ejecting adds a lot of dependencies, but it should add them to devDependencies

[attila123]

Is this a bug report?

Yes

Can you also reproduce the problem with npm 4.x?

not relevant

Which terms did you search for in User Guide?

N/A

Environment

1-3: not relevant

4. npm ls react-scripts-ts (if you haven’t ejected): 2.8.0

Then, specify:

1. Operating system: Linux, but not relevant
2. Browser and version (if relevant): not relevant

Steps to Reproduce

1. npm run eject

Expected Behavior

No packages are added under "dependencies" in package.json, but rather to devDependencies, where they really belong. I want to remove all the non-essential 3rd party dependencies for production use ("npm prune --production" (works well in npm 5, finaly...)). This is also a legal issue: the 3rd party stuff you deploy to a customer needs their licences to be checked.

Actual Behavior

Stuff is being added to dependencies:

  Removing react-scripts-ts from devDependencies
  Adding autoprefixer to dependencies
  Adding case-sensitive-paths-webpack-plugin to dependencies
  Adding chalk to dependencies
  Adding css-loader to dependencies
  Adding dotenv to dependencies
  Adding extract-text-webpack-plugin to dependencies
  Adding file-loader to dependencies
  Adding fs-extra to dependencies
  Adding html-webpack-plugin to dependencies
  Adding jest to dependencies
  Adding object-assign to dependencies
  Adding postcss-flexbugs-fixes to dependencies
  Adding postcss-loader to dependencies
  Adding promise to dependencies
  Adding react-dev-utils to dependencies
  Adding source-map-loader to dependencies
  Adding style-loader to dependencies
  Adding sw-precache-webpack-plugin to dependencies
  Adding ts-jest to dependencies
  Adding ts-loader to dependencies
  Adding tslint to dependencies
  Adding tslint-loader to dependencies
  Adding tslint-react to dependencies
  Adding typescript to dependencies
  Adding url-loader to dependencies
  Adding webpack to dependencies
  Adding webpack-dev-server to dependencies
  Adding webpack-manifest-plugin to dependencies
  Adding whatwg-fetch to dependencies

Reproducible Demo

N/A

PS

Should I create a ticket for create-react-app? I know I can edit package.json and move the added dependencies to devDependencies myself, and I will do it. But why not have this fixed in the first place.

[DorianGrey]

Should I create a ticket for create-react-app?

If I've got that in mind correctly, we don't modify the ejection process that much. However, please check if the behavior you observed also occurs on the original CRA. If it does, please open an issue on that repo, Otherwise, please state the difference here, and we'll inspect this further.

[WorldMaker]

Facebook has a strange view of the topic: https://github.com/facebook/create-react-app/issues/2696

[moljac024]

@WorldMaker that's a not a strange view to me, it makes a whole lot of sense in fact. What do you find strange about it?

[WorldMaker]

@moljac024 I try to keep a tight line between runtime dependencies and development dependencies because it keeps things well managed and makes a clearer API to any dependent projects, and in my case I often have dependent projects (separate projects for each runtime environment such as Cordova, Electron, etc; each with their own development time needs such as different webpack setups, etc). Facebook's view here seems strange to me because I read it as "we don't know which libraries might contribute polyfills/etc at runtime, so we just install them all to runtime". Which makes even less sense to me because in this case (ejection) you are replacing/expanding a single devDependency so you should be able to presume all of the dependencies are themselves devDependencies. So the Facebook view here seems strangely hypocritical in this way (everything is a dev dependency when "bundled" pre-ejection, but not after ejection). If all the smaller dependencies can't be relied on to be devDependencies, then you've a problem installing the `-scripts bundle as a dev dependency in the first place, I think. On the flipside though, I do think that all of these are devDependencies and moving them to dependencies on ejection is strange and needlessly creates cleanup busy work for those of use that do use CRA-started projects as libraries in bigger projects.