Website dependencies in graphile-worker package.json

[lauri865]

Summary

I was wondering why my server docker image includes 10mb of fontawesome icons. Turns out graphile-worker is the culprit.

All of the following files should be moved to devDependencies – as they are not dependencies of the built lib:

"@fortawesome/fontawesome-svg-core": "^6.5.1",
"@fortawesome/free-brands-svg-icons": "^6.5.1",
"@fortawesome/free-regular-svg-icons": "^6.5.1",
"@fortawesome/free-solid-svg-icons": "^6.5.1",
"@fortawesome/react-fontawesome": "^0.2.0",
"@types/debug": "^4.1.10",
"@types/pg": "^8.10.5",

Happy to open a PR if needed.

[benjie]

Oops! I should have caught this during review; thanks for the heads up!

[benjie]

Fix released in 0.16.4

[lauri865]

Appreciate the quick fix. Not as big of an issue, but I think types should still be moved to devDependencies as well.

[benjie]

That would be a breaking change for @types/pg since we expose things that depend on these types (for example our public interface exports a dependency on pg.Pool, for which pg module would be required). Probably @types/debug could be moved, but 🤷‍♂️

[lauri865]

In theory I could agree. But practically, I can't think of a reason why anyone would need typescript types in a production install / build? Even if you do, you're highly unlikely to be able to use npm install --prod anyways, as you'll miss out on the types from many other packages (unless they are meant to be bundled, which is a whole different topic, but bundlers have access to devdeps anyways). And let's say you even do get away with it by some miracle, then what use are types in production if you don't build your app? It's not like you get runtime errors.

There's another 2 packages in my case that add nodejs types to my production build. Both are by accident by the authors, never by design. But they do add 10mb+ of dead weight into the build. This stuff matters in the serverless world.

[benjie]

When you install a module from npm you only ever install the dependencies of that module; devDependencies are for your application alone, not for its dependencies.

https://stackoverflow.com/a/46011417/141284