npm audit fix vs npm install
There is something I don't understand with how npm audit fix works. From the docs:
npm audit fixruns a full-fledgednpm installunder the hood
So why when I run npm install and see audit vulnerabilities do I have to run npm audit fix manually to fix them?
npm install without any arguments will just install the dependencies in your package-lock.json (assuming it exists). npm audit fix will use the audit information to figure out what dependencies need to be upgraded and install them, as long as they don't conflict with your package.json.