Most dependency audit tools exit with a non-zero code when they find vulnerabilities. npm audit, yarn npm audit, pip-audit and composer audit work this way. Dependency-Check fails above a CVSS score you set, and NuGet audit raises warnings that you can treat as errors. Knowing the rule tells you how to wire each into a pipeline.
Definitions
Exit code. The number a command returns to the shell. Zero is success.
Threshold. The severity or score at which a tool starts to fail.
Gate. A pipeline step that stops the build on failure.
Behaviour by tool
| Tool | Exit behaviour | Threshold control |
|---|---|---|
| npm audit | 0 when none found, non-zero by default otherwise | Audit level option sets the minimum severity, without filtering the report |
| yarn npm audit | Non-zero when a report is found for the selected packages | Docs do not say whether severity or ignore change the code |
| pip-audit | 0 for none, 1 for one or more found | None; the code cannot be suppressed |
| composer audit | 0 for no issues, 1 when packages match policies or the audit failed | Ignore severity option |
| Dependency-Check | Exit code reflects whether a score at or above the CVSS threshold was found | Fail on CVSS option, 0 to 10 |
| NuGet audit | Restore warnings NU1901 to NU1904 | Treat chosen codes as errors |
| pnpm audit | Not listed in general in the docs | Audit level option, check behaviour in your version |
Steps
- Run the tool locally on a known vulnerable project and note the exit code.
- Decide the threshold you want the pipeline to enforce.
- Wire the command into CI. Avoid pipes that swallow the exit code.
- Add a distinct step or job name, so a failure is readable.
- Save the report as an artifact.
npm audit --audit-level=high; echo $?
pip-audit -r requirements.txt; echo $?
Pitfalls
- Piping output to another command can mask the code unless your shell fails on pipe errors.
- A fallback that forces success, such as an or true suffix, silences the gate.
- A tool that failed to reach its data source may exit differently from one that found issues. Check the documented codes, for example composer treats missing packages as a failed audit.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a pull request and see which rule blocks the merge.
Quick check
Why does CI pass even though the tool printed findings?
Often a pipe or a forced success hid the exit code. Run the command alone and check.
Can I make pip-audit ignore its exit code?
The project says the code cannot be suppressed. Teams that need to continue use a shell fallback, which should be a deliberate choice.
Safeguard policy gates can block a pull request on findings that match your rules. A free scan shows what would trigger them.
Sources
- npm docs, npm audit
- Yarn docs, yarn npm audit
- pip-audit on GitHub
- Composer documentation, audit
- OWASP Dependency-Check CLI arguments
- Microsoft Learn, Auditing package dependencies
- pnpm docs, pnpm audit
Last reviewed: 19 October 2026.
