.npmrc

# Security hardening: disable lifecycle scripts (including postinstall) to reduce npm supply-chain risk.
# npm docs: https://docs.npmjs.com/cli/v10/using-npm/config#ignore-scripts
# See also https://snyk.io/articles/npm-security-best-practices-shai-hulud-attack/
# Note: this also prevents automatic execution of this repo's `prepare` script (husky). To enable git hooks locally, run `npm run prepare` after install.
ignore-scripts=true

# Security hardening: reject git-based dependencies (git+ssh://, github: URLs, etc.).
allow-git=none

# Security hardening: skip package versions published less than 7 days ago (based on CISA's guidance).
min-release-age=7

# Fail on peer dependency conflicts so dependabot PRs with broken peer deps are rejected.
strict-peer-deps=true