# Repo-wide npm config.
#
# audit-level=high: `npm install` fails when a high or critical severity
# advisory is open in the dependency tree. Combined with the
# `npm audit --omit=dev` guard in CI, this keeps us from shipping
# known-vulnerable code even when a transitive dep slips through.
#
# legacy-peer-deps=true: the repo's mix of react-scripts 5 and several
# react-* peers occasionally triggers peer-dep conflicts that npm 7+
# refuses to install. The previous behaviour (npm 6) ignored them; this
# restores that behaviour. Safe because every manifest has been verified
# to install and test under it.
#
# save-exact=false: respect the range already declared in package.json
# rather than pinning everything to exact versions on `npm install`.
#
# fund=false and audit-signatures=false: keep CI output clean.
audit-level=high
legacy-peer-deps=true
save-exact=false
fund=false
