Skip to content

How to change a dependency

A dependency change is a lockfile change: package.json, package-lock.json and .npmrc decide what executes on the CI runner, so a bump is made deliberately — never as a side effect of a bare npm install, npm update or npm audit fix — and a pull request touching any of the three runs the Audit Node Dependencies step automatically. Bump with the steps below; review someone else's bump with the checklist that follows.

Bump a dependency

Requires npm 11.19.0 or newer (see local setup). Nothing installs until step 3.

  1. Rewrite the lockfile only, without touching node_modules:

    npm install --package-lock-only --save-exact <package>@<version>

  2. Take the semver-compatible CVE fixes the bump made available, lockfile only:

    npm audit fix --package-lock-only

    Often a no-op — a fix lands only where a patched version fits the existing ranges.

  3. Run npm run setup — it installs exactly what the new lockfile says and relinks the SF CLI plugins.

  4. Run npm run lint; if the bump changed lint rules, regenerate the baseline (npm run lint:createbaseline) and commit it with package.json and package-lock.json.

SF CLI plugins are dependencies too

sfdx-git-delta and the code-analyzer plugin are exact-pinned devDependencies — bumping them is a dependency change like any other and follows the same procedure. Most CVE findings live inside these plugins' trees; the fix is bumping the plugin pin when Salesforce or sgd release, not patching transitive packages.

Review a dependency pull request

Do not read the lockfile diff hunk by hunk — a generated 20k-line diff defeats any human. Review intent and plausibility:

  1. Do the changed direct dependencies match what the PR claims to do? A lint-rule PR that bumps execa is the red flag, not any transitive noise below it.
  2. New top-level packages you don't recognize — ask.
  3. resolved URLs pointing anywhere other than registry.npmjs.org — reject.
  4. Missing integrity hashes on new entries — reject.
  5. Major-version jumps nobody mentioned — ask.

The audit step covers the rest:

The audit step… On
Blocks Malware advisories (CWE-506 / GHSA malware naming)
Reports, does not block CVEs
Verifies Registry signatures and attestations of every installed package
Flags Versions published less than 7 days ago

On a malware hit: do not merge, rotate the org credentials (revoke OAuth tokens, reissue auth URLs), and purge the pipeline npm cache.