noUndeclaredDependencies

JavaScript (and super languages)

Summary

Rule available since: v1.6.0
Diagnostic Category: lint/correctness/noUndeclaredDependencies
This rule doesn’t have a fix.
The default severity of this rule is error.
This rule belongs to the following domains:
- project
Sources:
- Same as import/no-extraneous-dependencies

Description

Disallow the use of dependencies that aren’t specified in the package.json.

Indirect dependencies will trigger the rule because they aren’t declared in the package.json. This means that if the package @org/foo has a dependency on lodash, and then you use import "lodash" somewhere in your project, the rule will trigger a diagnostic for this import.

The rule is meant to catch those dependencies that aren’t declared inside the closest package.json, and isn’t meant to detect dependencies declared in other manifest files, e.g. the root package.json in a monorepo setting.

The rule ignores imports that are not valid package names. This includes internal imports that start with # and @/ and imports with a protocol such as node:, bun:, jsr:, https:.

To ensure that Visual Studio Code uses relative imports when it automatically imports a variable, you may set javascript.preferences.importModuleSpecifier and typescript.preferences.importModuleSpecifier to relative.

Examples

Invalid

1
import "vite";

Valid

1
import { A } from "./local.js";

1
import assert from "node:assert";

If you have declared type-fest in the devDependencies section:

1
import type { SetRequired } from "type-fest";

Options

This rule supports the following options:

devDependencies: If set to false, then the rule will show an error when devDependencies are imported. Defaults to true.
peerDependencies: If set to false, then the rule will show an error when peerDependencies are imported. Defaults to true.
optionalDependencies: If set to false, then the rule will show an error when optionalDependencies are imported. Defaults to true.

You can set the options like this:

1
{
2
  "options": {
3
    "devDependencies": false,
4
    "peerDependencies": false,
5
    "optionalDependencies": false
6
  }
7
}

You can also use an array of globs instead of literal booleans. When using an array of globs, the setting will be set to true (no errors reported) if the name of the file being linted (i.e. not the imported file/module) matches a single glob in the array, and false otherwise.

In the following example, only test files can use dependencies in devDependencies section. dependencies, peerDependencies, and optionalDependencies are always available.

1
{
2
  "options": {
3
    "devDependencies": ["tests/*.test.js", "tests/*.spec.js"]
4
  }
5
}

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "correctness": {
5
        "noUndeclaredDependencies": "error"
6
      }
7
    }
8
  }
9
}