{
  "id": "policy/npm-audit-fails-on-high-severity-vulnerability",
  "signature": "npm ERR! code ELIFECYCLE\nnpm ERR! errno 1\nnpm ERR! audit: `npm audit`\nnpm ERR! Exit status 1\nnpm ERR! Found 1 high severity vulnerability",
  "signature_zh": "npm ERR！代码 ELIFECYCLE\nnpm ERR！errno 1\nnpm ERR！audit：`npm audit`\nnpm ERR！退出状态 1\nnpm ERR！发现 1 个高严重性漏洞",
  "regex": "npm ERR! code ELIFECYCLE.*npm ERR! errno 1.*npm ERR! audit.*Found \\d+ high severity vulnerability",
  "domain": "policy",
  "category": "build_error",
  "subcategory": null,
  "root_cause": "The project's npm audit policy (configured in .npmrc or package.json) treats high-severity vulnerabilities as build failures, blocking CI/CD pipelines.",
  "root_cause_type": "generic",
  "root_cause_zh": "项目的 npm audit 策略（在 .npmrc 或 package.json 中配置）将高严重性漏洞视为构建失败，从而阻止 CI/CD 流水线。",
  "versions": [
    {
      "version": "npm 8.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "npm 9.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "npm 10.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Running 'npm audit fix' blindly",
      "why_fails": "Running 'npm audit fix' without understanding the dependency tree can introduce breaking changes or remove necessary packages, leading to runtime errors.",
      "fail_rate": 0.35,
      "condition": "",
      "sources": []
    },
    {
      "action": "Deleting node_modules and reinstalling",
      "why_fails": "Deleting node_modules and package-lock.json then reinstalling does not resolve the vulnerability if the vulnerable package version is pinned in package.json.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    },
    {
      "action": "Using '--json' flag to suppress exit code",
      "why_fails": "Using 'npm audit --json' to bypass the exit code might hide the vulnerability but doesn't address the policy; the CI will still fail if the policy is enforced at a higher level.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Update the vulnerable package to a patched version using 'npm audit fix --force' (if breaking changes are acceptable) or manually upgrade the dependency in package.json.\nExample:\n  npm audit fix --force\n  # Or manually:\n  npm install semver@7.5.2 --save-exact",
      "success_rate": 0.75,
      "how": "Update the vulnerable package to a patched version using 'npm audit fix --force' (if breaking changes are acceptable) or manually upgrade the dependency in package.json.\nExample:\n  npm audit fix --force\n  # Or manually:\n  npm install semver@7.5.2 --save-exact",
      "condition": "",
      "sources": []
    },
    {
      "action": "Override the audit policy in .npmrc to allow high-severity vulnerabilities temporarily by setting 'audit-level=high' to 'audit-level=critical'. This is a workaround for development, not production.\nExample:\n  echo \"audit-level=critical\" >> .npmrc\n  npm audit",
      "success_rate": 0.6,
      "how": "Override the audit policy in .npmrc to allow high-severity vulnerabilities temporarily by setting 'audit-level=high' to 'audit-level=critical'. This is a workaround for development, not production.\nExample:\n  echo \"audit-level=critical\" >> .npmrc\n  npm audit",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use a vulnerability management tool like Snyk or Dependabot to automatically fix vulnerabilities and update PRs, bypassing npm audit's strict exit code.\nExample:\n  # Install Snyk CLI\n  npm install -g snyk\n  snyk test --severity-threshold=high",
      "success_rate": 0.85,
      "how": "Use a vulnerability management tool like Snyk or Dependabot to automatically fix vulnerabilities and update PRs, bypassing npm audit's strict exit code.\nExample:\n  # Install Snyk CLI\n  npm install -g snyk\n  snyk test --severity-threshold=high",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "使用 'npm audit fix --force'（如果可接受破坏性更改）更新易受攻击的包到修补版本，或手动在 package.json 中升级依赖。\n示例：\n  npm audit fix --force\n  # 或手动：\n  npm install semver@7.5.2 --save-exact",
    "在 .npmrc 中覆盖审计策略，临时允许高严重性漏洞，将 'audit-level=high' 设置为 'audit-level=critical'。这仅适用于开发环境，不适用于生产。\n示例：\n  echo \"audit-level=critical\" >> .npmrc\n  npm audit",
    "使用第三方漏洞管理工具如 Snyk 或 Dependabot 自动修复漏洞并更新 PR，绕过 npm audit 的严格退出代码。\n示例：\n  # 安装 Snyk CLI\n  npm install -g snyk\n  snyk test --severity-threshold=high"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://docs.npmjs.com/cli/v10/commands/npm-audit",
  "official_doc_section": null,
  "error_code": "ELIFECYCLE",
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.8,
  "resolvable": "partial",
  "first_seen": "2023-06-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}