Dependency hygiene: audit, update and prune npm packages

A typical Node.js project depends on a handful of packages you chose and hundreds you did not. Each one can carry a vulnerability, break on an update, or sit unused while still being installed on every build. Left alone, dependencies rot. Updating a project that is three years behind is a project in itself.

A small routine prevents that.

1. Audit for known vulnerabilities

npm audit

The report lists each known vulnerability, its severity and the package that brought it in. npm audit fix applies the updates that stay within your version ranges.

Be careful with npm audit fix --force. It can install new major versions with breaking changes. Read what it plans to do first.

2. See what is out of date

npm outdated

The output has three columns that matter: the version you have, the newest version your range allows, and the latest release.

• npm update moves everything to the newest allowed version. This is usually safe.
• Major versions need a decision. Take them one at a time, read the changelog and run the tests.

Small, regular updates are easy. Rare, giant ones are where projects get stuck.

3. Remove what you no longer use

Packages outlive the code that needed them. A tool can find them:

npx depcheck
# or
npx knip

Review the list, then remove the leftovers with npm uninstall <package>. npm prune cleans node_modules of anything that is not in package.json.

Fewer dependencies mean faster installs, a smaller attack surface and fewer update notifications.

4. Make installs reproducible

• Commit package-lock.json.
• Use npm ci in CI and in Docker builds. It installs exactly what the lockfile says and fails if the two disagree.

5. Let automation do the reminding

• Dependabot or Renovate opens a pull request when an update is available, with the changelog attached.
• Add npm audit --audit-level=high to CI so a serious vulnerability fails the build instead of waiting to be noticed.

A monthly checklist

1. Run npm audit and fix what it reports.
2. Run npm outdated and apply minor and patch updates.
3. Plan one major upgrade if any are pending.
4. Run a cleanup tool and remove unused packages.
5. Run the tests and deploy.

Half an hour a month keeps the project current and the next big upgrade small.

For the wider picture, see software supply chain security. If you manage several packages in one repository, see monorepo dependencies with pnpm and npm workspaces.