Framework dependencies listed as peerDependencies

Listing React, Vue, or any consumer-provided framework in dependencies instead of peerDependencies installs a second copy of that framework in the consumer's node_modules. For React specifically, this triggers the infamous "Invalid hook call" error because two separate React instances exist at runtime — a hard crash, not a degraded experience. It also silently doubles the framework's bundle weight. SSDF PS.3.2 flags this as a supply chain concern: you're injecting unverified versions of major frameworks into consumer apps. ISO 25010 interoperability fails when your version range conflicts with the host app.

Move framework dependencies from dependencies to peerDependencies with broad version ranges, and keep them in devDependencies for local development.

{
  "peerDependencies": {
    "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
    "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0"
  },
  "devDependencies": {
    "react": "^18.0.0",
    "react-dom": "^18.0.0"
  }
}

For optional peer dependencies (e.g., a Vue adapter that's only needed for Vue users), add a peerDependenciesMeta entry: { "vue": { "optional": true } }. Test with the oldest and newest versions in your peer range.