No duplicate dependencies in node_modules
Why it matters
Duplicate dependency versions — two installs of the same library at different patch versions — silently inflate node_modules and the final bundle. Projects with complex dependency trees can end up with lodash@4.17.19 and lodash@4.17.21 both installed, contributing duplicate code to the production bundle. ISO 25010:2011 resource-utilisation flags the storage and bandwidth waste; CWE-1104 (Use of Unmaintained Third-Party Components) applies when the older duplicate version has known vulnerabilities that the newer version has patched.
Severity rationale
Low because duplicate dependencies waste disk space and add bundle weight, but do not cause correctness failures — the impact is proportional to the size and count of the duplicated packages.
Remediation
Run npm ls --depth=0 or npx npm-check to identify duplicate versions. Then deduplicate with a single command.
# In project root — deduplicates hoistable packages in node_modules
npm dedupe
# For pnpm:
pnpm install --dedupe
# Verify no duplicates remain:
npm ls lodash react
If duplicates persist after deduplication, add a resolutions field to package.json (supported by Yarn and pnpm) to pin a single version.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Performance Deep Dive Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1104 — Use of Unmaintained Third-Party Components
- slsa:1.0 · L2 — SLSA L2 — hosted build service; duplicate/unpinned deps weaken provenance
- iso-25010:2011 · performance-efficiency.resource-utilization — Resource Utilisation (performance efficiency)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from performance-deep-dive·automated