[BUG] `npm audit fix` installes incompatible peer dependencies

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

I run npm audit fix, npm warns about "npm warn ERESOLVE overriding peer dependency"

Expected Behavior

Run the npm audit fix subcommand to automatically install compatible updates to vulnerable dependencies.

(Highlight by me)

https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities?ref=content-for-engineers-by-engineers-atomist-blog#security-vulnerabilities-found-with-suggested-updates

Steps To Reproduce

package.json

package-lock.json

Run npm audit fix

Environment

• npm: 11.16.0
• Node.js: v24.18.0
• OS Name: Debian forky/sid
• System Model Name: N/A
• npm config:

; "builtin" config from /usr/share/nodejs/npm/npmrc

prefix = "/usr/local"

Reproduce the report with the attached package.json and package-lock.json by running npm audit fix, and capture the ERESOLVE warning and resulting dependency changes. Trace how the audit fix command selects updates and resolves peer dependencies; done means vulnerable dependencies are updated without installing incompatible peer dependencies.