@hyrious/dup

Find duplicates in your package-lock.json / pnpm-lock.yaml.

This script is using string matching, it is very fast.

Usage

Next Steps

You can run na why {package-name} to find out why they are there in your dependencies tree.

• The duplicates are likely to happen after you have run taze -wi. This is because package managers tend to keep indirect dependencies' versions if updating them is not necessary and for smaller downloading footprint.

  You can run na dedupe to force update all dependencies to the same version (if possible).

• Some modules may deploy their function and CLI in the same package, which results in the CLI's dependencies (yargs, commander, etc.) being included in your dependencies tree and you actually does not need them.

  You can add overrides to remove them, for example:

  "pnpm": {
    "overrides": {
      "critters>chalk": "npm:[email protected]",
      "html-minifier>commander": "npm:[email protected]"
    }
  }

• If an indirect dependency's newer version breaks your codebase, you can either

  • Hack into it (if possible) in your codebase and alter its behavior;
  • Make a patch to fix it manually;
  • Raise an issue to the package's repo.

  I'm just encouraging you to use less dependencies to risk less.

License

MIT @ hyrious