depcheck is a tool that helps you to find unused dependencies in your project. It scans your project files and identifies which dependencies are not being used, which can help you to clean up your package.json file and reduce the size of your project.
Check for unused dependencies
This feature allows you to check for unused dependencies in your project. You can specify options to ignore certain directories or dependencies that match specific patterns.
const depcheck = require('depcheck');
const options = {
ignoreDirs: [
'sandbox',
'dist',
'bower_components'
],
ignoreMatches: [
'grunt-*'
]
};
depcheck('/path/to/your/project', options, (unused) => {
console.log(unused.dependencies); // an array containing the unused dependencies
console.log(unused.devDependencies); // an array containing the unused devDependencies
});Check for missing dependencies
This feature allows you to check for dependencies that are used in your project but are not listed in your package.json file.
const depcheck = require('depcheck');
depcheck('/path/to/your/project', {}, (unused) => {
console.log(unused.missing); // a lookup containing the dependencies missing in package.json but used in the code
});Check for invalid files
This feature allows you to identify files in your project that could not be parsed, which might indicate issues with those files.
const depcheck = require('depcheck');
depcheck('/path/to/your/project', {}, (unused) => {
console.log(unused.invalidFiles); // a lookup containing the files that could not be parsed
});npm-check is a similar tool that checks for outdated, incorrect, and unused dependencies. It provides a more interactive experience compared to depcheck, allowing you to update and uninstall packages directly from the command line.
dependency-check is another tool that checks for missing or unused dependencies. It is more focused on ensuring that all dependencies are correctly listed in your package.json file, rather than identifying unused dependencies.
madge is a tool that provides a visual representation of your project's dependency graph. While it does not specifically focus on unused dependencies, it can help you understand the structure of your project and identify potential issues.
Depcheck is a tool for analyzing the dependencies in a project to see: how each dependency is used, which dependencies are useless, and which dependencies are missing from package.json.
npm install -g depcheck
Notice: depcheck needs node.js >= 4.
Depcheck not only recognizes the dependencies in JavaScript files, but also supports these syntaxes:
typescript dependency)node-sass dependency)vue-template-compiler dependency)To get the syntax support by external dependency, please install the corresponding package explicitly. For example, for Typescript user, install depcheck with typescript package:
npm install -g depcheck typescript
The special component is used to recognize the dependencies that are not generally used in the above syntax files. The following scenarios are supported by specials:
bin - Dependencies used in npm commands, Travis scripts or other CI scriptseslint - ESLint configuration presets, parsers and pluginstslint - TSLint configuration presets, parsers and pluginswebpack - Webpack loadersbabel - Babel presets and pluginsfeross-standard - Feross standard format parsermocha - Mocha explicit required dependenciescommitizen - Commitizen configuration adaptorgulp-load-plugins - Gulp-load-plugins lazy loaded pluginsThe logic of a special is not perfect. There might be false alerts. If this happens, please open an issue for us.
depcheck [directory] [arguments]
The directory argument is the root directory of your project (where the package.json file is). If unspecified, defaults to current directory.
All of the arguments are optional:
--ignore-bin-package=[true|false]: A flag to indicate if depcheck ignores the packages containing bin entry. The default value is false.
--skip-missing=[true|false]: A flag to indicate if depcheck skips calculation of missing dependencies. The default value is false.
--json: Output results in JSON. When not specified, depcheck outputs in human friendly format.
--ignores: A comma separated array containing package names to ignore. It can be glob expressions. Example, --ignores="eslint,babel-*".
--ignore-dirs: A comma separated array containing directory names to ignore. Example, --ignore-dirs=dist,coverage.
--help: Show the help message.
--parsers, --detectors and --specials: These arguments are for advanced usage. They provide an easy way to customize the file parser and dependency detection. Check the pluggable design document for more information.
The following arguments are deprecated and will be removed in next major version:
--dev=[true|false]: [DEPRECATED] It leads a wrong result for missing dependencies when it is false. This option will be enforced to true in next major version. The corresponding API option withoutDev is deprecated too.
Similar options are provided to depcheck function for programming.
import depcheck from 'depcheck';
const options = {
withoutDev: false, // [DEPRECATED] check against devDependencies
ignoreBinPackage: false, // ignore the packages with bin entry
skipMissing: false, // skip calculation of missing dependencies
ignoreDirs: [ // folder with these names will be ignored
'sandbox',
'dist',
'bower_components'
],
ignoreMatches: [ // ignore dependencies that matches these globs
'grunt-*'
],
parsers: { // the target parsers
'*.js': depcheck.parser.es6,
'*.jsx': depcheck.parser.jsx
},
detectors: [ // the target detectors
depcheck.detector.requireCallExpression,
depcheck.detector.importDeclaration
],
specials: [ // the target special parsers
depcheck.special.eslint,
depcheck.special.webpack
],
};
depcheck('/path/to/your/project', options, (unused) => {
console.log(unused.dependencies); // an array containing the unused dependencies
console.log(unused.devDependencies); // an array containing the unused devDependencies
console.log(unused.missing); // a lookup containing the dependencies missing in `package.json` and where they are used
console.log(unused.using); // a lookup indicating each dependency is used by which files
console.log(unused.invalidFiles); // files that cannot access or parse
console.log(unused.invalidDirs); // directories that cannot access
});
The following example checks the dependencies under /path/to/my/project folder.
$> depcheck /path/to/my/project
Unused dependencies
* underscore
Unused devDependencies
* jasmine
Missing dependencies
* lodash
It figures out:
underscore is declared in the package.json file, but not used by any code.jasmine is declared in the package.json file, but not used by any code.lodash is used somewhere in the code, but not declared in the package.json file.Please note that, if a subfolder has a package.json file, it is considered another project and should be checked with another depcheck command.
The following example checks the same project, however, outputs as a JSON blob. Depcheck's JSON output is in one single line for easy pipe and computation. The json command after the pipe is a node.js program to beautify the output.
$> depcheck /path/to/my/project --json | json
{
"dependencies": [
"underscore"
],
"devDependencies": [
"jasmine"
],
"missing": {
"lodash": [
"/path/to/my/project/file.using.lodash.js"
]
},
"using": {
"react": [
"/path/to/my/project/file.using.react.jsx",
"/path/to/my/project/another.file.using.react.jsx"
],
"lodash": [
"/path/to/my/project/file.using.lodash.js"
]
},
"invalidFiles": {
"/path/to/my/project/file.having.syntax.error.js": "SyntaxError: <call stack here>"
},
"invalidDirs": {
"/path/to/my/project/folder/without/permission": "Error: EACCES, <call stack here>"
}
}
dependencies, devDependencies and missing properties have the same meanings in the previous example.using property is a lookup indicating each dependency is used by which files.missing and using lookup is an array. It means the dependency may be used by many files.invalidFiles property contains the files having syntax error or permission error. The value is the error details. However, only one error is stored in the lookup.invalidDirs property contains the directories having permission error. The value is the error details.Depcheck just walks through all files and tries to find the dependencies according to some predefined rules. However, the predefined rules may not enough or even be wrong.
There may be some cases in which a dependency is being used but is reported as unused, or a dependency is not used but is reported as missing. These are false alert situations.
If you find that depcheck is reporting a false alert, please open an issue with the following information to let us know:
depcheck --json command. Beautified JSON is better.We use the Github release page to manage changelog.
MIT License.
FAQs
Check dependencies in your node module
The npm package depcheck receives a total of 871,184 weekly downloads. As such, depcheck popularity was classified as popular.
We found that depcheck demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
Security News
A Stanford study reveals 9.5% of engineers contribute almost nothing, costing tech $90B annually, with remote work fueling the rise of "ghost engineers."