npm audit --audit-level=high now exits 0. The advisories were in dev-only dependencies (braces via jest 29).