Dependency Cruiser is a static analysis tool for validating and visualizing dependencies in JavaScript, TypeScript, and CoffeeScript projects, supporting various module systems including ES6, CommonJS, and AMD. Currently at version 17.3.10, the project demonstrates an active release cadence with frequent maintenance and feature updates. Key differentiators include its ability to define and enforce custom architectural rules, detect issues like circular dependencies or missing `package.json` entries, and generate highly customizable dependency graphs in multiple formats such as DOT, SVG, Mermaid, JSON, HTML, or plain text. It offers both a command-line interface for quick analysis and reporting, and a programmatic API for deeper integration into build processes or custom tooling.
npm install dependency-cruiserVerified import paths — ran on the pinned version, not inferred.
Installs Dependency Cruiser, generates a basic configuration, then demonstrates CLI usage for visual graph generation and programmatic API usage for rule validation in a TypeScript project.
Remove the `--config` option from CLI commands. For API users, refactor `require` statements to `import` and update the `cruise` function call to `await cruise(...)` ensuring it handles promises and the updated signature. Ensure your Node.js version is compatible with v13+ (Node 14 support was dropped).
Prefer `npx` for executing `dependency-cruiser` commands unless you are fully aware of `pnpx`'s behavior and potential differences, especially regarding package resolution and environment setup.
Install Graphviz on your system. For most Linux-like systems, this can be done via your package manager (e.g., `sudo apt-get install graphviz`). Refer to the Graphviz download page for other operating systems.
No direct fix is required for `dependency-cruiser`'s functionality, as the vulnerability is contextually irrelevant. If security scanners flag it, you may need to add an override in your `package.json` to a later `picomatch` version or document the false positive.
Ensure `typescript` is installed as a `devDependency` in your project or globally in a location accessible to `dependency-cruiser`. You might also need to set `tsPreCompilationDeps: true` in your configuration for a more complete analysis of TypeScript-specific dependencies.
Install TypeScript: `npm install --save-dev typescript` (local) or `npm install -g typescript` (global).
Use `--output-type dot` with `dependency-cruiser` and then pipe the output to the `dot` command from Graphviz: `npx depcruise src --output-type dot | dot -T svg > output.svg`.
Refactor your modules to break the circular dependency. This often involves applying dependency inversion principles, extracting shared logic to a common module, or re-evaluating module responsibilities.
For v13+, the API is ESM-only and asynchronous. Change your import to `import { cruise } from 'dependency-cruiser';` and ensure you `await cruise(...)` within an `async` function.