dependency-lint

Lints your NPM dependencies and devDependencies reporting which node modules are

• missing and should be added to your dependencies or devDependencies
• unused and should be removed from your dependencies or devDependencies
• mislabeled and should be moved from dependencies to devDependencies or vice versa

Installation

Supported on Node.js versions 12, 14, 16

$ npm install dependency-lint

Usage

$ dependency-lint

To automatically remove unused dependencies and move mislabeled dependencies:

$ dependency-lint --auto-correct

How it works

dependency-lint compares the node modules listed in your package.json and the node modules it determines are used. A node module is used if:

• it is required in a javascript file (or a file that transpiles to javascript)
• one of its executables is used in a script in your package.json or in a shell script

Since this does not cover all the possible ways that a node module can be used, dependency-lint can be configured to ignore specific errors. Please create an issue anytime you need to use this, so we can discuss new ways to determine if and how a node module is used.

Configuration

Please see here for an explanation of all the options. Custom configuration should be placed at dependency-lint.yml in your project directory. You can create a configuration file by running

dependency-lint --generate-config

Any options not set in your configuration file will be given there default value.

Formatters

Three formatters are available and can be switched between with the --format option

dependency-lint --format <format>

• minimal (default) - prints only the modules with errors
• summary - prints all modules
• json - prints JSON of the form {dependencies, devDependencies} where each is array of objects with the keys
  • name - name of the module
  • files - list of the files that require the module or execute the module
  • scripts - list of scripts in your package.json that execute the module
  • error - null or one of the following strings: "missing", "should be dependency", "should be dev dependency", "unused"
  • errorIgnored - if dependency lint has been configured to ignore this error.

Changelog

7.1.0 (2021-07-24)

• Add windows testing to CI
• Update how listed dependency executables are found to reading the package.json files of your dependencies and devDependecies. Thus it is no longer possible to find missing modules via executable usage.

7.0.1 (2021-07-10)

• Republish as 7.0.0 release artifacts are incomplete

7.0.0 (2021-07-10)

• Drop support for Node 8, 10
• Update how listed dependency executables are found (NOTE: this was changed again in 7.1.0)
  • BEFORE: Search node_modules/*/package.json and node_modules/*/*/package.json files for executable configuration
  • AFTER: Search the executables in node_modules/.bin and follow the symbolic links to determine the package

6.0.0 (2019-04-13)

• Drop support for Node 6

5.0.1 (2017-03-20)

• fix published package

5.0.0 (2017-03-18)

• add formatters: minimal (the new default), json, summary (the previous default)

4.3.1 (2016-12-27)

• do not auto correct ignored errors

4.3.0 (2016-11-30)

• fix transpiler support to only use on files matching the extension
• fix installed module validation when module is listed as dependency and devDependency

4.2.0 (2016-10-18)

• extend transpiler configuration to support babel

4.1.5 (2016-10-11)

• fix --auto-correct indentation of package.json

4.1.4 (2016-10-11)

• fix missing built in modules by using npm package: builtin-modules

4.1.3 (2016-08-27)

• update dependencies

4.1.2 (2016-08-27)

• Add CLI option --auto-correct to automatically remove unused dependencies and move mislabeled dependencies.

4.1.1 (2016-08-25)

• respect word boundaries when searching scripts for use of a module's executables

4.1.0 (2016-07-20)

• find module executables by parsing package.json files
  • previously found them by reading the symbolic links in node_modules/.bin
  • adds support for other package managers like ied and pnpm

4.0.2 (2016-06-24)

• update dependencies

4.0.1 (2016-03-27)

• report dependency-lint as used when listed as a devDependency and unused

4.0.0 (2016-03-27)

BREAKING CHANGES

• add ignoreErrors configuration option
  • moved allowUnused to ignoreErrors.unused
• update configuration structure, see the configuration documentation for the new structure
  • devFilePatterns -> requiredModules.files.dev
  • devScripts -> executedModules.npmScripts.dev
  • filePattern -> requiredModules.files.root
  • ignoreFilePatterns -> requiredModules.files.ignore
  • stripLoaders -> requiredModules.stripLoaders
  • transpilers -> requiredModules.transpilers

Updates

• add version as to default devScripts
• expand devFilePatterns
• when validating the versions of installed modules, ignore modules not installed from an npm registry
• add support for searching for module executables in shell scripts, see the configuration documentation

3.1.2 (2016-02-16)

• move configuration documentation from default configuration file to docs folder

3.1.1 (2016-02-13)

• move configuration documentation from README to default configuration file

3.1.0 (2016-02-13)

• check that each module listed in package.json is installed with the correct semantic version

3.0.0 (2016-02-09)

• remove support for configuration files with extensions: cson, coffee, js, json, yaml
  • please convert to dependency-lint.yml
• remove built in support for coffee-script
• add transpilers configuration option
• add filePattern configuration option

2.4.0 (2015-12-03)

• add option to ignore webpack loaders in requires

2.3.0 (2015-10-22)

• add filename to javascript syntax error messages

2.2.1 (2015-07-28)

• update documentation

2.2.0 (2015-07-14)

• add support for config as .yaml, .yml

2.1.0 (2015-07-06)

• add error if module is listed as a dependency and a devDependency
• update dependencies

2.0.0 (2015-06-11)

• add support for config as .coffee, .cson, .js
• update devFiles to devFilePatterns using glob patterns instead of regular expressions
• update ignoreFiles to ignoreFilePatterns using glob patterns instead of regular expressions
• node_modules is no longer ignored by default

1.4.2 (2015-05-26)

• update dependencies

1.4.1 (2015-05-12)

• more informative message when modules are not installed

1.4.0 (2015-05-08)

• add support for scoped modules
• update dependencies

1.3.2 (2015-03-28)

• ignore node_modules folder by default

1.3.1 (2015-03-15)

• update npm errors
  • list as unused when executable used
  • act like normal module when required as globally installed modules cannot be required

1.3.0 (2015-03-14)

• expect npm to be globally installed
  • always require removing it from your package

1.2.1 (2015-03-14)

• update dependencies

1.2.0 (2015-02-17)

• print where a module is used when it has an error

1.1.3 (2015-02-16)

• expose executable

1.1.2 (2015-02-16)

• add .npmignore
• update documentation

1.1.1 (2015-02-16)

• catch coffeescript compilation errors

1.1.0 (2015-02-16)

• rename ignoreUnused to allowUnused

1.0.0 (2015-02-16)

• initial implementation