---
title: "Outdated dependencies"
slug: outdated-dependencies
severity: medium
category: Configuration
summary: "A lockfile full of old packages is a pile of known bugs you have not looked at. Some are security fixes and some are noise, so you still have to look."
platforms:
  - GitHub
  - Next.js
  - Vercel
updated: "2026-10-13"
related:
  - secrets-committed-to-git
  - missing-security-headers
---

An AI coding session adds packages quickly and rarely comes back to update them. The risk is not "old" by itself. The risk is a known vulnerability in a package your app actually runs, or a malicious release you installed because the name looked right.

GitHub documents Dependabot alerts and security updates as available without buying GitHub Secret Protection or GitHub Code Security. Alerts tell you a dependency has a known vulnerability. Security updates can open a pull request to bump it. Version updates are a separate Dependabot feature for staying current. npm ships an `npm audit` command that reports known vulnerabilities for the packages you have installed. This page did not re-fetch the npm docs on the day it was written, so treat specific `npm audit` flags as something to confirm in the current npm documentation.

Not every alert is equally urgent. A prototype-pollution bug in a build tool you only run locally is not the same as a remote code execution bug in the server framework. Read the advisory before you panic, and before you ignore it.

`npm audit fix --force` can jump major versions and break the app. Do not treat a clean audit as proof the app is secure. It does not see missing RLS.

## How to check in 5 minutes

1. Confirm `package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock` is committed. A repo with only `package.json` installs different versions over time.
2. Run `npm audit` (or the equivalent for your package manager) and read the top of the list. Note which vulnerable packages are dependencies versus dev dependencies.
3. On GitHub, open Dependabot alerts for the repository. GitHub's security features page lists alerts and security updates among features that do not require a paid Advanced Security product.
4. Search `package.json` for packages you do not recognize. An agent may have added a typo-squat or a library that runs code in a `postinstall` script. Supply-chain tools such as Socket are for that case. See the [tools directory](/tools).

## How to fix

### GitHub

Enable Dependabot alerts and security updates if they are off. Add a `dependabot.yml` for version updates if you want weekly pull requests. Review the diff. A green check is not a review of a major bump.

For a public repository, GitHub also documents code scanning and dependency review as available by default. Private repositories need GitHub Code Security for those. Alerts themselves are in the "all plans" section of GitHub's security features page.

### Next.js

Update the framework and the packages your routes import first. Rebuild and click through login, checkout, and a write to the database. Do not merge an audit fix that you have not run.

Commit the lockfile. In CI, install with `npm ci` so the build uses that file.

### Vercel

Vercel builds what you pushed. It does not patch your `node_modules`. A vulnerable dependency stays until you deploy a lockfile that has the fix.

### Supabase

The Supabase client libraries are normal dependencies. Update them the same way. That update does not enable RLS. Do both.

## Agent prompt

```text
You are updating vulnerable dependencies. Do not add features and do not run a blind force upgrade.

1. Read the lockfile situation. If there is no lockfile, add one with a normal install. Do not delete the lockfile.
2. Run the package manager's audit command and list advisories that affect runtime dependencies first.
3. Bump the smallest version range that includes the fix. Do not use npm audit fix --force unless I ask.
4. If a bump is a major upgrade, stop and tell me. Do not take it silently.
5. Leave a short note of what you updated and what I should click-test.

Do not claim the app is secure because the audit is clean.
```

## FAQ

### The audit says moderate and the app is a prototype. Can I ship?

You can ship a prototype to yourself. Do not ship it to other people's data while a known issue in a library you run on the server is still unfixed, unless you have read the advisory and it does not apply to how you use the library. Write down that decision.

### Dependabot is noisy. Should I turn it off?

No. Close the alerts that do not apply with a reason, and merge the ones that do. Turning it off hides the next one.

## Sources

- [GitHub security features, including Dependabot](https://docs.github.com/en/code-security/getting-started/github-security-features)
- [npm audit documentation](https://docs.npmjs.com/cli/commands/npm-audit)