RFC: Opt out of auto-installing peer dependencies

[manzoorwanijk]

Summary

Adds an RFC for an auto-install-peers config that lets a project stop npm from auto-installing required peers and report any package that forgets to declare a peer it consumes. A package author who depends on B (peer react) but never declares react gets no signal today, because npm installs it on B's behalf. The mistake then ships, and consumers on Yarn Plug'n'Play hit it at runtime.

Notable semantics

• Default stays true, so nothing changes unless opted in.
• Checks manifest declarations, not placement, so hoisted and linked give the same result.
• Warns by default; under strict-peer-deps, root and workspace violations fail, third-party ones warn.
• Covers peer chains, workspaces and third-party dependents; optional peers and bundled deps are exempt.
• Stale auto-installed peers in a lockfile are pruned, and npm ci fails as out of sync.
• No effect under legacy-peer-deps.

Related:

• [BUG] npm install does not repair invalid or missing lockfile deps behind a workspace, so strict-peer-deps passes cli#9977
• [RRFC] No auto-install for peerDependencies marked as optional #221

---

Disclosure: Codex and Claude Code were used to draft the initial version of this RFC and to iterate on it during review.

[manzoorwanijk]

CC: @reggi @martinrrm @nkolev92

I will create a draft implementation for you to look at.

[manzoorwanijk]

Here is the draft implementation - npm/cli#10049