devDependency or dependency?
DanielRuf opened this issue · 5 comments
In the docs you sometimes use npm i @oktadev/schematics and sometimes npm i -D @oktadev/schematics`.
Is this a devDepndency in general or does it depend on the setup? Because this is not clear and currently @oktadev/schematics uses a dependency with vulnerabilities (ini 1.3.5, loaded by schematics-utilities 2.0.2).
That's my fault. It should be a dev dependency (-D) in most cases. React has a philosophy of no dev dependencies, so that's why I might've missed it there.
Ah ok, thanks for the clarification.
You might want to adjust the package.json file for the ng add command to not save the package to dependencies. See angular/angular-cli#15815
React has a philosophy of no dev dependencies
That is new to me. React itself is no devDependency, that is correct. But dependencies which are only needed during the build process, should be devDependencies. According to the docs the package is only needed for the schematics CLI to generate the code (once).
schematics @oktadev/schematics:add-auth
@DanielRuf Can you please create a PR with this change? I'd be happy to add it!
Thanks for your contribution @DanielRuf!