Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
depcheck is a tool that helps you to find unused dependencies in your project. It scans your project files and identifies which dependencies are not being used, which can help you to clean up your package.json file and reduce the size of your project.
Check for unused dependencies
This feature allows you to check for unused dependencies in your project. You can specify options to ignore certain directories or dependencies that match specific patterns.
const depcheck = require('depcheck');
const options = {
ignoreDirs: [
'sandbox',
'dist',
'bower_components'
],
ignoreMatches: [
'grunt-*'
]
};
depcheck('/path/to/your/project', options, (unused) => {
console.log(unused.dependencies); // an array containing the unused dependencies
console.log(unused.devDependencies); // an array containing the unused devDependencies
});
Check for missing dependencies
This feature allows you to check for dependencies that are used in your project but are not listed in your package.json file.
const depcheck = require('depcheck');
depcheck('/path/to/your/project', {}, (unused) => {
console.log(unused.missing); // a lookup containing the dependencies missing in package.json but used in the code
});
Check for invalid files
This feature allows you to identify files in your project that could not be parsed, which might indicate issues with those files.
const depcheck = require('depcheck');
depcheck('/path/to/your/project', {}, (unused) => {
console.log(unused.invalidFiles); // a lookup containing the files that could not be parsed
});
npm-check is a similar tool that checks for outdated, incorrect, and unused dependencies. It provides a more interactive experience compared to depcheck, allowing you to update and uninstall packages directly from the command line.
dependency-check is another tool that checks for missing or unused dependencies. It is more focused on ensuring that all dependencies are correctly listed in your package.json file, rather than identifying unused dependencies.
madge is a tool that provides a visual representation of your project's dependency graph. While it does not specifically focus on unused dependencies, it can help you understand the structure of your project and identify potential issues.
Keeping track of your dependencies is not an easy task, especially if you have a big project. Are you sure you are using all of the dependencies you define in your package.json
file? One way to find out is to look at all your files and check which modules you are using, but that's too time consuming. Or maybe you can do a grep
on all the files of your project, and then some grep -v
to remove the junk. But that's a hassle too.
And that is why depcheck
exists - it's a nifty little tool that looks at your project files and scans your code in order to find any unused dependencies.
grunt.tasks.loadNpmTasks
call.npm install depcheck -g
depcheck [directory] [arguments]
The directory
argument is the root directory of your project (where the package.json
file is). It will be the current directory when not specified.
All the arguments are optional:
--dev=[true|false]
: A flag indicates if depcheck looks at devDependencies
. By default, it is true
. It means, depcheck looks at both dependencies
and devDependencies
.
--ignore-bin-package=[true|false]
: A flag indicates if depcheck ignores the packages containing bin entry. The default value is true
.
--json
: Output results to JSON. When not specified, depcheck outputs in human friendly format.
--ignores
: A comma separated array containing package names to ignore. It can be glob expressions. Example, --ignores=eslint,babel
.
--ignores-dirs
: A comma separated array containing directory names to ignore. Example, --ignore-dirs=dist,coverage
.
--help
: Show the help message.
--parsers
, --detectors
and --specials
: These arguments are for advanced usage. They provide an easy way to customize the file parser and dependency detection. Check the pluggable design document for more information.
Want to call depcheck from code? See the example:
var path = require('path');
var depcheck = require('depcheck');
var options = {
withoutDev: false, // check against devDependencies
ignoreBinPackage: false, // ignore the packages with bin entry
ignoreDirs: [ // folder with these names will be ignored
'sandbox',
'dist',
'bower_components'
],
ignoreMatches: [ // ignore dependencies that matches these globs
'grunt-*'
],
parsers: { // the target parsers
'*.js': depcheck.parser.es6,
'*.jsx': depcheck.parser.jsx
},
detectors: [ // the target detectors
depcheck.detector.requireCallExpression,
depcheck.detector.importDeclaration
],
specials: [ // the target special parsers
depcheck.special.eslint,
depcheck.special.webpack
]
};
depcheck('/path/to/your/project', options, function(unused) {
console.log(unused.dependencies); // an array containing the unused dependencies
console.log(unused.devDependencies); // an array containing the unused devDependencies
console.log(unused.invalidFiles); // files that cannot access or parse
console.log(unused.invalidDirs); // directories that cannot access
});
MIT License.
0.5.10 (2015-11-22)
Closed issues:
Merged pull requests:
FAQs
Check dependencies in your node module
The npm package depcheck receives a total of 438,706 weekly downloads. As such, depcheck popularity was classified as popular.
We found that depcheck demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.