npm deprecation warnings are advisory and do not block install

Goal

Define a reproducible dependency policy for a project that must remain buildable from a lockfile while handling deprecated packages.

Constraints

npm install resolves dependencies declared in package.json and writes or updates package-lock.json with exact versions and integrity metadata. npm ci is designed to install strictly from an existing lockfile and will exit with an error if package.json and package-lock.json are out of sync. Deprecated packages remain installable by default; npm surfaces a deprecation warning during install but does not block the install.

Uncertainty

The decision to allow continued use of a deprecated dependency or enforce an upgrade is left to the project. The interaction between advisory warnings, lockfile pinning, and CI enforcement is not codified in the install behavior.

Should a deprecation warning be treated as a hard failure for reproducible builds, and if so, how can that be enforced without changing npm install behavior? Can npm audit configuration be used to provide a support signal for deprecation policy without altering install outcomes? What is the expected project-level decision point for accepting risk on a deprecated package that is already pinned in package-lock.json?