search

import-js / eslint-plugin-import

ESLint plugin with rules that help validate proper imports.
MIT License
5.58k stars 1.57k forks source link

Add option to `no-extraneous-dependencies` to check shrinkwrap #546

Open jfmengels opened 8 years ago

jfmengels commented 8 years ago

Just thinking of this : If a package has a npm-shrinkwrap.json file, any (production) dependencies should also appear in the shrinkwrap.

I'm proposing to add a new option (checkShrinkwrap: bool?) to add an additional check for dependencies (that we know are production dependencies), to verify that they also appear at the top level of the shrinkwrap.

What do you think?

PS: Yup. This rule has a lot of options...

benmosher commented 8 years ago

My new barometer for rule creation/mutation is "will I immediately be glad I can use this?"

If no: not right now.

It would be cool to validate that shrinkwrap matches dependencies, but that feels more like a script to call during posttest/prepublish than a lint rule.

But again: if you'll use it and be glad you have it, do it. 😄

jfmengels commented 8 years ago

My new barometer for rule creation/mutation is "will I immediately be glad I can use this?"

Sounds like a good rule of thumb :+1:

I need to talk about it to colleagues, but I think we'd definitely use it at work. It happens sometimes (too often at least) that dependencies are added to the projects without the shrinkwrap being updated. I agree that a separate tool could be used for this (there probably exists some, don't know any, but I haven't looked for any either), but I think that this would be a nice addition here. It would be one less think to set up in a project, as ESLint configs are shareable, but build processes are not.

Now that I think of it, this could get a bit harder when there are multiple shrinkwraps in a project (as we've seen with the multiple package.json issues), though I don't know if (and thus how...) that is used somehow.