deno audit

The deno audit command checks your project's dependencies for known security vulnerabilities. It reads your lock file and reports any advisories found in vulnerability databases.

Examples

Audit all dependencies:

›_

deno audit

Show only high and critical severity vulnerabilities:

›_

deno audit --level=high

Check against the socket.dev vulnerability database:

›_

deno audit --socket

Ignore specific CVEs (useful for suppressing false positives or accepted risks):

›_

deno audit --ignore=CVE-2024-12345,CVE-2024-67890

Ignore advisories that have no available fix:

›_

deno audit --ignore-unfixable

Don't error if the audit data can't be retrieved from the registry:

›_

deno audit --ignore-registry-errors

Auto-fixing vulnerabilities

Starting in Deno 2.8, pass --fix to automatically upgrade vulnerable direct dependencies to a patched, semver-compatible version:

›_

deno audit --fix

deno audit --fix updates package.json / deno.json and regenerates the lockfile. To keep changes safe, it deliberately skips:

Major-version upgrades (reported as unfixable so you can bump them intentionally).
Unsupported version specifier styles such as >=1 <2, 1.x, dist-tags, or aliases — rather than silently rewriting them to a caret range.
Transitive dependencies that don't have a clean direct-dependency upgrade path. These are surfaced as "could not be fixed automatically".

Example output:

╭ @denotest/with-vuln1 is susceptible to prototype pollution
│ ...
Found 2 vulnerabilities
Severity: 0 low, 0 moderate, 1 high, 1 critical

Fixed 1 vulnerability:
  @denotest/with-vuln1 1.0.0 -> 1.1.0

1 vulnerability could not be fixed automatically:
  @denotest/with-vuln2 (major upgrade to 2.0.0)

For a typical CI workflow, run deno audit after deno ci so the install and the security check share the same reproducible state.

Command line usage:

deno audit [OPTIONS]

Audit currently installed dependencies.

deno audit

Show only high and critical severity vulnerabilities

deno audit --level=high

Check against socket.dev vulnerability database

deno audit --socket

Don't error if the audit data can't be retrieved from the registry

deno audit --ignore-registry-errors

Dependency management options

--frozen<BOOLEAN>optional

Error out if lockfile is out of date.

--lock<FILE>optional

Check the specified lock file. (If value is not provided, defaults to "./deno.lock").

--no-lock

Disable auto discovery of the lock file.

Options

--env-file<FILE>optional

Load environment variables from local file Only the first environment variable with a given key is used. Existing process environment variables are not overwritten, so if variables with the same names already exist in the environment, their values will be preserved. Where multiple declarations for the same environment variable exist in your .env file, the first one encountered is applied. This is determined by the order of the files you pass as arguments.

--fix

Automatically fix vulnerabilities by upgrading packages.

--ignore<CVE>

Ignore advisories matching the given CVE IDs.

--ignore-registry-errors

Return exit code 0 if remote service(s) responds with an error.

--ignore-unfixable

Ignore advisories that don't have any actions to resolve them.

--level<level>

Only show advisories with severity greater or equal to the one specified.

--socket

Check against socket.dev vulnerability database.