Which audit-level threshold prevents CI failure for low-severity vulnerabilities?

Answer

In an npm CI job, the --audit-level flag controls the minimum severity that will cause a non‑zero exit code. Setting it to high (or critical) means that only vulnerabilities classified as high or critical will break the build. low and moderate findings are still reported in the audit output, but they do not set the exit code to 1.

Behavior with unfixable nested dependencies

If a vulnerability is found in a nested dependency that npm audit fix cannot resolve, the audit command will still report it. The exit code depends solely on the severity threshold:

• Vulnerability below the threshold – exit code 0, build continues.
• Vulnerability at or above the threshold – exit code 1, build fails.

Thus, an unfixable low or moderate vulnerability in a deep dependency will be logged but will not abort the pipeline.

Verification steps

1. Run npm audit --audit-level=high locally and inspect the exit code:

   npm audit --audit-level=high
   echo $?   # should be 0 if only low/moderate are present

2. In your CI workflow (e.g., .github/workflows/ci.yml), add the flag to the audit step:

   - name: Security audit
     run: npm audit --audit-level=high
     continue-on-error: false

3. Introduce a known low‑severity CVE into package.json and push. The job should finish successfully while the audit report shows the issue.
4. Replace the CVE with a high‑severity one and confirm the job fails.

These steps confirm that the threshold behaves as described: only high or critical findings trigger a CI failure.