mirror of
https://github.com/github/codeql.git
synced 2026-01-18 17:04:50 +01:00
455b840712
For those documents with no obvious new home I've pointed the links to the Internet Archive.
74 lines
1.7 KiB
XML
74 lines
1.7 KiB
XML
<!DOCTYPE qhelp PUBLIC
|
|
"-//Semmle//qhelp//EN"
|
|
"qhelp.dtd">
|
|
<qhelp>
|
|
<overview>
|
|
<p>
|
|
Specifying an unused dependency in <code>package.json</code> may make packages harder to install.
|
|
The unused dependency will still be downloaded by npm, and if it conflicts with another package
|
|
installation will become difficult or impossible.
|
|
</p>
|
|
<p>
|
|
Dependencies on packages that are only used during development (such as testing frameworks or
|
|
linters) should be listed under <code>devDependencies</code> rather than <code>dependencies</code>,
|
|
since they are not required for deployment.
|
|
</p>
|
|
|
|
</overview>
|
|
<recommendation>
|
|
|
|
<p>
|
|
Remove the unused dependency.
|
|
</p>
|
|
|
|
</recommendation>
|
|
<example>
|
|
|
|
<p>
|
|
In the following example, the <code>package.json</code> file specifies dependencies on both
|
|
<code>acorn</code> and <code>esprima</code>, but in fact only <code>acorn</code> is used.
|
|
The dependency on <code>esprima</code> can simply be removed.
|
|
</p>
|
|
|
|
<sample src="examples/UnusedDependency.js" />
|
|
|
|
<p>
|
|
As another example, the following <code>package.json</code> file specifies a dependency on
|
|
<code>eslint-plugin-babel</code>, a plugin for a popular linter:
|
|
</p>
|
|
|
|
<sample language="javascript">
|
|
{
|
|
"name": "another-example-package",
|
|
"version": "0.1.0",
|
|
"dependencies": {
|
|
"eslint-plugin-babel": "3.3.0"
|
|
}
|
|
}
|
|
</sample>
|
|
|
|
<p>
|
|
Since this dependency is only used during development, it should instead be listed under
|
|
<code>devDependencies</code>:
|
|
</p>
|
|
|
|
<sample language="javascript">
|
|
{
|
|
"name": "another-example-package",
|
|
"version": "0.1.0",
|
|
"devDependencies": {
|
|
"eslint-plugin-babel": "3.3.0"
|
|
}
|
|
}
|
|
</sample>
|
|
|
|
</example>
|
|
<references>
|
|
|
|
|
|
<li>NPM Manual: <a href="https://docs.npmjs.com/cli/v7/configuring-npm/package-json">package.json</a>.</li>
|
|
|
|
|
|
</references>
|
|
</qhelp>
|