
Security News
NIST Officially Stops Enriching Most CVEs as Vulnerability Volume Skyrockets
NIST will stop enriching most CVEs under a new risk-based model, narrowing the NVD's scope as vulnerability submissions continue to surge.
enhanced-peer-deps
Advanced tools
A smart CLI tool that intelligently resolves peer dependency conflicts across npm, yarn, and pnpm projects.
# Install globally
npm install -g enhanced-peer-deps
# Or with yarn
yarn global add enhanced-peer-deps
# Or with pnpm
pnpm add -g enhanced-peer-deps
Use epd as a drop-in replacement for your package manager's install command:
# Install all dependencies from package.json
epd install
# Or simply
epd
# Add a new package
epd add react
# Add multiple packages
epd add react react-dom
# Add with specific version
epd add react@18.2.0
# Scan for unused dependencies
epd scan
# Check for security vulnerabilities
epd security
# Check for outdated dependencies
epd outdated
# Interactive dependency resolution
epd interactive
# View current configuration
epd config
By default, epd automatically detects your package manager based on lockfiles or availability. You can override this with the --pm flag:
# Force using npm
epd install --pm=npm
# Force using yarn
epd add react --pm=yarn
# Force using pnpm
epd add react --pm=pnpm
When you run epd, it:
| Option | Description |
|---|---|
--pm=<manager> | Force a specific package manager (npm, yarn, pnpm) |
--debug | Enable debug mode with verbose logging |
--interactive | Enable interactive conflict resolution |
--config=<path> | Use custom configuration file |
Create a .epdrc file in your project root:
{
"packageManager": "npm",
"autoResolve": true,
"interactive": false,
"ignorePackages": ["@types/node"],
"preferredVersions": {
"react": "^18.0.0"
},
"timeout": 30000,
"retries": 3
}
If you see an error like:
❌ Forced package manager pnpm is not installed or not in PATH
Make sure the specified package manager is installed and available in your PATH.
If you encounter registry connection problems:
❌ Error fetching versions for react: HTTP error! Status: 404
Check your internet connection and ensure you have access to the npm registry. If you're using a custom registry, verify it's correctly configured in your npm settings.
If you see:
Command 'epd' not found
Ensure the package is properly installed globally. You may need to add the npm global bin directory to your PATH.
Contributions are welcome! Please feel free to submit a Pull Request.
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)This project is licensed under the MIT License - see the LICENSE file for details.
--legacy-peer-deps flagThe following improvements have been made to the project:
TypeScript Migration: The entire codebase has been converted to TypeScript for improved type safety and developer experience. Type definitions are now available for all core interfaces and functions.
Unit Testing: A comprehensive test suite has been added using Node's native test runner, covering core functionality like dependency scanning and report generation.
Type Definitions: Added robust TypeScript interfaces for:
These changes improve code quality, maintainability, and developer experience while ensuring reliable functionality through automated testing.
FAQs
Enhanced peer dependency resolution for npm, yarn, and pnpm
The npm package enhanced-peer-deps receives a total of 7 weekly downloads. As such, enhanced-peer-deps popularity was classified as not popular.
We found that enhanced-peer-deps demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
NIST will stop enriching most CVEs under a new risk-based model, narrowing the NVD's scope as vulnerability submissions continue to surge.

Company News
/Security News
Socket is an initial recipient of OpenAI's Cybersecurity Grant Program, which commits $10M in API credits to defenders securing open source software.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.