9

I have a Vue.js project with only 24 direct dependencies in the package.json. That results in 1230 total dependencies in the package-lock.json.

One of the transitive dependencies has a license that is not allowed in my organization. I did some research on Google on how to exclude transitive dependencies in NPM, but I couldn't find anything useful.

In Maven (Java world) there is an optional exclusions list for each direct dependency. Is there something similar for NPM? How can I permanently remove a transitive dependency from my project?

Improve this question
6
  • 1
    Half out of curiosity - What's the "bad" package, and what package is depending on it? After all, if it's a hard dependency, the depending package may break.
    – AKX
    Commented Aug 10, 2020 at 15:55
  • 1
    You can resolve to a specific version (only potentially useful), or hack the lock file. I don't think you can change the package itself w/ resolutions (e.g., replace the package w/ an API-compatible one). But if you exclude it, and it's actually being used, things will break.
    – Dave Newton
    Commented Aug 10, 2020 at 15:58
  • @AKX for example webpack-chain (MPL-2.0) is a transitive dependency of @vue/cli-service. I figured out that this module is not part of the deliverable, not distributed to customers, that's why it's ok after all. But anyway, in future I might have a transitive dependency with GPL license which I will need to exclude. Not all dependencies are always mandatory. The developer should at least have the option to exclude dependencies, just like in the Java world with Maven. Really don't know why NPM is so limiting.
    – Robert Reiz
    Commented Aug 11, 2020 at 9:44
  • 1
    Honestly, your best bet might be a postinstall script that obliterates or replaces any bad packages from your node_modules tree.
    – AKX
    Commented Aug 11, 2020 at 10:00
  • 2
    stackoverflow.com/questions/36758157 has the answer. "overrides": { "yourlib": "../_EXCLUDED_" } does the trick if the transitive lib is actually unused, but there may still be unused imports of it that have to be disabled too.
    – fo2rist
    Commented Jun 28, 2023 at 0:14
Related questions
13
NPM: Never install nested optional dependencies for npm package
27
How can I forcibly exclude a nested dependency for NPM?
8
NPM / Yarn suppress unmet dependencies warning if dependency is globally installed
Load 7 more related questions Show fewer related questions

0

Reset to default

Browse other questions tagged or ask your own question.