@js-joda/core added to package.json deps when using clj-commons/humanize

[knubie]

Apologizes for the long title, but I am trying to figure out why "@js-joda/core" is getting added as a dependency in my package.json when I include org.clj-commons/humanize in deps.edn. It's also added to the build when I run a build-report. Output looks something like this:

[4/4] Building fresh packages...
success Saved lockfile.
success Saved 1 new dependency.
info Direct dependencies
└─ @js-joda/[email protected]
info All dependencies
└─ @js-joda/[email protected]

AFAICT js-joda is only a :cljs-test dependency for humanize, so I don't think it should be added to the dependencies or the build, but maybe I've misunderstood how these dependencies work.

[thheller]

The only way shadow-cljs adds anything to package.json is when it finds deps.cljs files on the classpath that specify :npm-deps they need. That install only happens when the package is not already in package.json. To check where a particular dependency is coming from you can run npx shadow-cljs clj-repl and then

(shadow.cljs.devtools.server.npm-deps/get-deps-from-classpath)

It'll show something like this, just look for js-joda

[{:id "react",
  :version "16.13.0",
  :url #object[java.net.URL
               0x2241daab
               "jar:file:/C:/Users/thheller/.m2/repository/reagent/reagent/0.10.0/reagent-0.10.0.jar!/deps.cljs"]}
 {:id "react-dom",
  :version "16.13.0",
  :url #object[java.net.URL
               0x2241daab
               "jar:file:/C:/Users/thheller/.m2/repository/reagent/reagent/0.10.0/reagent-0.10.0.jar!/deps.cljs"]}]

You may suppress this automatic install entirely by setting :npm-deps {:install false} in shadow-cljs.edn at the top level (i.e. not the :builds config).

[knubie]

Awesome, thanks! I was able to track down the source through a transient dependency:
org.clj-commons/humanize → com.widdindustries/cljc.java-time → com.widdindustries/cljs.java-time → @js-joda/core