Dependency Insight CLI Tool

Overview

dependency-insight is a tiny, powerful, and user-friendly command-line tool designed to help you audit, analyze, and manage your project's dependencies. It provides a wide range of features to ensure that your project uses the most up-to-date, secure, and efficient libraries. Available on NPM registry.

Installation

You can install dependency-insight globally via npm:

npm install -g dependency-insight

Alternatively, you can install it locally in your project:

npm install --save-dev dependency-insight

Or simply npm i (but you may have to use npx before dep-insight)

npm install dependency-insight #use npx 

---

Features

1. Audit Dependencies

• Command: dep-insight audit
• Description: Audits your project's dependencies for known vulnerabilities and displays the severity of each.

2. Check Outdated Dependencies

• Command: dep-insight outdated
• Description: Identifies outdated dependencies and checks for newer versions.

3. Prune Unused Dependencies

• Command: dep-insight prune
• Description: Detects unused dependencies and helps keep your project lean.

4. Visualize Dependency Tree

• Command: dep-insight tree
• Description: Visualizes the complete dependency tree of your project.

5. Suggest Lightweight Alternatives

• Command: dep-insight suggest
• Description: Suggests lightweight alternatives for heavy dependencies.

6. Analyze Bundle Size

• Command: dep-insight size
• Description: Analyzes the size of your project's dependencies and provides a summary.

7. Check Project Health

• Command: dep-insight health
• Description: Checks the health of your dependencies by reviewing download statistics, GitHub activity, and more.

8. Interactive Update for Dependencies

• Command: dep-insight update
• Description: Allows you to interactively update outdated dependencies in your project.

9. Clear npm Cache

• Command: dep-insight clear-cache
• Description: Clears the npm cache completely after confirming with the user.

10. Check License Compliance

• Command: dep-insight licenses
• Description: Scans all dependencies for their license types, flags packages with restrictive or incompatible licenses, and generates compliance reports.

11. Dependency Impact Analysis

• Command: dep-insight impact <package-name>
• Description: Analyze how updating a specific dependency might affect your project, including breaking changes and risk scoring.

12. Dependency Usage Analyzer

• Command: dep-insight usage
• Description: Shows which files/modules are importing each dependency, identifies underutilized or unused packages, and finds redundant dependencies.

13. Lockfile Validator

• Command: dep-insight lock
• Description: Analyzes your lockfile (package-lock.json, yarn.lock, or pnpm-lock.yaml) for inconsistencies or potential issues and verifies lockfile integrity.

14. Peer Dependency Validator

• Command: dep-insight peers
• Description: Checks for missing or incompatible peer dependencies and highlights potential conflicts.

15. CI/CD Integration

• Command: dep-insight ci
• Description: Runs all critical checks in CI environments, generates machine-readable reports, and sets appropriate exit codes for failing builds.

16. Default/Help Command

• Command: No command or dep-insight help
• Description: Displays the available commands and their descriptions when no command is provided or the help flag is used.

---

Usage

After installation, you can run the tool from the command line by typing dep-insight followed by the desired command. For example:

• To audit dependencies:

  dep-insight audit

• To check for outdated dependencies:

  dep-insight outdated

• To check license compliance:

  dep-insight licenses

• To analyze dependency usage:

  dep-insight usage

• To validate lockfile:

  dep-insight lock

• To validate peer dependencies:

  dep-insight peers

• To run all checks in CI:

  dep-insight ci

For a full list of commands, use the help command:

dep-insight help

---

Example Output

When you run the dep-insight audit command, it will analyze your dependencies for security vulnerabilities and output a summary:

Auditing dependencies for vulnerabilities...

Low: 2, Moderate: 1, High: 3, Critical: 0

When you run dep-insight outdated, it will show any outdated dependencies:

Outdated dependencies:

express: 4.16.3 → 4.18.2 (4.18.2)

When you run dep-insight licenses, it will show license risk summary and details:

License Risk Summary:
High Risk: 1 - Copyleft licenses with strict requirements
Moderate Risk: 0 - Licenses with some restrictions
Low Risk: 10 - Permissive licenses
Unknown: 2

⚠️ High Risk Licenses:
- some-copyleft-package  GPL-3.0

All Licenses:
some-copyleft-package   GPL-3.0
chalk                   MIT
...

When you run dep-insight usage, it will show dependency usage analysis:

Dependency Usage Analysis:
──────────────────────────────────────────────────────────────
Dependency                      Imports    Files   Coverage
──────────────────────────────────────────────────────────────
chalk                                18       18        86%
inquirer                              3        3        14%
depcheck                              1        1         5%
filesize                              0        0         0%

⚠️ Unused Dependencies:
- filesize (consider removing)

When you run dep-insight lock, it will validate your lockfile:

Validating lockfile integrity...

Detected lockfiles:
- package-lock.json

✅ package-lock.json is up to date.
Lockfile version: 2
✅ All packages have integrity hashes.

When you run dep-insight peers, it will validate peer dependencies:

Validating peer dependencies...

✅ All peer dependencies are satisfied!

When you run dep-insight ci, it will run all checks and output a machine-readable report.

---

Dependencies

This tool uses the following libraries:

• chalk: For colorful and easy-to-read outputs in the terminal.
• depcheck: For identifying unused dependencies in your project.
• inquirer: For prompting users during interactive commands.
• filesize: For displaying file sizes in human-readable formats.

---

Contributing

Feel free to fork this project, submit issues, or create pull requests. Contributions are welcome!

---

License

This project is licensed under the MIT License. See the LICENSE file for more information.

---

Note: GitHub API is rate-limited to 60 requests per hour for unauthenticated requests, which may