title: What does "npm audit fix" exactly do?
body: <p><code>npm audit fix</code> is intended to automatically upgrade / fix vulnerabilities in npm packages. However, I haven't found out what it exactly does to fix those vulnerabilities.</p>
  
  <p>I assumed that <code>npm audit fix</code> would upgrade dependencies and dependencies' dependencies to the latest versions that are allowed by the semver-definitions of the packages – effectively the same as <code>rm package-lock.json; npm install</code>. However <code>npm audit fix</code> still performs a lot of changes after lock file removal + reinstall.</p>
  
  <p>What exactly does <code>npm audit fix</code> do? Does it for example install versions of dependencies newer than those allowed by the corresponding <code>package.json</code> (but still semver-compatible)?</p>