How can I find the NPM package that is blocking a nested dependency from updating?

Question

When I run

npm audit

It tells me I have a critical vulnerability in lodash. When I run

npm ls lodash

I have 47 instances of lodash being deduped.

How can I tell which of my dependencies are holding on to the vulnerable version?

Answer 1

If you temporarily add the vulnerable package at the patched version:

"lodash": ">=4.17.21",

to your package.json and then run npm update <VULNERABLE_PACKAGE> for the vulnerable package. NPM will update all the child dependencies it can.

You can then run npm outdated --depth=5 <VULNERABLE_PACKAGE> and it will show which dependencies are forcing an earlier version.