Updating & Auditing

First, see what's out of date

Before changing anything, get the lay of the land. npm outdated lists every package that has a newer version available, in a three-column table worth understanding:

  • Current — what you have installed right now.
  • Wanted — the newest version allowed by your package.json range (the caret rules from the versioning chapter).
  • Latest — the newest version published, ignoring your range.

See which packages are behind

Terminal 
$ npm outdated
In VS Code
  1. Open the terminal (Ctrl+`)
  2. Run npm outdated
  3. Read the Current / Wanted / Latest columns to plan your updates

If a package's Wanted matches Latest, a simple npm update gets you there. If Latest is higher, that's a major bump needing care (below).

The easy updates: npm update

npm update moves packages up to the "Wanted" version — that is, as far as your package.json ranges safely allow (new minors and patches, never a new major). This is the routine, low-risk update you can do regularly.

Apply the safe updates

Terminal 
$ npm update
$ npm run build   # always re-check the build afterwards
In VS Code
  1. Run npm update in the terminal
  2. It refreshes node_modules and the lockfile within your version ranges
  3. Run your build/tests to confirm nothing changed unexpectedly

npm update respects the caret ranges, so it won't jump a package across a major version. That's why it's safe to run often.

The careful updates: a new major version

When npm outdated shows a "Latest" that's a higher major number (say you're on 6.x and 7.0.0 exists), npm update won't take you there on purpose — a major version can include breaking changes. To move up deliberately:

Bump one package to its latest major

Terminal 
$ npm install astro@latest
$ # or a specific version:
$ npm install astro@7.0.0
In VS Code
  1. Read the package's release notes / changelog first — majors can break things
  2. Run the install in the terminal
  3. Run npm run build and test thoroughly before committing

Do majors one package at a time and test between each, so if something breaks you know exactly which update caused it.

Checking for security problems: npm audit

Packages occasionally turn out to have security vulnerabilities. npm audit compares everything you've installed against a public database of known issues and reports any matches, with a severity rating.

Scan for known vulnerabilities

Terminal 
$ npm audit
$ npm audit fix
In VS Code
  1. Run npm audit to see the report
  2. Run npm audit fix to let npm upgrade to safe versions automatically where it can
  3. Re-run npm run build to confirm the fixes didn't break anything

npm audit fix only applies changes allowed by your version ranges. It may suggest 'npm audit fix --force' for breaking fixes — treat that like a major bump and test carefully.

Don't panic at audit warnings. Many reported issues are in deep build-time tools and never affect your shipped site. Read the severity and what the package is used for before forcing a risky fix. After any update, the habit that keeps you safe is simple: npm run build and test.

Up next: when something goes wrong — the reliable fixes for npm's most common errors.

FAQ

Frequently Asked Questions

How do I see which packages are out of date?
Run npm outdated. It lists each package's current, wanted (highest allowed by your package.json range) and latest (newest published) versions.
Does npm update install new major versions?
No. npm update only moves packages up within the range in package.json (e.g. ^4.3.0 stays on 4.x). A new major version needs a deliberate bump and testing.
What does npm audit do?
It checks your installed packages against a database of known security vulnerabilities and reports them. npm audit fix upgrades to safe versions automatically where it can.
Should I run my build after updating?
Always. After any update run npm run build (and your tests) to confirm nothing broke before committing the changed package.json / package-lock.json.