Add documentation for no-extraneous-dependencies

CHANGELOG.md

@@ -6,6 +6,7 @@ This change log adheres to standards from [Keep a CHANGELOG](http://keepachangel
 ## [Unreleased]
 ### Added
 - [`no-named-as-default-member`] to `warnings` canned config
+- add [`no-extraneous-dependencies`] rule
 
 ## [1.5.0] - 2016-04-18
 ### Added

README.md

@@ -48,10 +48,12 @@ This plugin intends to support linting of ES2015+ (ES6+) import/export syntax, a
 * Ensure all imports appear before other statements ([`imports-first`])
 * Report repeated import of the same module in multiple places ([`no-duplicates`])
 * Report namespace imports ([`no-namespace`])
+* Forbid the use of extraneous packages ([`no-extraneous-dependencies`])
 
 [`imports-first`]: ./docs/rules/imports-first.md
 [`no-duplicates`]: ./docs/rules/no-duplicates.md
 [`no-namespace`]: ./docs/rules/no-namespace.md
+[`no-extraneous-dependencies`]: ./docs/rules/no-extraneous-dependencies.md
 
 
 ## Installation

docs/rules/no-extraneous-dependencies.md

@@ -0,0 +1,68 @@
+# Forbid the use of extraneous packages
+
+Forbid the import of external modules that are not declared in the `package.json`'s `dependencies` or `devDependencies`.
+The closest parent `package.json` will be used. If no `package.json` is found, the rule will not lint anything.
+
+### Options
+
+This rule supports the following options:
+
+`devDependencies`: If set to `false`, then the rule will show an error when `devDependencies` are imported. Defaults to `true`.
+
+You can set the options like this:
+
+```js
+"import/no-extraneous-dependencies": ["error", {"devDependencies": false}]
+```
+
+
+## Rule Details
+
+Given the following `package.json`:
+```json
+{
+  "name": "my-project",
+  "...": "...",
+  "dependencies": {
+    "builtin-modules": "^1.1.1",
+    "lodash.cond": "^4.2.0",
+    "lodash.find": "^4.2.0",
+    "pkg-up": "^1.0.0"
+  },
+  "devDependencies": {
+    "ava": "^0.13.0",
+    "eslint": "^2.4.0",
+    "eslint-plugin-ava": "^1.3.0",
+    "xo": "^0.13.0"
+  }
+}
+```
+
+
+## Fail
+
+```js
+var _ = require('lodash');
+import _ from 'lodash';
+
+/* eslint import/no-extraneous-dependencies: ["error", {"devDependencies": false}] */
+import test from 'ava';
+var test = require('ava');
+```
+
+
+## Pass
+
+```js
+// Builtin and internal modules are fine
+var path = require('path');
+var foo = require('./foo');
+
+import test from 'ava';
+import find from 'lodash.find';
+```
+
+
+## When Not To Use It
+
+If you do not have a `package.json` file in your project.

src/rules/no-extraneous-dependencies.js

@@ -5,28 +5,28 @@ import isStaticRequire from '../core/staticRequire'
 
 function getDependencies(context) {
   const filepath = pkgUp.sync(context.getFilename())
-	if (!filepath) {
-		return null
-	}
+  if (!filepath) {
+    return null
+  }
 
-	try {
-		const packageContent = JSON.parse(fs.readFileSync(filepath, 'utf8'))
-		return {
+  try {
+    const packageContent = JSON.parse(fs.readFileSync(filepath, 'utf8'))
+    return {
       dependencies: packageContent.dependencies || {},
       devDependencies: packageContent.devDependencies || {},
     }
-	} catch (e) {
-		return null
-	}
+  } catch (e) {
+    return null
+  }
 }
 
 function missingErrorMessage(packageName) {
-	return `'${packageName}' is not listed in the project's dependencies. ` +
-		`Run 'npm i -S ${packageName}' to add it`
+  return `'${packageName}' is not listed in the project's dependencies. ` +
+  `Run 'npm i -S ${packageName}' to add it`
 }
 
 function devDepErrorMessage(packageName) {
-	return `'${packageName}' is not listed in the project's dependencies, not devDependencies.`
+  return `'${packageName}' is not listed in the project's dependencies, not devDependencies.`
 }
 
 function reportIfMissing(context, deps, allowDevDeps, node, name) {