Detect missing dependencies

[sindresorhus]

Meaning, dependencies required/imported in the module, but not defined in dependencies. To ensure I don't publish a release that has the dependency incorrectly in the devDependencies field. Like in the sindresorhus/grunt-concurrent#85 case. Could maybe be a ESLint rule.

[jfmengels]

I think you can do that with what is going on in import-js/eslint-plugin-import#241, by running ESLint with this rule

• with option devDependencies set to false
• only on files defined by package.json files field
• or only on files not ignored by .npmignore

If you have neither of those fields set, the tool will have to get really smart about what are "production" files, and what are "dev" files. I'd say if you don't have those, you should not attempt this, as it will almost always fail.

[SamVerschueren]

Would be quite straightforward to implement now that we are using JavaScript as implementation language.

[sindresorhus]

@SamVerschueren I'm going to implement that in XO, so don't think this is needed anymore: xojs/xo#109

[SamVerschueren]

Not for us but maybe people that use ESLint instead of the superior XO ;)

[sindresorhus]

@SamVerschueren They can still use that plugin themselves though. I just think depending on ESLint by default here is a bit heavy and I don't want to deal with support stuff about it.

[SamVerschueren]

Yeah, good point!

[jamestalmage]

I think this can be closed