# `deslop/misclassified-dependency`

Move a runtime dep consumed only via `import type` into devDependencies.

- **Category:** Dead Code
- **Severity:** warn
- **Source:** deslop-js
- **Framework:** global
- **Enabled when:** react-doctor deadCode analysis enabled (default true); whole-project scan only — skipped in --diff/--staged modes
- **Documentation:** <https://github.com/millionco/deslop-js>

## Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires from deslop detectMisclassifiedDependencies when a package declared in package.json dependencies (the detector only ever reads dependencies and reports declaredAs "dependencies") is consumed across the whole module graph ONLY through type-only positions — `import type`, `export type` re-exports, or a plain import where every named binding is type-only — with zero value use (no plain value import, side-effect import, dynamic import, or value re-export), so it reports suggestedAs devDependencies (confidence medium, or high for @types/*); the reason reads `"<pkg>" is in dependencies but only consumed via import type / export type — consider devDependencies (or keep here if downstream consumers need its types)`, or for an @types/* package the high-confidence variant `"<pkg>" is a @types/* package in dependencies but is only consumed via type imports — should be in devDependencies`, with trace listing up to 5 type-only import sites. False positive: the package IS reachable from shipped runtime code through a path the import collector never recorded — a string/CommonJS require(), a bundler alias, or a generated/aliased file not present in graph.modules at all (note side-effect and dynamic imports do NOT qualify here, since deslop already counts both as value-use and so would never fire) — in which case the runtime need is real and moving it to devDependencies breaks the build.

## Fix prompt

Use this once validation confirms the diagnostic is real.

Confirm no value import of the package exists anywhere shipped (including string/CommonJS require, bundler aliases, and generated files the scanner can miss), then relocate it in package.json from the "dependencies" block into "devDependencies": cut the `"<pkg>": "<version>"` line and paste it under devDependencies, keeping the exact version range, since types are erased at build time and a type-only entry in dependencies adds install weight and a phantom runtime requirement for every consumer; for an @types/* package this is almost always correct, so move it without hesitation. See https://docs.npmjs.com/cli/v10/configuring-npm/package-json#devdependencies