dependencies vs devDependencies — What Goes Where

Every npm package you install belongs in one of two categories: packages your application needs to run in production, and packages you only need during development. npm formalises this distinction with two separate fields in package.json: dependencies and devDependencies. Getting this right matters beyond just cleanliness — it directly affects your production deployment bundle size, your security attack surface, and how clearly your codebase communicates its architecture to other developers.

The Core Distinction #

Classifying Your MERN Packages #

Installing With the Correct Flag #

# ── Server: production dependencies ──────────────────────────────────────────
cd server
npm install express mongoose dotenv cors helmet bcryptjs jsonwebtoken nodemailer multer

# ── Server: dev dependencies ──────────────────────────────────────────────────
npm install -D nodemon eslint jest supertest

# ── Client: production dependencies (bundled by Vite) ────────────────────────
cd ../client
npm install react react-dom react-router-dom axios

# ── Client: dev dependencies (build tools, linting) ──────────────────────────
npm install -D vite @vitejs/plugin-react eslint eslint-plugin-react

Production Install — What Gets Skipped #

# On your local machine — installs everything including devDependencies
npm install

# In production / CI — skips devDependencies
npm install --omit=dev      # npm 7+  (modern)
npm install --production     # older syntax (same effect)

# Verify what would be installed in production
npm list --omit=dev --depth=0

Example: server/ node_modules in production vs development

Development install — includes:
  express, mongoose, dotenv, cors, bcryptjs, jsonwebtoken (production)
  nodemon, eslint, jest, supertest (dev — 4 extra packages, ~40MB)

Production install (--omit=dev) — includes only:
  express, mongoose, dotenv, cors, bcryptjs, jsonwebtoken
  → Smaller image, faster deploy, smaller security surface

Common Mistakes #

Mistake 1 — Installing runtime packages as devDependencies #

❌ Wrong — dotenv installed as a dev dependency:

npm install -D dotenv   # dotenv goes into devDependencies

Local:      Works — all deps installed
Production: CRASH — "Cannot find module 'dotenv'"
            process.env variables are never loaded → MongoDB URI is undefined

✅ Correct — dotenv is needed at runtime (server startup) so it belongs in production dependencies:

npm install dotenv   # no -D flag ✓

Mistake 2 — Installing build tools as production dependencies #

❌ Wrong — nodemon in production dependencies bloats the deployment:

npm install nodemon   # goes into dependencies — deployed to production unnecessarily

✅ Correct — nodemon is a dev tool that only watches files during development:

npm install -D nodemon   # devDependencies — excluded from production deploy ✓

Mistake 3 — Using nodemon in production #

❌ Wrong — package.json start script using nodemon:

"scripts": {
  "start": "nodemon index.js"   // nodemon is a devDependency — not available in production!
}

✅ Correct — use node for production, nodemon only for development:

"scripts": {
  "start": "node index.js",      // production — plain Node.js
  "dev":   "nodemon index.js"    // development — auto-restart on change
}

Quick Reference #