Skip to content

v0.3.0 — Transitive echo detection + 207 well-known patterns

Choose a tag to compare

View all tags
@FlorianBruniaux FlorianBruniaux released this 21 Apr 17:18
· 26 commits to main since this release
v0.3.0
2147ebb

What's new

--check-transitive — Transitive dependency graph analysis

dep-scope scan --check-transitive

Walks the full transitive dependency graph (BFS from your direct deps) and surfaces packages that have native JS alternatives in the e18e database (169 packages). These are the real problem: is-string pulls 160M downloads/month, almost always as a transitive, not a direct install.

Transitive echoes (reportable upstream or via overrides):
  ↗ is-string          via lodash              → typeof x === 'string'
  ↗ has-flag           via chalk               → process.argv.includes('--flag')

Symbol ↗ is intentional: transitive packages can't be removed from your package.json directly. The action is to report upstream or force a version via overrides (npm/pnpm) / resolutions (Yarn). These findings do not trigger exit code 1.

Supported layouts: npm (flat), pnpm (strict + non-strict, .pnpm/ store), Bun (same as npm). Yarn PnP is detected and skipped with a warning.

Performance: BFS with caching. Typical time: ~1s for 1500 packages.

207 well-known patterns (up from 120)

67 new KEEP patterns added to eliminate false positives on common stacks:

  • NestJS: @nestjs/*, rxjs, reflect-metadata, class-validator, class-transformer
  • Fastify: fastify, @fastify/*
  • React Router v7: @react-router/*, react-router
  • Loggers: winston, pino, bunyan, log4js
  • Email: nodemailer, resend, @sendgrid/*
  • HTTP middleware: cors, helmet, cookie-parser, isbot
  • AI SDKs: @anthropic-ai/*, @google/genai, @azure/openai, openai
  • Auth/secrets: @workos-inc/*, @infisical/*
  • ORMs: typeorm, sequelize, mikro-orm, @mikro-orm/*
  • Security: dompurify

Update

npm install -g @florianbruniaux/dep-scope@latest
Assets 2
Loading