![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
npm-prestige
Advanced tools
Check and report duplicate -> dependencies@2.0.1
dependencies -> duplicate@1.0.3
inside your installed npm modules
npm -g i npm-prestige
or
yarn global add npm-prestige
npm-prestige
When building large js applications, you sometimes end up with large trees of dependencies. When different dependencies depend on different versions of the same package your final program/bundle will end up with both versions inside. Depending on your application, these extra packages may have negative performance implications (for example if you're developing js for a web application, it will increase the final bundle size the user needs to download over the wire).
Sometimes it gets worse, as npm and yarn won't always dedupe all versions of a package with the same version (if there's another version of the package already installed higher up in the dependency tree) This can lead to the exact same version of a package installed many many times. Note that browserify and some other tools match and dedupe based on the code signature for different dependencies and don't have this problem
Updating your dependencies to all use the same semver range of packages can reduce the final bundle size of your packages.
npm-prestige reports all duplicate dependencies that it finds installed. It uses npm ls
under the hood, and only reports un-deduped packages.
Since npm-prestige
uses npm under the hood, it has a hidden dependency on the version of npm you've globally installed.
It works fine with all versions of npm that I've tested (4.1.0
and up), but prints nicer output with >4.6.0
.
Please submit an issue if it doesn't work with a specific version of npm
FAQs
Finds and summarizes duplicate npm dependencies
We found that npm-prestige demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.