WebPack可以确定在创建生产捆绑时是否使用DevDediesence？
tl; dr：
是否有一种方法可以配置WebPack（开箱即用或通过某些插件？）来标记 /引起警告，如果代码捆绑（用于生产捆绑包）需要 /导入任何DEV依赖关系？ （直接通过devDepentencies，或通过dev：true在package> package> package-lock.json中间接使用）？
上下文
我们正在配置Disperabot以仅在依赖项中声明的扫描软件包（这是通过使用Displyabot的 允许 config option）。
但是，为了使其成为一个可靠的安全过程（因为我们依靠Disperabot的安全漏洞扫描），我们需要具有一个自动化过程，以确保在dependencies或webpack发出警告，如果任何捆绑代码都包含devDepentency。
一些进一步的潜在相关信息：
这是针对由nx管理的monorepo，并
- 上使用一个
package.json - 在root两个应用程序
应用程序/后端） - 一些共享库（在
libs/*中）
tl;dr:
Is there a way to configure webpack (out-of-the-box or via some plugin?) to flag/raise a warning if the code getting bundled (for a production bundle) requires / imports any dev dependencies? (either directly via devDependencies, or indirectly via dev: true in package-lock.json)?
Context
We are configuring dependabot to only scan packages declared in dependencies (this is achievable by using dependabot's allow config option).
However, in order for this to be a reliable security process (as we are relying on dependabot's security vulnerability scanning), we need to have an automated process that ensure packages are correctly placed either in dependencies or devDependencies. One way to do this would be to have webpack emit a warning if any bundled code includes a devDependency.
Some further potentially relevant info:
This is for a monorepo managed by nx with
- a single
package.jsonat the root - two apps (
apps/frontendandapps/backend) - a few shared libraries (in
libs/*)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
否。没有Webpack插件可以为您执行此操作。还有其他一些依赖图图形模块/CLI工具可以生成这些统计数据。 depCheck 是我经常使用的模块。
它可以告诉您有关未使用和缺少模块的信息，但不完全是您想要的。通常，很难找到这一点。您声称为
devDepentency的内容可能也可能是某些及物包的实际依赖项。同样，强制性同行依赖性也被称为开发依赖性，这使事物更加复杂。最后，您可能还具有仅用于开发目的的脚本，在这些脚本中，您也可以导入这些Dev依赖项。No. There is no Webpack plugin that can do this for you. There are some other dependency graph traversal modules/CLI tools that can generate these stats. The depcheck is one such module that I often use.
It can tell you about unused and missing modules, but not exactly what you seek. In general, it is hard to find that out. It may happen that what you declared as a
devDependencymay also be an actualdependencyfor some transitive package. Also, mandatory peer dependencies are also declared as dev dependencies which further complicate things. Finally, you may also have scripts which are meant only for development purpose and in those scripts, you may also import those dev dependencies.