npm audit fix and the force flag: what it changes and when to avoid it

npm audit fix applies the remediations npm calculates, working within the ranges you declared. Adding the force flag lets it install versions outside your ranges, including major version changes. Use plain audit fix freely on a branch, and treat force as a manual upgrade that needs review.

What npm audit does

The npm documentation says audit sends a description of your project's dependencies to the registry and asks for known vulnerabilities. If it finds any, it calculates the impact and the remediation. By default it exits with a non-zero code when it finds anything, and the audit-level option sets the minimum severity that triggers the failure without filtering the report. A lockfile is required by default.

What audit fix does

It applies the remediations to your tree. Under the hood it runs a full install, so installer settings apply. For instance, the package-lock-only option updates just the lockfile. The docs note that some vulnerabilities cannot be fixed automatically and need manual review.

What force changes

With force, audit fix may install modules outside your declared range, including semver major changes. The npm page warns that if you do not have a clear idea of what you want to do, it strongly recommends against this option.

Force is also needed when a chain of vulnerable packages reaches the root project and cannot be updated without changing dependency ranges.

A safe order of operations

1. Create a branch and make sure tests pass first.
2. Run npm audit and read the report. Note severity and which are direct or transitive.
3. Run npm audit fix. Review the lockfile diff.
4. Run tests and the build.
5. For what remains, handle each item by hand: upgrade the parent, replace it, or use an override as covered in npm overrides.
6. Use force only for a specific item, then test the affected code.

Development vs production

The omit option leaves dependency types out of the audited tree. Using omit with dev skips development dependencies, and the docs say it also affects what is submitted for audit. That helps you focus on what ships, but development tools still run on your machines and in CI, so do not ignore them forever.

Audit has limits

• It reports known advisories. It does not tell you whether the vulnerable code is reachable from your app.
• It does not judge malicious packages that have no advisory yet.
• A clean report is a point in time. New advisories appear daily.

npm also provides audit signatures, which verifies registry signatures and provenance attestations of downloaded packages. That addresses integrity, not vulnerabilities.

Where a fix tool helps

Reachability analysis can tell you which findings matter first, and autonomous remediation can open fix pull requests. In Safeguard it is off by default, with every category on Manual. The demo below shows a fix being applied.

Click through it at your own pace, or open it full screen.

You can run a free scan at gold.safeguard.sh/scan.

Quick check

Sources

• npm audit, npm Docs

Last reviewed: 19 October 2026.