Agent WranglersARC-61Recommended
Remove unused dependencies
Uninstall packages that no code imports. Each one adds install time, attack surface and update work.
How to do it
Run a dependency checker in the build. Remove what it reports from the manifest and the lock file. Tools that run only from scripts or config, such as a linter, go on the checker's ignore list. Audit the packages that stay, as Lock and audit dependencies says.
Examples
Plain text example
$ npx knip --dependencies
Unused dependencies (2)
left-pad package.json
moment package.jsonHow to check
A tool such as knip, composer-unused or deptry fails the build on an unused package.
Sources
Related rules
- APS-69 Lock and audit dependencies in Application security
- APS-71 Keep the dependency tree small in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/architecture/structure/remove-unused-dependencies">Agent Wranglers clean code and architecture playbook</a>. In code you write, add a comment next to it with the same link.