noUndeclaredDependencies

JavaScript (and super languages)

Summary

Rule available since: v1.6.0
Diagnostic Category: lint/correctness/noUndeclaredDependencies
This rule doesn’t have a fix.
The default severity of this rule is error.
This rule belongs to the following domains:
- project
Sources:
- Same as import/no-extraneous-dependencies

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "correctness": {
5
        "noUndeclaredDependencies": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow the use of dependencies that aren’t specified in the package.json.

Indirect dependencies will trigger the rule because they aren’t declared in the package.json. This means that if the package @org/foo has a dependency on lodash, and then you use import "lodash" somewhere in your project, the rule will trigger a diagnostic for this import.

The rule is meant to catch those dependencies that aren’t declared inside the closest package.json, and isn’t meant to detect dependencies declared in other manifest files, e.g. the root package.json in a monorepo setting.

The rule ignores imports that are not valid package names. This includes internal imports that start with # and @/ and imports with a protocol such as node:, bun:, jsr:, https:.

To ensure that Visual Studio Code uses relative imports when it automatically imports a variable, you may set javascript.preferences.importModuleSpecifier and typescript.preferences.importModuleSpecifier to relative.

Examples

Invalid

1
{
2
  "dependencies": {}
3
}

1
import "vite";

/index.js:1:8 lint/correctness/noUndeclaredDependencies ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Dependency vite isn’t specified in /package.json.
  
  > 1 │ import “vite”;
      │        ^^^^^^
    2 │ 
  
  ℹ This could lead to errors.
  
  ℹ Add the dependency in your manifest.

Valid

1
{
2
  "dependencies": {
3
    "vite": "*"
4
  }
5
}

1
import "vite"; // package is correctly declared
2

3
import assert from "node:assert"; // Node imports don't need declaration
4

5
import { A } from "./local.js"; // relative imports don't trigger the rule
6
import { B } from "#alias"; // same goes for aliases

Options

This rule supports the following options:

devDependencies: If set to false, then the rule will show an error when devDependencies are imported. Defaults to true.
peerDependencies: If set to false, then the rule will show an error when peerDependencies are imported. Defaults to true.
optionalDependencies: If set to false, then the rule will show an error when optionalDependencies are imported. Defaults to true.

You can set the options like this:

1
{
2
  "linter": {
3
    "rules": {
4
      "correctness": {
5
        "noUndeclaredDependencies": {
6
          "options": {
7
            "devDependencies": false,
8
            "peerDependencies": false,
9
            "optionalDependencies": false
10
          }
11
        }
12
      }
13
    }
14
  }
15
}

You can also use an array of globs instead of literal booleans. When using an array of globs, the setting will be set to true (no errors reported) if the name of the file being linted (i.e. not the imported file/module) matches a single glob in the array, and false otherwise.

Example using the `devDependencies` option

In this example, only test files can use dependencies in the devDependencies section. dependencies, peerDependencies, and optionalDependencies are always available.

1
{
2
  "linter": {
3
    "rules": {
4
      "correctness": {
5
        "noUndeclaredDependencies": {
6
          "options": {
7
            "devDependencies": [
8
              "**/tests/*.test.js",
9
              "**/tests/*.spec.js"
10
            ]
11
          }
12
        }
13
      }
14
    }
15
  }
16
}

1
{
2
  "devDependencies": {
3
    "vite": "*"
4
  }
5
}

1
// cannot import from a non-test file
2
import "vite";

/src/index.js:2:8 lint/correctness/noUndeclaredDependencies ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Dependency vite isn’t specified in /package.json.
  
    1 │ // cannot import from a non-test file
  > 2 │ import “vite”;
      │        ^^^^^^
    3 │ 
  
  ℹ vite is part of your devDependencies, but it’s not intended to be used in this file.
  
  ℹ You may want to consider moving it to the dependencies section.

1
// this works, because the file matches a glob from the options
2
import "vite";