Dead Dependencies & Bundle Weight

As projects grow, dependencies accumulate. Tools like `depcheck` identify packages you installed but no longer use, while tools like Bundlephobia help you measure the real-world cost of a package before installing it.

Package Managers5 min readConcept 24 of 24

What is it?

depcheck is a CLI tool that scans your package.json against the actual require() and import statements in your source code. If a package is listed in package.json but never imported, it flags it as a 'dead dependency'.

Bundle weight is the physical size of a package when it is minified and gzipped for production. Bundlephobia is a service that calculates this cost.

Why use it?

Dead dependencies bloat your node_modules folder, increase CI build times, and expand your attack surface for security vulnerabilities, all for code you aren't even using.

Installing massive libraries (like the original moment.js) can add hundreds of kilobytes to your frontend bundle, destroying your app's load time and Web Vitals.

How it works

Run npx depcheck in your project root. It will list 'Unused dependencies' (packages you should uninstall) and 'Missing dependencies' (packages you import but forgot to add to package.json).

Before installing a new package, go to bundlephobia.com or use npx bundle-phobia-cli <pkg> to check its minified + gzipped size.

Interactive Demo

Explore the concept in action using the interactive visualization below.

{
  "name": "my-project",
  "dependencies": {
    "react": "^18.3.1",
    "lodash": "^4.17.21"
  }
}
$ npx depcheck
Unused dependencies
* lodash

depcheck scans your src/ files and realizes you never actually imported lodash.

BundlephobiaTree-shakable
Minified72.4kB
Min + Gzip25.3kB

Leaving it in inflates your node_modules by megabytes, and if accidentally imported, inflates your users' download by 25.3kB.

Remember this

  • depcheck finds dependencies listed in package.json that are never imported.
  • Dead dependencies slow down CI builds and increase security risks.
  • Bundlephobia tells you the network cost (Minified + Gzipped) of adding a library.
  • Packages with 'side effects' cannot be tree-shaken by bundlers.

Done with this concept?

Mark it complete to track your progress. No login needed.