npm 7 ships as default with faster installs, peer-dep enforcement

The npm CLI version 7 has reached general availability and is now published as latest to the npm registry. Running npm install --global npm will now fetch npm 7 by default; users who need the previous major can still get it with npm install --global npm@6.

The release marks a significant internal overhaul. According to the npm team, npm 7 trims dependencies from 123 in npm 6 down to 67, a reduction of roughly 46%. Code coverage is up from 77% to 94%, and project maintainers report "significant" performance gains across their benchmark suite. Development velocity has also shifted, with 45 releases shipped since August—an average of about two per week. The project now operates on a weekly release cadence.

Lockfile v2 and yarn compatibility

The new lockfile format, lockfile v2, is backwards compatible with npm 6 and enables deterministic package tree builds. When npm 7 encounters a project with a v1 lockfile and runs npm install, it will replace that file with the v2 format. To avoid rewriting the lockfile, use npm install --no-save.

npm can now also read yarn.lock files in an existing project. Previously ignored, the yarn lockfile now acts as a source of package metadata and resolution guidance, and npm will keep it current with the package tree as installs proceed.

Peer dependencies enforced by default

Behavior around peer dependencies changes in npm 7. Where npm 4–6 issued warnings for conflicting peer dependencies but continued installing, npm 7 blocks the installation when it cannot automatically resolve an upstream conflict. Developers can override this by retrying with --force or by using --legacy-peer-deps, which ignores peer dependencies entirely and matches the behavior of earlier versions.

Given that deep package trees often contain pre-existing peer conflicts that can't be fixed from a top-level install, npm 7 will emit warnings and work around those deeper conflicts. For fully strict peer resolution at every level of the tree, developers can pass the --strict-peer-deps flag.