Is there a way to see dependencies of dependencies in NPM

user_1725871 0
Viewed 851

I have an angular project which I develop on a Windows 10 machine, test using ubuntu on Github Actions and like to checkout and build on my local Linux server as well, to ensure that I have everything set up as it should, and don't have some hidden dependencies.

Github's dependabot and snyk.io both inform me of potential vulnerabilities, but recently I did a rather fresh install npm ci on my local Linux server and noticed several warnings about breaking changes and deprecated packages:

npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.

npm audit shows me details on one of the packages @angular-devkit/build-webpack which implicitly imports chokidar@2.1.8 but the rest are not visible to me.

I know that I don't have explicit imports for these packages, so my question is
Is there an npm command to show me which package is importing the deprecated packages

package.json

{
  "name": "scrum-timer",
  "version": "0.2.24",
  "license": "MIT",
  "scripts": {
    "ng": "ng",
    "start": "node server.js",
    "build": "ng build",
    "test": "ng test",
    "lint": "ng lint",
    "e2e": "ng e2e",
    "bump-version": "npm version patch -m \"Bump version to %s\" && git push --tags",
    "deploy": "ng build --base-href \"https://josste.github.io/ScrumTimer/\" && cp ./dist/index.html ./dist/404.html && angular-cli-ghpages –-no-silent"
  },
  "private": true,
  "dependencies": {
    "@angular/animations": "^12.1.0",
    "@angular/common": "^12.1.0",
    "@angular/compiler": "^12.1.0",
    "@angular/core": "^12.1.0",
    "@angular/forms": "^12.1.0",
    "@angular/platform-browser": "^12.1.0",
    "@angular/platform-browser-dynamic": "^12.1.0",
    "@babel/polyfill": "^7.12.1",
    "bootstrap": "^4.5.3",
    "core-js": "^3.15.1",
    "diff": "^5.0.0",
    "font-awesome": "^4.7.0",
    "jquery": "^3.6.0",
    "npm": "^7.19.0",
    "popper.js": "^1.16.0",
    "rxjs": "^6.6.7",
    "rxjs-compat": "^6.6.7",
    "tether": "^1.4.7",
    "tslib": "^2.2.0",
    "zone.js": "~0.11.4"
  },
  "devDependencies": {
    "@angular-devkit/build-angular": "^0.1102.10",
    "@angular/cli": "^11.2.10",
    "@angular/compiler-cli": "^11.2.11",
    "@angular/language-service": "^11.2.11",
    "@angular/router": "^11.2.11",
    "@types/jasmine": "~3.6.0",
    "@types/jasminewd2": "^2.0.8",
    "@types/node": "^13.13.34",
    "angular-cli-ghpages": "^0.6.2",
    "codelyzer": "^6.0.0",
    "jasmine-core": "~3.6.0",
    "jasmine-spec-reporter": "~5.0.0",
    "karma": "~6.3.2",
    "karma-chrome-launcher": "~3.1.0",
    "karma-cli": "~2.0.0",
    "karma-coverage-istanbul-reporter": "~3.0.2",
    "karma-jasmine": "~4.0.0",
    "karma-jasmine-html-reporter": "^1.5.0",
    "protractor": "~7.0.0",
    "ts-node": "~8.8.2",
    "eslint": "^7.14.0",
    "typescript": "~4.1.5"
  }
}

Solution:

as per RobC

npm ls har-validator@5.1.5 resolve-url@0.2.1 chokidar@2.1.8 uuid@3.4.0 gave a beautiful dependency graph:

npm dependency graph

npm dependency-management
1 Answers

Consider utilizing the npm ls command.

For example:

  1. Firstly cd to your project directory

  2. Then run:

    npm ls har-validator@5.1.5 resolve-url@0.2.1 chokidar@2.1.8 uuid@3.4.0

This will print to stdout a tree structure showing each specific version of a package that is listed in the aforementioned npm ls command.

For example, given the following tree snippet:

└─┬ npm@7.19.1
  └─┬ node-gyp@7.1.2
    └─┬ request@2.88.2
      ├── har-validator@5.1.5
      └── uuid@3.4.0
...

we can ascertain that:

  • Both; har-validator@5.1.5 and uuid@3.4.0 are dependencies of request@2.88.2
  • request@2.88.2 is a dependency of node-gyp@7.1.2
  • node-gyp@7.1.2 is a dependency of npm@7.19.1
user_16114590
Related