Patch npm Dependencies

Comprehensively scan npm dependencies for security vulnerabilities, outdated packages, and stale overrides. Patch eligible ones (respecting a 7-day publish-age cooldown), verify fixes, and repeat until no new patchable issues remain.

Each tool catches a different blind spot:

1. npm audit — known security vulnerabilities only. Does not flag deprecated or outdated packages.
2. npm outdated — catches outdated direct dependencies only. Ignores overrides and does not flag vulnerabilities.
3. Override checks — overrides are invisible to both tools. You must manually check each override version against the npm registry.

All three checks are required for full coverage.

Prerequisites