- [Instructor] An npm audit is basically a command
that will check the dependencies of your project
and make sure they are safe to use.
Whenever you install a new package,
the command npm audit runs automatically
and tells you if there are any issues with the package.
Also make sure you have version six or above of npm
to make sure that this works properly.
So the first thing we'll do is check
with npm -v to make sure that we have the proper version.
So I have 6.2.0 right now therefore I can use npm audit.
If you don't just do a simple sudo npm install npm.
Either select the version so 6.2.0 or just simply install
latest and you can also install the latest this way
and then make sure you install it clovely like that.
But I'm not gonna do that, I already have the right version
so I'm gonna clear my command.
So let's try npm audit.
The first thing I'm gonna do because if I run
an npm audit right now, I know that these are safe
and there's not gonna be any security issue
so let me install something that may have a few warning.
So I'm gonna do npm install socketio.
So as you can see already, when installing socketio
we get a warning that there are some issues
with this package and yours may be a little bit different
because I've already installed this package in the past
so that's why I'm seeing this very condensed version
but you might have a few more warnings in your screen
if you've never installed socketio.
So let's do an npm audit to get a little more detail.
So npm audit.
Now we see a little bit more details.
So let me just go through these.
So let's go to the first one so this is the report
and we get some warnings with low, low,
and I believe I've seen one high warning further down
so this one is a high warning.
So now we see more details as to what could be the issue.
If the issue is low or moderate,
their recommended action is to fix at your own leisure.
But if it is high or critical, like the one we have here,
you need to address this ASAP.
Then in the same report, it gives you
a little bit more details as to what is the issue
so for example here if we look at this one low,
the issue is a Regular Expression Denial of Service
so there's some issues with the code
that is related to regular expression DOS.
So then they name the package, so the package
that where the issue is, when it was patched
and what dependency of it is so it could be
a dependency of express or in this case socketio.
And last but not least, we don't have an example here
but if you see a semveer, so S-E-M-V-E-E-R warning,
that means the patch could be breaking the package
and usually is right below here.
So if you see an extra warning here,
that means if you patch this, it could be breaking
your code or your application.
Then when you checked all this, you could either do
an npm audit fix or simply
install the packages one by one.
I suggest the latter as you don't know which package
could potentially break your app and if so,
you wanna make sure you know who is the culprit
so basically, I would literally go npm install
and then do an update on
parsjson and so on and so forth.
to fix those little issues here
and make sure that if I'm actually breaking my code,
I know exactly where and what actually what broke my code.