如何使用CI检查NPM依赖关系

Question

I've recently been trying to find a way to have a regular check on the dependencies of a project, this would ideally look for new versions of packages as well as deprecation.

At the moment, npm-check, depcheck and other such plugins seem to either not work or aren't returning the results that I'd expect (ie not flagging unused dependencies).

Does anyone know of a good way to test for this kind of thing?

Answer 1

For new versions of packages, I've been pleased with greenkeeper . It sends you pull requests whenever a new version of a package you depend on is released. Then your CI configuration should run tests against the code in the PR.

Not sure if they currently warn about deprecated packages, but the theory is if you are always using the latest release, you will never be using a deprecated version. That is unless the entire package and all versions get deprecated for some reason.

I don't believe it flags unused dependencies either, but you might consider asking them to add that feature. Their support seems pretty attentive to the needs of users.

Answer 2

I ended up using the David NPM module to check the status of the packages and pass / fail a mocha test based on the result:

https://github.com/alanshaw/david

You can see the example code on web-starter-kit:

https://github.com/google/web-starter-kit/blob/11562f490fe17cfc88ba86742de6345469b70779/test/dependency-checker.js