Gathering detailed insights and metrics for dependency-tree-81
Gathering detailed insights and metrics for dependency-tree-81
Gathering detailed insights and metrics for dependency-tree-81
Gathering detailed insights and metrics for dependency-tree-81
npm install dependency-tree-81
Typescript
Module System
Min. Node Version
Node Version
NPM Version
61.9
Supply Chain
95.8
Quality
71.7
Maintenance
100
Vulnerability
97.6
License
JavaScript (100%)
Total Downloads
47,304
Last Day
213
Last Week
1,182
Last Month
3,637
Last Year
6,762
MIT License
727 Stars
302 Commits
84 Forks
7 Watchers
2 Branches
21 Contributors
Updated on Apr 28, 2025
Minified
Minified + Gzipped
Latest Version
8.1.2
Package Id
dependency-tree-81@8.1.2
Unpacked Size
18.99 kB
Size
6.76 kB
File Count
7
NPM Version
7.5.3
Node Version
15.10.0
Cumulative downloads
Total Downloads
Last Day
610%
213
Compared to previous day
Last Week
3.5%
1,182
Compared to previous week
Last Month
145.7%
3,637
Compared to previous month
Last Year
23.7%
6,762
Compared to previous year
5
Get the dependency tree of a module
npm install --save dependency-tree
1var dependencyTree = require('dependency-tree');
2
3// Returns a dependency tree object for the given file
4var tree = dependencyTree({
5 filename: 'path/to/a/file',
6 directory: 'path/to/all/files',
7 requireConfig: 'path/to/requirejs/config', // optional
8 webpackConfig: 'path/to/webpack/config', // optional
9 tsConfig: 'path/to/typescript/config', // optional
10 nodeModulesConfig: {
11 entry: 'module'
12 }, // optional
13 filter: path => path.indexOf('node_modules') === -1, // optional
14 nonExistent: [] // optional
15});
16
17// Returns a post-order traversal (list form) of the tree with duplicate sub-trees pruned.
18// This is useful for bundling source files, because the list gives the concatenation order.
19// Note: you can pass the same arguments as you would to dependencyTree()
20var list = dependencyTree.toList({
21 filename: 'path/to/a/file',
22 directory: 'path/to/all/files'
23});
requireConfig
: path to a requirejs config for AMD modules (allows for the result of aliased module paths)webpackConfig
: path to a webpack config for aliased modulestsConfig
: path to a typescript config (or a preloaded object representing the typescript config)nodeModulesConfig
: config for resolving entry file for node_modulesvisited
: object used for avoiding redundant subtree generations via memoization.nonExistent
: array used for storing the list of partial paths that do not existfilter
: a function used to determine if a module (and its subtree) should be included in the dependency treeBoolean
. If it returns true
, the module is included in the resulting tree.detective
: object with configuration specific to detectives used to find dependencies of a file
detective.amd.skipLazyLoaded: true
tells the AMD detective to omit inner requiresThe object form is a mapping of the dependency tree to the filesystem – where every key is an absolute filepath and the value is another object/subtree.
Example:
1{ 2 '/Users/mrjoelkemp/Documents/node-dependency-tree/test/example/extended/a.js': { 3 '/Users/mrjoelkemp/Documents/node-dependency-tree/test/example/extended/b.js': { 4 '/Users/mrjoelkemp/Documents/node-dependency-tree/test/example/extended/d.js': {}, 5 '/Users/mrjoelkemp/Documents/node-dependency-tree/test/example/extended/e.js': {} 6 }, 7 '/Users/mrjoelkemp/Documents/node-dependency-tree/test/example/extended/c.js': { 8 '/Users/mrjoelkemp/Documents/node-dependency-tree/test/example/extended/f.js': {}, 9 '/Users/mrjoelkemp/Documents/node-dependency-tree/test/example/extended/g.js': {} 10 } 11 } 12}
This structure was chosen to serve as a visual representation of the dependency tree for use in the Dependents plugin.
npm install -g dependency-tree
dependency-tree --directory=path/to/all/supported/files [--list-form] [-c path/to/require/config] [-w path/to/webpack/config] filename
Prints the dependency tree of the given filename as stringified json (by default).
--list-form
option.Dependency tree takes in a starting file, extracts its declared dependencies via precinct, resolves each of those dependencies to a file on the filesystem via filing-cabinet, then recursively performs those steps until there are no more dependencies to process.
In more detail, the starting file is passed to precinct to extract dependencies. Dependency-tree doesn't care about how to extract dependencies, so it delegates that work to precinct: which is a multi-language dependency extractor; we'll focus on JavaScript tree generation for this example. To do the extraction, precinct delegates the abstract-syntax-tree (AST) generation to the default parser for node-source-walk. Precinct uses the AST to determine what type of JS module the file is (Commonjs, AMD, or ES6) and then delegates to the "detective" that's appropriate for that module type. The "detective" contains the logic for how to extract dependencies based on the module syntax format; i.e., the way dependencies are declared in commonjs is different than in AMD (which has 4 ways of doing that, for example).
After using the detective to get the (raw, like './foobar') dependency strings, precinct passes that back to dependency-tree. Of course, in order to find the dependencies in './foobar', we need to resolve that dependency to a real file on the filesystem. To do this, dependency-tree delegates that task to filing-cabinet: which is a multi-language dependency resolver.
Filing-cabinet reuses (for performance) the AST that precinct made node-source-walk generate. It then does a similar check on the AST to see which module type (commonjs, amd, or es6) is being used in the file (again, we're assuming a regular JS file for this example) and then delegates to the appropriate resolver for that module type. We need different resolvers because a dependency name in AMD could be aliased via a requirejs config. Similarly, commonjs has its own algorithm for resolving dependencies.
So after the appropriate resolver finds the file on the filesystem, filing-cabinet has successfully mapped a raw dependency name to a file on the filesystem. Now, dependency-tree has a file that it can also traverse (repeating exactly what was done for the starting file).
At the end of traversing every file (in a depth-first fashion), we have a fully populated dependency tree. :dancers:
If there are bugs in precinct or if the requireConfig
/webpackConfig
/tsConfig
options are incomplete,
some dependencies may not be resolved. The optional array passed to the nonExistent
option will be populated with paths
that could not be resolved. You can check this array to see where problems might exist.
You can also use the DEBUG=*
env variable along with the cli version to see debugging information explaining where resolution went wrong.
Example: DEBUG=* dependency-tree -w path/to/webpack.config.json path/to/a/file
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
0 existing vulnerabilities detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
SAST tool detected but not run on all commits
Details
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
Reason
Found 3/20 approved changesets -- score normalized to 1
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
Reason
project is not fuzzed
Details
Score
Last Scanned on 2025-05-05
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More