JavaScript

1982 readers

1 users here now

founded 1 year ago

MODERATORS

erlingur@programming.dev

Ategon@programming.dev

nick@programming.dev

Am I using devDependencies wrong or is everyone bad at explaining it? (lemmy.world)

submitted 9 months ago by BrianTheeBiscuiteer@lemmy.world to c/javascript@programming.dev

15 comments fedilink hide all child comments

Official docs say it's for

Packages that are only needed for local development and testing.

Umm, okay. Not 100% clear there. Some articles mention things like ESLint or Jest (k, I'm onboard there) but others mention Babel or WebPack. I get that you don't need WebPack libraries to be loaded in the browser but how the hell do you bundle up your code without it? When you use npm ci or npm install you'll get all dependencies but isn't it good practice (in a CICD environment) to use --omit=dev or --only=prod?

you are viewing a single comment's thread
view the rest of the comments

[–] MariusGundersen@programming.dev 4 points 9 months ago (2 children)

You only need to worry about devDependencies vs dependencies if you are going to publish the project you are working on as an npm package. If you are making a webapp or something else that you will run, then it doesn't matter.

[–] winky9827b@lemmy.world 4 points 9 months ago (1 children)

Not always. If you're publishing your app as a docker image, you want the final image to exclude dev depending to be a small as possible.

[–] BrianTheeBiscuiteer@lemmy.world 1 points 9 months ago

This isn't exactly the case but yes, I would prefer to keep the dependency list as small as possible, mainly because I'm subject to security scans and I don't want things to get held up because there's a vulnerability in my linter.

[–] Vincent@feddit.nl 1 points 9 months ago* (last edited 9 months ago)

Exactly. If nobody ever runs npm install <yourpackage>, don't worry about it. (Like, literally, you can put half your dependences in dependencies and half in devDependencies and it will be fine.)

If you do, then every dependency the person who runs that command doesn't necessarily need goes into your devDependencies.