Unused devDependencies

[christianbundy]

Hi. I'm using some modules for tests, and Dependency-Check keeps throwing errors:

Fail! Modules in package.json not used in code: cont, json-buffer, tape

How can I identify which files are dev-only files vs which are being deployed to production? Here's a relevant bit from my package.json:

{
  "main": "index.js",
  "directories": {
    "test": "test"
  }
}

Does Dependency-Check have some way that I can identify which modules have dependencies and which have devDependencies? Thanks!

[mixmix]

funny seeing you here :laughing:

[christianbundy]

:~)

I'm using depcheck now and I'd recommend it. On one hand, it's less minimalist... but on the other hand, it's less minimalist.

https://github.com/depcheck/depcheck

[voxpelli]

Sorry for missing this issue. You can use --no-dev to ignore all dev dependencies, or the --ignore-module module-name / -i module-name to ignore a specific module.

In your case -i cont -i json-buffer -i tape would ignore those three.

Also possible to use wildcards, like -i @types/* to ignore all @types/ modules.

[christianbundy]

@voxpelli Thanks for the feedback! That's what I've been using as a workaround, but is there a way to automatically set this? These dependencies are only used in my test/ directory, which is identified in package.json (http://wiki.commonjs.org/wiki/Packages/1.0#Optional_Fields), but dependency-check doesn't automatically treat those files differently than production dependencies.

[mixmix]

I think this is the challenge I was facing. It was saying some deps were unused - e.g. tape, scuttle-testbot. But these were in fact being used in test folder. I just had to turn off checking dev deps, which felt bad because now I can't guarentee that the test setup has the deps it needs. But at least production deps are covered

[voxpelli]

@mixmix Have you specified that it should look among the tests then?

[mixmix]

I am not sure? I copied the auto check example about checking before npm publish and assumed that would be a default that would work well with all node projects, including those with tests (as mafintosh wrote it!)

[voxpelli]

([ "$1" != "publish" ] || dependency-check .) && command npm "$@"

This runs dependency-check . – there are more options than that and I'm not sure whether that's still the setup that @mafintosh uses.

I myself use husky to run dependency-check: https://github.com/voxpelli/node-connect-pg-simple/blob/1b4784d2969c80ce28a4289901a8434e264926a7/package.json#L25

[voxpelli]

As for the directories, none of them are added by default at the moment: https://github.com/dependency-check-team/dependency-check/blob/d22bc2dba44e4c28fb63d77bf2c9911ca8310f72/index.js#L221-L248

Adding them as default would be a breaking change now, but maybe something for next major version