if the vulnerable package version is pinned in package.json.
Using '--json' flag to suppress exit code 70% fail
Using 'npm audit --json' to bypass the exit code might hide the vulnerability but doesn't address the policy; the CI will still fail if the policy is enforced at a higher level.