Dev dependencies separated
Why it matters
Build tools, test frameworks, and type definitions in dependencies instead of devDependencies bloat production installs and Docker images with packages that serve no runtime purpose. ISO 25010:2011 §6.5.1 classifies this as a structural defect. More concretely: typescript in dependencies means your production Node.js server or serverless function installs the TypeScript compiler on every cold start — adding hundreds of milliseconds to deploy times and attack surface for a tool that is never invoked at runtime.
Severity rationale
Low because miscategorized dependencies bloat production artifacts and extend attack surface without causing functional failures, making it a hygiene issue rather than a security emergency.
Remediation
Move build-time packages to devDependencies. Common packages that belong there: typescript, all @types/*, test runners (jest, vitest), linters (eslint, biome), and formatters (prettier).
# Move typescript from dependencies to devDependencies
npm uninstall typescript
npm install -D typescript
# Move jest to devDependencies
npm uninstall jest @types/jest
npm install -D jest @types/jest ts-jest
Verify your production build still works after the move:
npm install --omit=dev
npm run build
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Code Quality Essentials Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modularity — Maintainability — Modularity
Taxons
History
- 2026-04-18·v1.0.0·Initial import from code-quality-essentials·automated