Flag use of implicit import

[timotheeguerin]

Importing a library that is not explicititly defined in the pacakge.json can cause issues with varioius package managers.

[github-actions]

🎯 Issue Triage

Feature request to add a diagnostic/warning when a TypeSpec file imports a library that is not explicitly declared as a dependency in package.json, as implicit imports can cause issues with various package managers.

Category: Feature Request

Area: compiler:core

🔍 Analysis

• The compiler currently allows importing libraries that are reachable via node_modules but not explicitly listed as dependencies in package.json.
• This can lead to broken installs with strict package managers (pnpm, Yarn PnP, etc.) that enforce explicit dependencies.
• The fix would involve the compiler reading package.json and warning when an import resolves to a package not listed in dependencies/devDependencies/peerDependencies.
• Affected component: TypeSpec compiler's module resolution / import validation logic.

📝 Suggested next steps

• Determine whether this should be a hard error or a warning/hint
• Define the rule: check top-level import statements against package.json dependencies
• Consider whether devDependencies and peerDependencies should also satisfy the check
• Add a new compiler diagnostic (e.g., implicit-dependency) with a clear message pointing to the missing package.json entry

Generated by Agentic Triage