Update Node.js and vulnerable packages

Before updating

Open the website's Overview → Security. It shows support information for the detected Node.js version and known dependency vulnerabilities. Create a backup before changes and make sure you can test locally or in staging.

Update the runtime

1. Check the supported Node.js version recommended by the dashboard and your project's compatibility. Production applications should use a supported LTS release.
2. Change the setting identified by the dashboard: engines.node in package.json, .nvmrc, .node-version, the NIXPACKS_NODE_VERSION variable or Dockerfile.
3. Test installation, building and the application's main features with the chosen version.
4. Push file changes to GitHub and deploy. If the version comes from an environment variable, save the change on the dashboard's Environment page.

Update dependencies

Read the advisory shown in the dashboard and update the affected package or the dependency that brings it into the project. For npm projects, npm audit shows the report and npm audit fix can resolve some problems. Review the changes and run the project's tests. Do not use --force without assessing potentially breaking updates.

Push the updated package.json and your package manager's lockfile to GitHub. Deploy significant changes to staging first.

Check the new deployment

Confirm that the dashboard shows the updated runtime and a new package check. If the lockfile is missing or unreadable, fix that before interpreting the results. The absence of known vulnerabilities alone does not establish that the entire application is secure.