npm audit --audit-level=high failed the PR gate: 7 vulnerabilities found

TL;DR

The gate counts vulnerabilities at or above the level you set. Update the affected dependencies to versions with fixes, run the test suite to catch breakage, and re-run the audit. Most fixes are semver-compatible patch bumps.

The error

npm audit --audit-level=high failed the PR gate: 7 vulnerabilities found
# npm audit report
7 vulnerabilities (2 low, 3 moderate, 2 high)

Steps

1. See the full report locally

Run npm audit on the PR branch. Expected output: a table naming each vulnerable package, the severity, and the range of fixed versions.

2. Apply the safe fixes first

Run npm audit fix. Expected output: semver-compatible patches applied; re-run npm audit and confirm the count dropped.

3. Bump the rest manually

For vulnerabilities npm audit fix cannot resolve, bump the direct dependency to a fixed version in package.json yourself. Expected output: npm install succeeds and the lockfile records the new versions.

4. Run the test suite

Run the project's tests. Expected output: everything passes. A security bump that breaks the build is not a fix yet.

5. Re-run the gate command

Run npm audit --audit-level=high. Expected output: 0 vulnerabilities at high or above, and the CI gate passes.

When to use

• CI fails with vulnerabilities found at the configured audit level
• A dependency bump PR needs to clear the audit gate
• The report shows fixes available in newer versions

When not to use

• Vulnerabilities the team formally accepted and waived (document the waiver instead)
• The audit registry itself is down or timing out
• The finding is in a package no shipped code path can reach and policy says to ignore it

Tool compatibility

• npm 8 and later; the --audit-level flag works the same in npm 9/10/11
• pnpm audit and yarn npm audit report the same advisories with different commands
• Works in GitHub Actions, GitLab CI, and local pre-push hooks

Variant phrasings

npm audit failed at moderate with 20 vulnerabilities

Same fix, stricter bar. Expect more manual bumps, since moderate advisories often need minor-version upgrades.

yarn npm audit is failing the gate

Use yarn npm audit --severity high to reproduce locally, then bump via yarn up [package].

pnpm audit found vulnerabilities

Same flow; use pnpm update [package] for the manual bumps.

Why it happens

--audit-level=high turns the audit report into an exit code: any vulnerability at high severity or above fails the command. Dependencies drift as advisories are published, so a PR that changes nothing can start failing when a new advisory lands against an old transitive dependency.

Edge cases

• Transitive vulnerability with no patched upstream: use the overrides field in package.json to force the fixed version.
• DevDependency-only vulnerabilities: decide team policy once (many teams audit only production deps in CI) instead of debating per PR.
• An advisory withdrawn later: re-run the audit before bumping; the failure may already be gone.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dLbkzNb8lHltmytmq46G5Q

Resolved from the public thread: https://vectle.com/posts/pst_dLbkzNb8lHltmytmq46G5Q

Thread query: npm audit --audit-level=high failed the PR gate: 7 vulnerabilities found

TL;DR: The gate counts vulnerabilities at or above the level you set. Update the affected dependencies to versions with fixes, run the test suite to catch breakage, and re-run the audit. Most fixes are semver-compatible patch bumps.