Package react-scripts is installed as not a dev dependency

[alexeyraspopov]

Is this a bug report?

Yes

Can you also reproduce the problem with npm 4.x?

Yes

Which terms did you search for in User Guide?

(Write your answer here if relevant.)

Environment

1. node -v: 8.0.0
2. npm -v: 5.0.3
3. yarn --version (if you use Yarn):
4. npm ls react-scripts (if you haven’t ejected): 1.0.10
5. create-react-app --version: 1.3.3

Then, specify:

1. Operating system: macOS Sierra
2. Browser and version (if relevant):

Steps to Reproduce

nvm use 8
npm install --global create-react-app
create-react-app test-app
cd test-app
cat package.json

Expected Behavior

Package react-scripts should appear in devDependencies section

Actual Behavior

Package react-scripts appears next to react-dom in dependencies section.

Reproducible Demo

(Paste the link to an example project and exact instructions to reproduce the issue.)

[yakhinvadim]

This is intentional and was made in v1.0.8. See #2657

[Timer]

This is intentional as your application relies on polyfills provided by the package, warrantying a dependency.
As a side effect, deploying to Now and Heroku is easier.

[alexeyraspopov]

@gaearon, what was the reasoning for this change? I found it pretty confusing (so I opened the ticket) since it's expected behavior after 6+ years of using NPM.

[gaearon]

It fixes deployment issues on some hosting providers that assume only dependencies are needed for the build. The line is also very thin in frontend development. None of them are "runtime" dependencies because we don't have a server and they all get bundled into a single file. So if we were pedantic then we would have to declare everything as devDependencies, including React itself. I just figured that it's not worth conceptual overhead anyway since distinction is largely arbitrary. For example polyfills could be categorised as either.

[alexeyraspopov]

It fixes deployment issues on some hosting providers that assume only dependencies are needed for the build.

Couldn't it be done as just a part of Deployment/Troubleshooting part in README then?

[gaearon]

Sure, but we generally try for more things to work out of the box.

This is a good example of an issue that can be debated endlessly because there's very little technical arguments for and against. I've made a choice there and if you disagree, you can always move those few lines.

[stevenvachon]

The polyfills should be moved out to a "react-polyfills" package, then. "scripts" does not imply polyfills.

[gaearon]

What technical problem are you having?

[stevenvachon]

Semantics.

[gaearon]

You can move it in your package.json and then there is no problem.

Again, unless you’re building a Node.js app, the most correct semantics would be to put everything into devDependencies including react and any libraries you’re using. But there are practical reasons why this is undesirable so we just went with the opposite approach.

[stevenvachon]

react is a dependency because it is included in the final build. A polyfill, such as one for something like <details> would be treated the same. Something like babel is not, and is therefore a devDependency. I'd probably put something like babel-polyfill in devDependencies. With that, react-scripts would follow suit.

[jeremy-ww]

If you are using npm, run this command will move all packages except React into devDependencies.

$ npm i voy -g && voy mg '^(?!react)'

[justinmeiners]

@gaearon I can no longer identify which licenses are used in production and which are just for build tools.