Dependency Error Fixes
Exact error message fixes for npm, PyPI, Ruby, and PHP dependency issues.
Common npm, PyPI, Ruby, and Go dependency errors
These are the most common errors developers hit when managing dependencies — package conflicts, audit failures, lockfile mismatches, and version resolution issues. Each guide includes the exact command to diagnose and the specific fix.
npm audit found high severity vulnerabilities
npm audit fix won't resolve it. The fix requires a major version bump or the vulnerability is in a transitive dependency. Includes npm overrides pattern and force-upgrade commands.
package.json missing lockfile
No package-lock.json or yarn.lock committed to the repo. This causes non-reproducible installs and means transitive vulnerabilities are invisible to audit tools.
Transitive dependency vulnerability — npm overrides
The vulnerable package is not in your package.json — it is pulled in by a dependency you did install. npm audit fix cannot resolve this automatically. Use npm overrides.
pip dependency conflict
Two packages require incompatible versions of a shared dependency. pip cannot install both. Includes resolution strategies for requirements.txt and pyproject.toml projects.
composer memory limit exhausted
Composer runs out of memory resolving dependencies. Common in Laravel projects with many packages. Includes PHP memory limit and COMPOSER_MEMORY_LIMIT fixes.
Bundler version conflict
Gemfile.lock was generated with a different Bundler version. bundle install fails or produces inconsistent results across environments.
Most common transitive vulnerability patterns
Transitive vulnerabilities — CVEs in packages you did not install directly — are the hardest to fix because standard update commands skip them. These are the packages most commonly found as transitive vulnerabilities in 2026:
| Package | Ecosystem | CVE | Fix |
|---|---|---|---|
| cross-spawn | npm | CVE-2024-21538 | npm overrides → 7.0.6 |
| lodash | npm | CVE-2021-23337 | npm overrides → 4.17.21 |
| urllib3 | PyPI | CVE-2023-43804 | pin urllib3>=2.0.7 |
| rails | Ruby | multiple 2024 | bundle update rails |
| log4j | Java | CVE-2021-44228 | upgrade to 2.23.1 |