Most unused-dependency checkers answer one question. depseer answers several, from one AST pass:

| | | | --- | --- | | What is used? | Production and dev dependencies that appear in static imports | | What looks unused? | Declared packages with no static import — reported as possibly unused | | What is missing? | Imports that are not in package.json | | How is it wired? | Source graph, circular imports, reverse lookup, JSON, CI |

npm install --global depseer
# or
npx depseer

depseer
depseer ./path/to/project

depseer
────────────────────────────────────────────────

Project
  ~/projects/my-app

Framework
  Next.js

Source files
  184

Dependencies
  23

Dev dependencies
  14

Dependency Analysis
────────────────────────────────────────────────

✓ react              used
✓ next               used

⚠ lodash             possibly unused

Missing Dependencies
────────────────────────────────────────────────

⚠ src/api/client.ts
  imports "axios"
  but axios is not declared in package.json

Circular Dependencies
────────────────────────────────────────────────

⚠ src/auth.ts
    ↓
  src/api.ts
    ↓
  src/auth.ts

Summary
────────────────────────────────────────────────

  Source files          184
  Dependencies           23
  Dev dependencies       14

  Used                   21
  Possibly unused         2
  Missing                 1
  Circular cycles         1

Analysis complete.

Commands

| Command | What you get | | --- | --- | | depseer | Default report: used, possibly unused, missing, cycles, summary | | depseer --unused | Possibly unused production and dev dependencies | | depseer --missing | External imports not declared in package.json | | depseer --cycles | Canonicalized circular import loops | | depseer --tree | Source-level import tree (↳ already analyzed avoids repeats) | | depseer --packages | Which packages are imported, and by how many files | | depseer --who-uses react | Every file that imports a package | | depseer --file src/api/client.ts | What a file imports, and who imports it | | depseer --json | Deterministic JSON on stdout only | | depseer --ci / --check | Concise CI report; non-zero exit when issues exist |

--check is an alias for --ci. Default (non-CI) runs exit 0 after a successful analysis even if findings exist.

depseer CI
────────────────────────────────────────

Possibly unused dependencies: 2
Missing dependencies: 1
Circular dependencies: 1

FAIL

Exit codes

| Code | Meaning | | --- | --- | | 0 | Success, or a successful informational run | | 1 | --ci / --check found unused, missing, or circular dependencies | | 2 | Invalid CLI usage | | 3 | Project or input error (no package.json, missing --src, …) |

How analysis works

• Languages: .js .jsx .mjs .cjs .ts .tsx
• Imports: import … from, require(), import("…") with a string literal, export { x } from, export * from
• Aliases: tsconfig.json / jsconfig.json paths are resolved statically
• Builtins: Node.js builtins (fs, node:path, …) are never reported as missing
• Unused wording: always possibly unused. Plugins, CLI binaries, generated code, and runtime loading can use a package with no static import

Configuration

Optional. First file found wins: depseer.config.json, .depseerrc, .depseerrc.json.

{
  "src": "src",
  "exclude": ["src/generated/**"],
  "ignoreDependencies": ["some-plugin"]
}

depseer --src src --exclude "src/generated/**" --ignore lodash

CLI --src replaces the config value. --exclude and --ignore are merged with the config lists. Ignored packages are omitted from unused/missing findings; they stay in the graph.

Security and limits

depseer is read-only and offline. It parses files as text. It does not execute project code, run npm scripts, or upload anything. Details: SECURITY.md.

• One Node.js process; each source file is parsed once
• node_modules, .git, dist, build, .next, and similar directories are skipped
• Analyzes the nearest package.json (or the path you pass) — one package per run, not a merged monorepo graph
• Dynamic specifiers such as require(variable) are skipped

Development

npm install
npm test
npm run lint
npm run typecheck
npm run build

See CONTRIBUTING.md.

License

MIT