dependencies vs devDependencies in production?

DEPENDENCIES FOR RUNTIME

dependencies are packages your application needs to run in production. These include Express, Axios, database drivers, logging libraries, and utilities. When you require() or import a package in your running code, it must be in dependencies. At deployment, these are installed.

DEVDEPENDENCIES FOR DEVELOPMENT

devDependencies are packages used only during development and testing. These include Jest or Mocha for unit tests, ESLint for linting, Prettier for formatting, TypeScript for compilation, and build tools. These are never imported by your running application. They are used by developers or CI pipelines, not by production servers.

WHY THE DISTINCTION MATTERS

Production Docker images should exclude devDependencies. Including a 100MB testing framework adds unnecessary image size, increases deployment time, and increases the attack surface. A package with a security vulnerability in devDependencies can be ignored in production if it is not shipped. npm ci --only=production installs only runtime dependencies.

DEVELOPMENT WITHOUT THE DISTINCTION

In your development environment, running npm install installs both dependencies and devDependencies. This is correct; you need the linter and test framework. Your local node_modules includes everything. A developer can run npm test and use linting tools.

PRODUCTION OPTIMIZATION

When building a Docker image, use RUN npm ci --only=production (or npm install --only=production in older npm). This installs only dependencies. The resulting image is lean and fast. The final image size might drop by 50% by excluding devDependencies.

MISTAKE: WRONG CATEGORIZATION

If you accidentally categorize Axios as a devDependency because you use it in a test file, production fails. Always ask: Does the running application need this? If yes, it is dependencies. If it is used only in tests or build scripts, it is devDependencies.

SCENARIO: DATABASE DRIVER

Postgres driver is a dependency; your app queries the database at runtime. Jest is devDependency; used only by npm test. A shared utility imported by both production code and tests is a dependency, not devDependency, because production code needs it.