角和NPM相关性与devDependencies的关系

Question

在阅读了大量关于这个问题的文章之后，下面这个非常有用的帖子：What's the difference between dependencies, devDependencies and peerDependencies in npm package.json file?

我知道，依赖关系应该引用每个运行时库，devDependencies引用每个有用的开发依赖项。

但我现在很困惑。为了生产使用，我将不得不ng build --production我的角度应用程序。如果我使用npm install --production，我甚至不能使用ng build --production进行编译。I需要到npm install并安装每个devDependencies。知道了这一点，我试着把所有东西都放在devDependencies下，然后我做了一个ng build --prod，生成的dist文件夹具备了所需的一切，并且可以作为一个完整的角度应用程序。

所以，第一个问题是:在运行时lib和dev库之间添加一个“纸面上”的区别，为什么我要使用依赖关系?

其他问题:为了避免依赖项上的漏洞，我可以强制使用特定版本，方法是将这个库放在package.json中(只要主版本相同)。但是，我希望避免将这个库放在依赖项或devDependencies中，应该将这个库放在peerDependencies下吗？optionnalDependencies？bundledDependencies？

谢谢你对此的任何投入。

编辑

示例package.json是必需的：

{
  "name": "ANGULAR_PROJECT",
  "version": "X.Y.Z",
  "repository": {
    "type": "git",
    "url": "A_GIT_URL"
  },
  "scripts": {
    "ng": "ng",
    "test": "ng test",
    "e2e": "protractor e2e/conf/protractor.conf.js",
    "e2e:dev": "protractor e2e/conf/protractor-dev.conf.js",
  },
  "private": true,
  "dependencies": {
  },
  "devDependencies": {
    "@angular/pwa": "^0.12.4",
    "@angular/animations": "^8.2.11",
    "@angular/cdk": "^8.2.3",
    "@angular/common": "^8.2.11",
    "@angular/compiler": "^8.2.11",
    "@angular/core": "^8.2.11",
    "@angular/forms": "^8.2.11",
    "@angular/material": "^8.2.3",
    "@angular/material-moment-adapter": "^8.2.3",
    "@angular/platform-browser": "^8.2.11",
    "@angular/platform-browser-dynamic": "^8.2.11",
    "@angular/platform-server": "^8.2.11",
    "@angular/router": "^8.2.11",
    "@angular/service-worker": "^8.2.11",
    "@mat-datetimepicker/core": "^2.0.1",
    "@mat-datetimepicker/moment": "^2.0.1",
    "@ngrx/effects": "8.4.0",
    "@ngrx/router-store": "8.4.0",
    "@ngrx/schematics": "8.4.0",
    "@ngrx/store": "8.4.0",
    "@ngrx/store-devtools": "8.4.0",
    "@swimlane/ngx-charts": "12.0.1",
    "angular-gridster2": "^8.2.0",
    "angular-particle": "^1.0.4",
    "array-flat-polyfill": "^1.0.1",
    "apollo-angular": "^1.8.0",
    "apollo-angular-link-http": "^1.9.0",
    "apollo-cache-inmemory": "^1.6.3",
    "apollo-client": "^2.6.4",
    "apollo-link": "^1.2.13",
    "classlist.js": "^1.1.20150312",
    "core-js": "^2.5.4",
    "graphql": "14.0.0",
    "graphql-tag": "^2.10.1",
    "hammerjs": "^2.0.8",
    "json-server": "^0.14.2",
    "jsonpath": "^1.0.2",
    "moment": "^2.22.2",
    "ngrx-store-freeze": "^0.2.4",
    "ngrx-store-localstorage": "^8.0.0",
    "ngx-cacheable": "^1.2.5",
    "ngx-parallax": "^4.0.0",
    "node-sass": "4.13.1",
    "rxjs": "^6.5.3",
    "web-animations-js": "^2.3.2-pr208",
    "xlsx": "^0.14.2",
    "zone.js": "~0.9.1",
    ----------------------------------------------- REAL DEV DEPENDENCIES UNDER
    "@angular-devkit/build-angular": "^0.803.10",
    "@angular/cli": "^8.3.10",
    "@angular/compiler-cli": "^8.2.11",
    "@angular/language-service": "^8.2.11",
    "@commitlint/cli": "^7.2.1",
    "@types/chai": "^4.2.6",
    "@types/cucumber": "^6.0.0",
    "@types/jasmine": "~3.4.6",
    "@types/jasminewd2": "~2.0.8",
    "@types/node": "~8.9.4",
    "chai": "^4.2.0",
    "codelyzer": "~5.2.0",
    "commitizen": "^4.0.3",
    "conventional-changelog-cli": "^2.0.1",
    "cucumber": "5.1.0",
    "cucumber-html-reporter": "^5.0.2",
    "cz-customizable": "^5.3.0",
    "cz-customizable-ghooks": "^1.5.0",
    "husky": "^4.2.1",
    "jasmine-core": "~3.5.0",
    "jasmine-spec-reporter": "~4.2.1",
    "karma": "~4.4.1",
    "karma-chrome-launcher": "~3.1.0",
    "karma-coverage-istanbul-reporter": "~2.1.0",
    "karma-jasmine": "~2.0.1",
    "karma-jasmine-html-reporter": "^1.4.2",
    "karma-sonarqube-reporter": "^1.2.5",
    "karma-sonarqube-unit-reporter": "^0.0.21",
    "karma-spec-reporter": "0.0.32",
    "lint-staged": "^8.1.0",
    "mkdirp": "^0.5.1",
    "ng-mocks": "^8.1.0",
    "prettier": "^1.15.3",
    "protractor": "5.4.2",
    "protractor-cucumber-framework": "^6.2.0",
    "rxjs-compat": "^6.3.3",
    "ts-comparators": "^1.0.0",
    "ts-mockery": "1.2.0",
    "ts-node": "~7.0.1",
    "tslint": "~5.11.0",
    "tslint-config-prettier": "^1.18.0",
    "tslint-plugin-prettier": "^2.0.1",
    "typescript": "^3.1.6"
  },
  "peerDependencies": {

  }
}

Answer 1

应用程序在运行时库和开发工具库之间有“纸面上”的区别，为什么要使用依赖项?

回应:做你想做的事也没什么区别。但要知道：

• 知道依赖是prod还是dev依赖，即使它是“纸面上的”差异，所以尽量准确。要确定依赖关系是否真的在最终构建中使用，可以使用特殊的库。我对https://www.npmjs.com/package/webpack-bundle-analyser有一个偏好，因为它允许通过搜索字段
• 搜索依赖项，如果您需要使用带有--prod的npm命令，这些命令只会在package.json中使用“依赖项”堆栈。如果此依赖项位于"devDependencies“中，npm ls @angular/build prod将不会返回任何结果。但是它将返回一个结果，如果@/build-角在"dependencies"

中。

对于另一个问题：，为了避免依赖项上的漏洞，我可以强制使用特定版本，方法是将这个库放在package.json中(只要主版本是相同的)。但是，我希望避免将这个库放在依赖项或devDependencies中，应该将这个库放在peerDependencies下吗？optionnalDependencies？bundledDependencies ?

响应:最好的方法是使用npm工具：npm-force-resolutions，而不是在这些条目中引用这些依赖项。

关于npm的更多信息-强制-解决方案:例如：https://stackoverflow.com/a/62956076/2376892