unused-packages

Category: nursery. Default: off. Fixable: yes. Since: 0.1.0.

What it does

Reports a package that a package.json declares and that none of its modules imports.

Why is this bad?

An unused dependency costs install time and audit work, and it ships for no reason.

How it works

A package counts as used when a module that the package.json governs imports it. The package.json that governs a module is the nearest one above the module. The subpath of the import does not matter. These packages also count as used:

• @types/x follows x.
• @types/node follows any built-in module.
• The peer dependencies of a used package.

The rule does not see two kinds of use. A script can only run a package, for example a CLI. The configuration of a tool can load a package. Add these packages to ignore. The rule skips a package.json that governs no module of the graph.

Options

• production: do not check devDependencies, and ignore the imports of tests. oxcruise --production enables it.
• test: globs of test modules. These globs add to *.test.*, *.spec.* and test directories.
• sections: the package.json sections to check. The default is dependencies, peerDependencies and optionalDependencies. Most devDependencies are tools that no module imports.
• ignore: globs of package names to skip.
• conventions: packages that a tool loads by name count as used when the same package.json lists the tool. For example @vitest/* next to vitest, and *-loader next to webpack. The default is true (all conventions). Use false to disable them, or a list of names to keep only those conventions.

A violation of this rule is in a package.json, and a comment cannot suppress it there. Use ignore instead.

Fix

This rule is fixable. oxcruise --fix removes the entry from the package.json.

Configure the rule

{
  "rules": {
    "unused-packages": "error"
  }
}

To set options, use an object: the level, then the options of the rule.