Description
Some context: Yesterday Web3.js released a broken package. The problem was that one of its modules was doing a require of a dependency of a devDependency. I took some time to see if this could accidentally happen in EthereumJS and couldn't find anything preventing it.
I think we should enable tslint's no-implicit-dependencies rule, that prevents this from happening.
It has a small annoyance though. For it to actually work, it should only consider dependencies and peerDependencies as valid, so anything installed in devDependencies that is used in a test will be flagged as an error if we use the same tslint config for tests.
There are two ways to solve that:
- Instructing
tslintto also considerdevDependenciesas installed. This is pretty dangerous. - Whitelisting some dependencies. Also kinda dangerous, depending on how many they are. For example, if it's only something like
chai, it may be ok, as nobody would usechaioutside of a test. - Adding
// ts-lint-disable-next-line no-implicit-dependenciesbefore any conflicting require in the test files.
This is a great first issue, as the change is very small, but it exposes you to the release process of this library. We need to merge it here, release a new ethereumjs-config version, and update it in the other projects.