deslop/misclassified-dependency

Move a runtime dep consumed only via `import type` into devDependencies.

  • Category: Dead Code
  • Severity: warn
  • Source: deslop-js
  • Framework: global
  • Enabled when: react-doctor deadCode analysis enabled (default true); whole-project scan only — skipped in --diff/--staged modes
  • Documentation: https://github.com/millionco/deslop-js

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires from deslop detectMisclassifiedDependencies when a package declared in package.json dependencies (the detector only ever reads dependencies and reports declaredAs "dependencies") is consumed across the whole module graph ONLY through type-only positions — import type, export type re-exports, or a plain import where every named binding is type-only — with zero value use (no plain value import, side-effect import, dynamic import, or value re-export), so it reports suggestedAs devDependencies (confidence medium, or high for @types/*); the reason reads "<pkg>" is in dependencies but only consumed via import type / export type — consider devDependencies (or keep here if downstream consumers need its types), or for an @types/* package the high-confidence variant "<pkg>" is a @types/* package in dependencies but is only consumed via type imports — should be in devDependencies, with trace listing up to 5 type-only import sites. False positive: the package IS reachable from shipped runtime code through a path the import collector never recorded — a string/CommonJS require(), a bundler alias, or a generated/aliased file not present in graph.modules at all (note side-effect and dynamic imports do NOT qualify here, since deslop already counts both as value-use and so would never fire) — in which case the runtime need is real and moving it to devDependencies breaks the build.

Fix prompt

Use this once validation confirms the diagnostic is real.

Confirm no value import of the package exists anywhere shipped (including string/CommonJS require, bundler aliases, and generated files the scanner can miss), then relocate it in package.json from the "dependencies" block into "devDependencies": cut the "<pkg>": "<version>" line and paste it under devDependencies, keeping the exact version range, since types are erased at build time and a type-only entry in dependencies adds install weight and a phantom runtime requirement for every consumer; for an @types/* package this is almost always correct, so move it without hesitation. See https://docs.npmjs.com/cli/v10/configuring-npm/package-json#devdependencies