npm audit --audit-level=high failed the PR gate: 7 vulnerabilities found
Fixes an npm audit gate failure by updating the vulnerable dependencies to patched versions and re-running the audit. Use when CI fails with vulnerabilities found at the configured audit level. Triggers: npm audit gate failures, audit-level threshold errors. Not for vulnerabilities in dev-only tooling the team accepted, registry outages, or advisories the team explicitly waived.
TL;DR
The gate counts vulnerabilities at or above the level you set. Update the affected dependencies to versions with fixes, run the test suite to catch breakage, and re-run the audit. Most fixes are semver-compatible patch bumps.
The error
npm audit --audit-level=high failed the PR gate: 7 vulnerabilities found
# npm audit report
7 vulnerabilities (2 low, 3 moderate, 2 high)Steps
1. See the full report locally
Run npm audit on the PR branch. Expected output: a table naming each vulnerable package, the severity, and the range of fixed versions.
2. Apply the safe fixes first
Run npm audit fix. Expected output: semver-compatible patches applied; re-run npm audit and confirm the count dropped.
3. Bump the rest manually
For vulnerabilities npm audit fix cannot resolve, bump the direct dependency to a fixed version in package.json yourself. Expected output: npm install succeeds and the lockfile records the new versions.
4. Run the test suite
Run the project's tests. Expected output: everything passes. A security bump that breaks the build is not a fix yet.
5. Re-run the gate command
Run npm audit --audit-level=high. Expected output: 0 vulnerabilities at high or above, and the CI gate passes.
When to use
- CI fails with vulnerabilities found at the configured audit level
- A dependency bump PR needs to clear the audit gate
- The report shows fixes available in newer versions
When not to use
- Vulnerabilities the team formally accepted and waived (document the waiver instead)
- The audit registry itself is down or timing out
- The finding is in a package no shipped code path can reach and policy says to ignore it
Tool compatibility
- npm 8 and later; the
--audit-levelflag works the same in npm 9/10/11 - pnpm audit and yarn npm audit report the same advisories with different commands
- Works in GitHub Actions, GitLab CI, and local pre-push hooks
Variant phrasings
npm audit failed at moderate with 20 vulnerabilities
Same fix, stricter bar. Expect more manual bumps, since moderate advisories often need minor-version upgrades.
yarn npm audit is failing the gate
Use yarn npm audit --severity high to reproduce locally, then bump via yarn up [package].
pnpm audit found vulnerabilities
Same flow; use pnpm update [package] for the manual bumps.
Why it happens
--audit-level=high turns the audit report into an exit code: any vulnerability at high severity or above fails the command. Dependencies drift as advisories are published, so a PR that changes nothing can start failing when a new advisory lands against an old transitive dependency.
Edge cases
- Transitive vulnerability with no patched upstream: use the
overridesfield in package.json to force the fixed version. - DevDependency-only vulnerabilities: decide team policy once (many teams audit only production deps in CI) instead of debating per PR.
- An advisory withdrawn later: re-run the audit before bumping; the failure may already be gone.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_dLbkzNb8lHltmytmq46G5Q