microsoft/TypeScript

Dependencies

typescript ships with zero runtime dependencies. Every dev dependency is pinned in package.json and package-lock.json.

Why zero runtime deps

When users install typescript, the only thing they get is the compiler itself plus a few small CLI shims. Pulling in a dependency tree at install time would slow installs, raise the supply-chain attack surface, and cause version conflicts in monorepos. The team has stuck to this principle for a decade.

Dev dependencies

Categorised by role.

Build / runner

hereby — the gulp-style task runner driving Herebyfile.mjs.
esbuild — JS bundler producing lib/tsc.js, lib/tsserver.js, lib/typescript.js, etc.
@dprint/formatter, @dprint/typescript, dprint — the Rust-based code formatter.
glob — file globbing utility used by build scripts.
chokidar — filesystem watcher used inside the test harness for incremental scenarios.

Test

mocha — JavaScript test runner.
mocha-fivemat-progress-reporter — compact progress reporter for parallel runs.
chai, @types/chai — assertion library.
@esfx/canceltoken — cancellation primitives the test harness uses.
source-map-support, @types/source-map-support — readable stack traces from compiled JS.
c8 — V8-native code coverage.
monocart-coverage-reports — extra coverage reports (HTML + LCov).
playwright — browser test automation (used by the browser-bridge tests).
diff — text-diff utility used in baseline comparison.

Lint and quality

eslint, @eslint/js — ESLint v10.
typescript-eslint, @typescript-eslint/utils, @typescript-eslint/type-utils, @typescript-eslint/rule-tester — TypeScript-aware ESLint plugins.
eslint-plugin-regexp — regex linting rules.
globals — list of language globals used by the ESLint config.
knip — dead-code / unused-export detector.

Process and config

minimist, @types/minimist — argument parsing in build scripts.
jsonc-parser — JSON-with-comments parser used by build scripts.
fast-xml-parser — XML parsing for some Azure DevOps interop scripts.
picocolors — small ANSI colour helper for build script output.
ms, @types/ms — duration parser/formatter.
which, @types/which — locate executables.
tslib — runtime helpers consumed when --importHelpers is set; pinned here so the helpers in factory/emitHelpers.ts stay in sync.

Octokit / Azure DevOps

@octokit/rest — GitHub API client used by release scripts.
azure-devops-node-api — Azure Pipelines API client used by release publishing.

Misc types

@types/node — Node.js typings.
@types/mocha, @types/chai, @types/source-map-support, @types/which, @types/ms, @types/minimist — typings for the corresponding packages.

Self-host

typescript (^6.0.2) — the published version of TypeScript itself, used to type-check the source. The build promotes a freshly-built compiler into lib/ (the LKG); subsequent type-checks use the LKG via this dev dependency.

Lockfile size

package-lock.json is ~370 KB / ~10,000 lines. The depth comes from playwright and the @typescript-eslint/* family — both pull in long transitive trees.

Dependency policy

Dependabot (.github/dependabot.yml) runs daily PRs to bump dev dependencies. About a third of recent commits are dependabot bumps.
No new runtime dependencies. Maintainers will reject PRs that add anything to dependencies.
Pinning. Dev dependencies use caret ranges (^x.y.z) but the lockfile pins exact versions. Major version bumps require manual review.