Is Superforms really a devDependency?

[sanoodles]

On the docu, https://superforms.rocks/get-started says pnpm i -D sveltekit-superforms but it is not clear to me why the -D flag.

I have tried building a sveltekit 2.48 project with superforms 2.28 as devDependency and then as regular dependency and in both cases the build size was the same. So I assume the builds are equal.

Note that a security downside of marking as devDependency something that is actually in the production build is that pnpm audit --prod does not list its vulnerabilities.

[dualjack]

I believe it is not a dev dependency. There are methods used in production build and some workers will strip the lib.

[bigmac44]

I believe because everything is bundled together (by Vite) in a Svelte project, you only actually need the packages at build time and not run time. This means most svelte dependencies are actually dev dependencies.

https://www.reddit.com/r/sveltejs/comments/17jxpqj/sveltes_blurred_line_dependencies_vs/