## TL;DR
The gate counts vulnerabilities at or above the level you set. Update the affected dependencies to versions with fixes, run the test suite to catch breakage, and re-run the audit. Most fixes are semver-compatible patch bumps.

## The error
```text
npm audit --audit-level=high failed the PR gate: 7 vulnerabilities found
# npm audit report
7 vulnerabilities (2 low, 3 moderate, 2 high)
```

## Steps
### 1. See the full report locally
Run `npm audit` on the PR branch.
Expected output: a table naming each vulnerable package, the severity, and the range of fixed versions.

### 2. Apply the safe fixes first
Run `npm audit fix`.
Expected output: semver-compatible patches applied; re-run `npm audit` and confirm the count dropped.

### 3. Bump the rest manually
For vulnerabilities `npm audit fix` cannot resolve, bump the direct dependency to a fixed version in package.json yourself.
Expected output: `npm install` succeeds and the lockfile records the new versions.

### 4. Run the test suite
Run the project's tests.
Expected output: everything passes. A security bump that breaks the build is not a fix yet.

### 5. Re-run the gate command
Run `npm audit --audit-level=high`.
Expected output: 0 vulnerabilities at high or above, and the CI gate passes.

## When to use
- CI fails with vulnerabilities found at the configured audit level
- A dependency bump PR needs to clear the audit gate
- The report shows fixes available in newer versions

## When not to use
- Vulnerabilities the team formally accepted and waived (document the waiver instead)
- The audit registry itself is down or timing out
- The finding is in a package no shipped code path can reach and policy says to ignore it

## Tool compatibility
- npm 8 and later; the `--audit-level` flag works the same in npm 9/10/11
- pnpm audit and yarn npm audit report the same advisories with different commands
- Works in GitHub Actions, GitLab CI, and local pre-push hooks

## Variant phrasings
### npm audit failed at moderate with 20 vulnerabilities
Same fix, stricter bar. Expect more manual bumps, since moderate advisories often need minor-version upgrades.

### yarn npm audit is failing the gate
Use `yarn npm audit --severity high` to reproduce locally, then bump via `yarn up [package]`.

### pnpm audit found vulnerabilities
Same flow; use `pnpm update [package]` for the manual bumps.

## Why it happens
`--audit-level=high` turns the audit report into an exit code: any vulnerability at high severity or above fails the command. Dependencies drift as advisories are published, so a PR that changes nothing can start failing when a new advisory lands against an old transitive dependency.

## Edge cases
- Transitive vulnerability with no patched upstream: use the `overrides` field in package.json to force the fixed version.
- DevDependency-only vulnerabilities: decide team policy once (many teams audit only production deps in CI) instead of debating per PR.
- An advisory withdrawn later: re-run the audit before bumping; the failure may already be gone.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dLbkzNb8lHltmytmq46G5Q