npm: Switch from legacy-peer-deps to strict-peer-deps

[manzoorwanijk]

What?

Replaces legacy-peer-deps = true with strict-peer-deps = true in .npmrc and updates the lockfile.

Why?

legacy-peer-deps was added in #53426 (August 2023) as part of the npm upgrade, to retain npm 6-style behavior where peer dependencies are ignored during resolution. The npm docs explicitly recommend against it:

Use of legacy-peer-deps is not recommended, as it will not enforce the peerDependencies contract that meta-dependencies may rely on.

Switching to strict-peer-deps gives us:

• The peerDependencies contract is actually enforced. With legacy-peer-deps, npm silently ignores peer requirements, so incompatible peer combinations can land unnoticed and only surface as runtime bugs. With strict-peer-deps, any conflicting peer range fails the install immediately, so incompatibilities are caught at dependency-update time instead.
• A smaller, better-deduplicated tree. Peer-aware resolution removes a net 45 nested duplicate installs (mostly picomatch and @octokit/* copies), shrinking package-lock.json by 654 lines.

How?

• .npmrc: legacy-peer-deps = true → strict-peer-deps = true.
• Ran npm install to update package-lock.json. The whole tree resolves cleanly under strict mode — no ERESOLVE conflicts and no overrides needed, confirming our current dependency set already satisfies all peer ranges.

Testing Instructions

1. Delete node_modules and run npm ci (or npm install) — the install must complete without peer-dependency errors and without modifying package-lock.json.
2. Run npm run build and the CI checks — no behavioral changes expected, as no package versions change beyond the hoisting rearrangement.

Testing Instructions for Keyboard

N/A — no UI changes.

Use of AI Tools

Drafted with assistance from Claude Code; the change and lockfile analysis were reviewed by the author.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: manzoorwanijk <manzoorwanijk@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Size Change: 0 B

Total Size: 7.78 MB

_{compressed-size-action}

[manzoorwanijk]

Changed back to draft for now as it creates some lockfile diff like peer: true if you use npm v11 locally, which will be inconvenient to work with. We can wait for #80395 to have npm v11 on CI.

[aduth]

This is a good idea 👍 I recall looking at this in the past and similarly thinking we should drop it.