noDuplicateDependencies (JSON)

Language JSON (and super languages)

Summary

• Rule available since: v2.2.4
• Diagnostic Category: lint/suspicious/noDuplicateDependencies
• This rule isn’t recommended, so you need to enable it.
• This rule doesn’t have a fix.
• The default severity of this rule is warning.
• Sources:
  • Same as package-json/unique-dependencies
  • Same as package-json-dependencies/duplicate-dependencies

How to configure

biome.json

{
  "linter": {
    "rules": {
      "suspicious": {
        "noDuplicateDependencies": "error"
      }
    }
  }
}

Description

Disallow duplicate dependencies in package.json.

A package must not appear twice in the same dependency group. The rule checks dependencies, devDependencies, optionalDependencies, peerDependencies, overrides, bundledDependencies, and bundleDependencies.

Examples

Invalid

package.json

{
    "dependencies": {
        "foo": "1.0.0",
        "foo": "2.0.0"
    }
}

/package.json:4:9 lint/suspicious/noDuplicateDependencies ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ The dependency "foo" is listed twice under dependencies.
  
    2 │     "dependencies": {
    3 │         "foo": "1.0.0",
  > 4 │         "foo": "2.0.0"
      │         ^^^^^
    5 │     }
    6 │ }
  
  ℹ The dependency is also specified here.
  
    1 │ {
    2 │     "dependencies": {
  > 3 │         "foo": "1.0.0",
      │         ^^^^^
    4 │         "foo": "2.0.0"
    5 │     }
  
  ℹ This can lead to package manager issues and confusion for other developers. To resolve this, remove one of the listings.
  

package.json

{
    "bundleDependencies": ["foo", "foo"]
}

/package.json:2:35 lint/suspicious/noDuplicateDependencies ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ The dependency "foo" is listed twice under bundleDependencies.
  
    1 │ {
  > 2 │     "bundleDependencies": ["foo", "foo"]
      │                                   ^^^^^
    3 │ }
    4 │ 
  
  ℹ The dependency is also specified here.
  
    1 │ {
  > 2 │     "bundleDependencies": ["foo", "foo"]
      │                            ^^^^^
    3 │ }
    4 │ 
  
  ℹ This can lead to package manager issues and confusion for other developers. To resolve this, remove one of the listings.
  

Valid

package.json

{
    "dependencies": {
        "foo": "2.0.0"
    }
}

package.json

{
    "bundleDependencies": ["foo"]
}

The rule also prevents these conflicts between groups:

• a package in dependencies cannot also appear in devDependencies, optionalDependencies, or peerDependencies;
• a package cannot appear in both optionalDependencies and peerDependencies.

A package in devDependencies may also appear in optionalDependencies or peerDependencies. The overrides, bundledDependencies, and bundleDependencies groups are not compared with other groups.

Cross-group examples

Invalid

package.json

{
    "dependencies": {
        "foo": "1.0.0"
    },
    "devDependencies": {
        "foo": "1.0.0"
    }
}

/package.json:6:9 lint/suspicious/noDuplicateDependencies ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ The dependency "foo" is also listed under devDependencies.
  
    4 │     },
    5 │     "devDependencies": {
  > 6 │         "foo": "1.0.0"
      │         ^^^^^
    7 │     }
    8 │ }
  
  ℹ The dependency is also specified here.
  
    1 │ {
    2 │     "dependencies": {
  > 3 │         "foo": "1.0.0"
      │         ^^^^^
    4 │     },
    5 │     "devDependencies": {
  
  ℹ This can lead to package manager issues and confusion for other developers. To resolve this, remove one of the listings.
  

Valid

package.json

{
    "dependencies": {
        "foo": "1.0.0"
    }
}

Related links

• Disable a rule
• Configure the code fix
• Rule options
• Source Code (Edit this Page)
• Test Cases
• Try in the playground