npm-audit-fix

Custom Command: NPM Audit Fix

Command Usage

/npm-audit-fix [path]

Provide an optional project path (defaults to the repository root). The instructions below describe how to audit and remediate NPM vulnerabilities in the target project.

You will help audit and remediate NPM vulnerabilities in a Drupal theme project. The project uses NPM packages to build front-end assets like CSS and JavaScript, and may use NPM, Yarn, or other package managers.

Here is the project path you'll be working with:

<project_path> the project root path </project_path>

Your goal is to investigate the project setup, fix security vulnerabilities, ensure assets build properly in both host and Docker environments, and update documentation to guide developers on front-end asset rendering.

Before executing the remediation steps, wrap your analysis in <project_analysis> tags to systematically document your findings. It's OK for this section to be quite long. Include:

• File Structure: List the key files found in the project (package.json, lock files, Docker files, .nvmrc, etc.)
• Package Manager Detection: Identify which package manager is being used and document the evidence
• Build Environment: Determine if builds happen on host vs Docker and identify the build commands
• Node Version: Check for .nvmrc or other version specifications
• Git Baseline: Record the current git status to establish a baseline
• Vulnerability Assessment: Run and document the results of npm/yarn audit, listing each vulnerability with its severity
• Remediation Strategy: Plan your approach for fixing vulnerabilities while minimizing breaking changes

Before proceeding, make sure the PHP runtime has access to the same project files as the CLI container. The PHP image in this stack does not mount the module code by default, so you must manually sync the files before attempting any audits or Drupal commands:

Mandatory Container Sync (must be performed manually by the assistant)

• Identify the running PHP pod/container for the target environment. For Lagoon-based stacks use kubectl get pods -l lagoon.sh/project=<project-name>,lagoon.sh/service=php (or the equivalent kubectl get pod command provided by the platform). For local Docker Compose environments use docker compose ps php to confirm the container name.
• Determine the CLI container name (typically <project-name> locally or the Lagoon CLI pod). This container has the authoritative Drupal codebase.
• Copy the missing module directories from the CLI container to the PHP container so PHP can load them. Example (Docker): docker cp $(docker compose ps -q cli):/app/web/modules/. $(docker compose ps -q php):/app/web/modules/ and repeat for any other required paths (e.g. /app/vendor, /app/web/profiles). Example (Lagoon/Kubernetes): kubectl cp <cli-pod>:/app/web/modules <php-pod>:/app/web/modules -c php.
• Verify inside the PHP container that the expected module (e.g. upgrade_status) now exists under /app/web/modules/contrib. Do not restart or recreate containers; only manual copying is permitted.