chore: stop installing with --legacy-peer-deps

.github/workflows/deploy.yml

@@ -55,7 +55,7 @@ jobs:
           echo "Deploying to version $VERSION"
 
       - name: Install dependencies
-        run: npm ci --legacy-peer-deps
+        run: npm ci
 
       # site-search-index.json and the compiled content JSON are both generated
       # and gitignored. Without these the deployed bundle has no site-page

.github/workflows/release-verification.yml

@@ -50,7 +50,7 @@ jobs:
           cache: npm
 
       - name: Install dependencies
-        run: npm ci --legacy-peer-deps
+        run: npm ci
 
       - name: Install Playwright browser
         run: npx playwright install --with-deps chromium

.github/workflows/tests.yml

@@ -25,7 +25,7 @@ jobs:
           cache: npm
 
       - name: Install dependencies
-        run: npm ci --legacy-peer-deps
+        run: npm ci
 
       # No build step needed: no remaining spec imports the workspace libraries
       # from dist/, so this passes on a clean checkout.
@@ -105,7 +105,7 @@ jobs:
           cache: npm
 
       - name: Install dependencies
-        run: npm ci --legacy-peer-deps
+        run: npm ci
 
       # src/styles.scss @use's all three of these from dist/, and the
       # pathway-browser build copies reactome-cytoscape-style's assets, so the

CONTRIBUTING.md

@@ -63,6 +63,19 @@ error anywhere.
 breaks: anything read after the first `await` is not tracked as a dependency, so
 the effect never re-runs for it. Read signals up front, then do the async work.
 
+**Do not add `--legacy-peer-deps`.** It was on every install here until
+2026-09-16, left over from the first CI pipeline, and the tree had long since
+stopped needing it -- `npm ci` resolves strictly today, 2109 packages, measured.
+
+What it cost while it stayed: a dependency bump that could not resolve at all
+passed every check, because the flag accepts an inconsistent tree. Angular's
+packages peer-depend on one another at exact versions, a group bump moved eleven
+of them and left two behind, and nothing said so until a pre-push hook ran
+`npm ci` without the flag.
+
+If an install fails on peer dependencies, the tree is wrong. Fix the versions
+rather than telling npm to stop checking.
+
 **The backend is local.** `proxy.conf.js` points at `http://localhost:8080`,
 where ContentService, AnalysisService and ExperimentDigester all run. Pointing it
 at `dev.reactome.org` instead sends every API call out through Cloudflare and

Dockerfile

@@ -13,7 +13,7 @@ COPY package*.json ./
 RUN sed -i 's/ng serve/ng serve --host 0.0.0.0 --poll 2000/g' package.json
 
 # 4. Install Dependencies
-RUN npm install --legacy-peer-deps --ignore-scripts
+RUN npm install --ignore-scripts
 
 # The dev server runs against a bind-mounted working copy, so everything it
 # writes -- .angular/cache, generated content, dist -- lands in the developer's

documentation/local-environment.md

@@ -26,7 +26,7 @@ Node is the tool that will compile and run the Reactome project. You can downloa
 Once node is installed run the following commands in the `WebsiteAngular/` directory.
 
 ```
-npm install --legacy-peer-deps
+npm install
 npm start
 ```