Dependencies vs devDependencies
Separate packages your app needs from tools used only in development.
Syntax
npm install --save-dev nodemonpackage.json splits packages into two groups:
- dependencies — needed to run the app (e.g.
express). - devDependencies — needed only while developing (e.g. test runners,
nodemon).
Choosing the group
Install a dev-only tool with the --save-dev (or -D) flag. In production you can skip dev packages with npm install --omit=dev for a smaller install.
Example
# Runtime dependency
npm install express
# Development-only dependency
npm install --save-dev nodemon
# Production install (skip devDependencies)
npm install --omit=devWhen to use it
- A production Docker image built with `npm install --omit=dev` is significantly smaller because dev tools like Jest and ESLint are excluded.
- A release script checks `npm outdated` weekly to find dependencies that have fallen behind their latest patch releases before a deployment.
- A security audit job runs `npm audit --audit-level=high` in CI to block deploys when high-severity vulnerabilities are found in any dependency.
More examples
dependencies vs devDependencies
Shows the two main dependency buckets -- `dependencies` ship to production, `devDependencies` stay local.
{
"dependencies": {
"express": "^4.18.2",
"pg": "^8.11.0"
},
"devDependencies": {
"jest": "^29.7.0",
"eslint": "^8.57.0",
"nodemon": "^3.0.0"
}
}Audit and fix vulnerabilities
Uses `npm audit` to scan the dependency tree for vulnerabilities and `npm audit fix` to patch them.
# List all known vulnerabilities
npm audit
# Automatically fix patchable ones
npm audit fix
# Force-fix (may include breaking changes)
npm audit fix --forceList and update outdated packages
Checks for outdated packages, updates within semver ranges, and removes an unused dependency.
# Show what's outdated
npm outdated
# Update within allowed semver ranges
npm update
# Remove a dependency no longer needed
npm uninstall uuid
Discussion