Use import/no-extraneous-dependencies

[novemberborn]

https://github.com/benmosher/eslint-plugin-import/blob/HEAD/docs/rules/no-extraneous-dependencies.md would help prevent issues like avajs/ava#1823.

The globs would have to be configurable though.

[sindresorhus]

Weird, we already have it included:

xo/config/plugins.js

Line 60 in a28625a

'import/no-extraneous-dependencies': 'error',

[novemberborn]

I think that needs to be ['error', {devDependencies: false}], or rather a (configurable) glob with files that are typically used during development.

[pvdlg]

What would be the list of path typically used in development?
Do we have a way to determine that in a way reliable enough to not be configurable?

[novemberborn]

What would be the list of path typically used in development?

script / scripts, test / tests / __tests__… not sure what else.

Do we have a way to determine that in a way reliable enough to not be configurable?

Ultimately there'll be too many edge cases to not have it be configurable.

[pvdlg]

Ultimately there'll be too many edge cases to not have it be configurable.

Yes indeed. @sindresorhus do you think we should add a dedicated variable for this case?
I wonder if that could be beneficial for other rules.

[pvdlg]

See import-js/eslint-plugin-import#1171 for a possible solution. That would avoid the need for a dedicated option in XO.

If it doesn't get implemented there we could implement it in XO, but I think this a feature that belongs to the plugin rather than XO.

[pvdlg]

We could also use eslint-plugin-node/no-extraneous-require and eslint-plugin-node/no-extraneous-import that doesn't have this problem. However it seems those rules do not distinguish dependencies and devDependencies.

Also eslint-plugin-node/no-unpublished-require verifies that all the required/imported files and module are published (modules are in dependencies and files are in files and not .npmignore).
It was disabled because of mysticatea/eslint-plugin-node#105.
@sindresorhus to workaround the problem you reported, maybe we could enable the rule when either a files property is defined in the package.json or an .npmignore file exist. So for app project where you don't set files nor create an .npmignore the rule would be disabled.