Manifest rules

Hygiene of the root and member package.json files: field placement, ordering and toolchain declarations.

Rule	Default severity	Fixable
empty-dependencies	error	safe
incompatible-peer-dependencies	warning	none
local-path-dependency	error	sometimes
member-toolchain-fields	warning	unsafe
root-package-dependencies	warning	unsafe
root-package-manager-field	error	none
root-package-private-field	error	safe
types-in-dependencies	error	unsafe
unsorted-dependencies	error	safe

Fixable is safe (applied by --fix), unsafe (applied only by --fix-unsafe), sometimes (fixable for some findings) or none. See the CLI reference.

empty-dependencies

A dependency section (dependencies, devDependencies, peerDependencies, optionalDependencies) is an empty object.

• Default severity: error
• Fixable: safe

[rules]
empty-dependencies = "error"

incompatible-peer-dependencies

The version a package installs in devDependencies does not satisfy the range it declares in peerDependencies.

• Default severity: warning
• Fixable: none

[rules]
incompatible-peer-dependencies = "warn"

local-path-dependency

A dependency points at a path on disk (link:, file:, portal: or a relative path) instead of a registry or workspace version.

• Default severity: error
• Fixable: sometimes
• sherif name: local-path-dependencies

[rules]
local-path-dependency = "error"

member-toolchain-fields

Member packages should not declare packageManager or engines; the root package owns the toolchain.

• Default severity: warning
• Fixable: unsafe

[rules]
member-toolchain-fields = "warn"

root-package-dependencies

The root package should only have devDependencies; runtime dependencies belong to the packages that use them.

• Default severity: warning
• Fixable: unsafe

[rules]
root-package-dependencies = "warn"

root-package-manager-field

The root package.json must declare the package manager in packageManager or devEngines.packageManager.

• Default severity: error
• Fixable: none

[rules]
root-package-manager-field = "error"

root-package-private-field

The root package.json must set "private": true so it cannot be published by accident.

• Default severity: error
• Fixable: safe

[rules]
root-package-private-field = "error"

types-in-dependencies

A private package lists @types/* packages in dependencies; type packages belong in devDependencies.

• Default severity: error
• Fixable: unsafe

[rules]
types-in-dependencies = "error"

unsorted-dependencies

The entries of a dependency section are not in alphabetical (byte) order.

• Default severity: error
• Fixable: safe
• sherif name: unordered-dependencies

[rules]
unsorted-dependencies = "error"