Remove NPM Dependency #114

New issue

Closed

opened 2026-04-07 07:13:13 +00:00 by PeterBurner · 1 comment

PeterBurner commented

2026-04-07 07:13:13 +00:00

(Migrated from github.com)

Description

spectral-aws-apigateway-ruleset@3.0.1 lists npm as a production dependency:

"dependencies": {
  "ajv": "^8.5.0",
  "ajv-draft-04": "^1.0.0",
  "ajv-formats": "^2.1.0",
  "npm": "^11.5.2"
}

However, npm is not imported or referenced anywhere in the package's source files. This appears to be an accidental inclusion.

Impact

Because npm ships with a large set of bundled sub-dependencies, this single entry causes ~80 extra entries to appear in the users lock file (all the node_modules/npm/node_modules/* entries). Depending on the package manager used, they even get physically installed on disk. When using Yarn or PNPM this is undesirable. They also bloat the lock file and appear as dependencies in security audits, increasing noise and scan time.

Steps to Reproduce

npm install spectral-aws-apigateway-ruleset
npm why npm
# npm@11.x dev → spectral-aws-apigateway-ruleset@3.0.1

Expected Behaviour

npm should not be listed as a dependency at all. If it is needed for internal scripts (e.g. release tooling), it should be moved to devDependencies.

Suggested Fix

Remove "npm": "^11.5.2" from the dependencies block in package.json.

## Description `spectral-aws-apigateway-ruleset@3.0.1` lists `npm` as a production dependency: ```json "dependencies": { "ajv": "^8.5.0", "ajv-draft-04": "^1.0.0", "ajv-formats": "^2.1.0", "npm": "^11.5.2" } ``` However, `npm` is not imported or referenced anywhere in the package's source files. This appears to be an accidental inclusion. ## Impact Because `npm` ships with a large set of bundled sub-dependencies, this single entry causes ~80 extra entries to appear in the users lock file (all the `node_modules/npm/node_modules/*` entries). Depending on the package manager used, they even get physically installed on disk. When using Yarn or PNPM this is undesirable. They also bloat the lock file and appear as dependencies in security audits, increasing noise and scan time. ## Steps to Reproduce ```shell npm install spectral-aws-apigateway-ruleset npm why npm # npm@11.x dev → spectral-aws-apigateway-ruleset@3.0.1 ``` ## Expected Behaviour `npm` should not be listed as a dependency at all. If it is needed for internal scripts (e.g. release tooling), it should be moved to `devDependencies`. ## Suggested Fix Remove `"npm": "^11.5.2"` from the dependencies block in `package.json`.

andylockran commented

2026-04-07 08:19:46 +00:00

(Migrated from github.com)