Bundle impact of significant new dependencies is evaluated

Without bundle analysis tooling, you have no visibility into the JavaScript payload your users download. A single npm install can add 100KB to your production bundle without any visible signal in your development workflow — and that cost compounds with each new dependency. The ISO 25010 performance-efficiency characteristic requires that resource use be measured and managed relative to functional requirements; shipping an unmeasured bundle means you cannot know whether that requirement is being met. SSDF PW.4 treats third-party component evaluation as ongoing, not one-time. Bundle analysis is the instrumentation that makes that evaluation possible: you cannot manage what you cannot see.

Add a bundle analyzer to your dev dependencies and configure it for on-demand analysis. For Next.js:

npm install --save-dev @next/bundle-analyzer

// next.config.js
const withBundleAnalyzer = require('@next/bundle-analyzer')({
  enabled: process.env.ANALYZE === 'true',
})
module.exports = withBundleAnalyzer({})

# Run analysis before merging any PR that adds a dependency
ANALYZE=true npm run build

For Vite projects, use rollup-plugin-visualizer. For non-Next.js webpack projects, use webpack-bundle-analyzer.