
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
better-deps
Advanced tools
CLI for reducing issues with JavaScript dependencies in monorepos/workspaces.
The changes implemented by this CLI may help reduce issues encountered in certain common monorepo setups, but they may not be applicable or preferable in all cases.
Currently, each command has a --check
mode which can be used in CI, but the commands must be run individually. In the future, the tool may be modified to follow more of a "linter" model with a configurable list of rules, or entirely rewritten as an ESLint plugin.
hoist-dev-deps
Remove devDependencies
from individual packages and declare them at the monorepo/workspace root instead.
This approach helps mitigate issues with package manager behavior (particularly Yarn v1) and reduce churn, but it has some downsides. Alternatively, some repos may prefer to use a package manager which implements strict installation layout (essentially the opposite of this strategy).
--check
: Check for issues without making any changes, and exit non-zero if issues are found (good for CI)--exclude <deps...>
: Don't hoist these devDependencies
--only <deps...>
: Only hoist these devDependencies
(mutually exclusive with other options)--threshold <percent>
: Only hoist devDependencies used in >= this percent of packages. This can help mitigate concerns about how hoisting makes it less explicit which packages actually use which dependencies.
--always <deps...>
: Always hoist these devDependencies
(only relevant with --threshold
)# Hoist all dev deps
better-deps hoist-dev-deps
# Check that no new non-hoisted deps have been introduced
better-deps hoist-dev-deps --check
# Hoist all dev deps except @storybook/html
better-deps hoist-dev-deps --exclude @storybook/html
# Hoist dev deps used by >= 50% of packages
better-deps hoist-dev-deps --threshold 50
# As above, but always hoist typescript and react deps
better-deps hoist-dev-deps --threshold 50 --always typescript react react-dom @types/react @types/react-dom
# Only hoist @types/react and @types/react-dom
better-deps hoist-dev-deps --only @types/react @types/react-dom
This is a potentially "less bad" approach to mitigate issues with package manager behavior and reduce churn, though it has some downsides.
devDependencies
. This is especially important for frequent updates with a tool such as Renovate or Dependabot.
"foo": "^1.0.0"
from 1.1.0
to 1.2.0
) has been improved, so its recommended config presets no longer pin devDependencies
by default.devDependencies
without accidentally introducing mismatches and duplicates. (But you should also be using syncpack or another tool to prevent mismatches!)node_modules
. Yarn (at least v1) seems nondeterministic about which package version it chooses to install at the repo root if more than one version is present anywhere in the tree, sometimes leading to different behavior between computers. (npm may also have a variant of this problem when generating or updating the lock file.)devDependencies
. This can be mitigated somewhat by using the --threshold
option to hoist only things that are widely used.Another approach which eliminates implicit hoisting while avoiding the cons listed above is to use a package manager which implements strict installation layout instead (essentially the opposite of this strategy). Some examples are pnpm, midgard-yarn-strict, or npm's upcoming isolated mode once implemented. However, this approach doesn't address issues of churn from updating devDependencies
.
star-local-dev-deps
Change version specs of devDependencies
on local packages (those defined within the monorepo/workspace) to *
.
--check
: Check for issues without making any changes, and exit non-zero if issues are found (good for CI)better-deps star-local-dev-deps
Many monorepos define build scripts or configuration in local packages (which may also be published), and all the other packages have devDependencies
on the shared build packages. Using *
for those devDependencies
minimizes churn and merge conflicts when package versions are updated, while also maintaining the dependency graph.
unpin-dev-deps
Change exact versions of external devDependencies
to use ^
or ~
ranges (excluding anything using a prerelease version). This is mainly an easy way to revert Renovate's old behavior of pinning devDependencies
.
--check
: Check for issues without making any changes, and exit non-zero if issues are found (good for CI)--exclude <deps...>
: Don't modify these devDependencies
--patch <deps...>
: Only allow patch version of these deps to vary (~
)# Unpin all dev deps
better-deps unpin-dev-deps
# Unpin all dev deps except typescript and prettier
better-deps unpin-dev-deps --exclude typescript prettier
# Unpin all dev deps, using ~ versions for typescript and prettier
better-deps unpin-dev-deps --patch typescript prettier
FAQs
CLI for reducing issues with JavaScript dependencies
We found that better-deps demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.