depcheck

Depcheck does what it promises - scanning your codebase to identify unused dependencies and missing ones. The CLI works well for one-off audits during development, but integrating it programmatically reveals concerning performance characteristics. On medium-to-large codebases (500+ files), memory usage can spike to 500MB+ with no streaming or chunking options available. There's no built-in resource pooling or concurrency control when analyzing multiple projects.

The library lacks timeout configuration entirely, which becomes problematic when parsers hang on malformed files. Error handling is basic - parse failures often bubble up as unhandled rejections rather than graceful degradation. There's minimal logging output even when verbose mode is enabled, making it difficult to debug why certain dependencies aren't detected. The API is synchronous-feeling despite being async, with no progress hooks for long-running operations.

Configuration options exist for custom parsers and detectors, but they're poorly documented. Breaking changes between minor versions (particularly around detector APIs) have caught me off guard. For CI/CD pipelines, you'll want to wrap this with your own timeout logic and memory limits.

Depcheck does what it promises - scans your codebase to find unused dependencies and missing imports. The CLI is straightforward (`npx depcheck`), and it works out of the box for simple projects. However, real-world usage quickly reveals limitations that require significant configuration investment.

The false positive rate is frustratingly high. Dev dependencies used in config files (ESLint plugins, Jest presets, Vite plugins) are routinely flagged as unused. TypeScript type-only imports often confuse the parser. You'll spend considerable time maintaining an `ignoreMatches` array in your config, essentially teaching it about your project structure. The programmatic API exists but lacks TypeScript definitions, making IDE support nonexistent when integrating into custom tooling.

Error messages are minimal - when parsing fails on a file, you get a brief path and cryptic message with little context. The JSON output format helps for CI integration, but the default console output is verbose and difficult to scan. Documentation covers basic usage but lacks guidance on handling common false positives or explaining detection heuristics.

Depcheck does what it promises - scanning your codebase to find unused dependencies and missing ones from package.json. The CLI is straightforward (`npx depcheck`) and provides useful output for basic cases. However, the day-to-day experience reveals significant friction points that require manual configuration.

The biggest pain point is false positives. Modern build tools, monorepo setups, and dynamic imports frequently confuse depcheck. You'll spend time creating ignore patterns and special configurations. The configuration API is JSON-based but lacks schema validation, so typos fail silently. TypeScript support exists but type definitions are minimal - you're mostly working with string arrays and basic options without much IDE guidance.

Error messages are cryptic when parsing fails, often just exiting without clear indication of what went wrong. The documentation covers basic usage well but advanced scenarios (custom parsers, ignore patterns for specific frameworks) require digging through GitHub issues. Integration into CI pipelines works but expect to maintain an exclusion list as your project evolves.