no-local-dependencies

This rule enforces that no dependencies are declared with local file paths, since this will likely result in errors when installing from a registry. This includes any paths that start with file:, link:, ./, or ../.

Dependencies listed in bundleDependencies (or its bundledDependencies alias) are exempt, since their contents are published within the package’s own tarball and so remain resolvable when installed from a registry. Setting bundleDependencies to true bundles every dependency, and likewise exempts them all.

The bundledDependencies alias is only consulted when bundleDependencies is absent or falsy, matching how npm resolves the two.

Examples

❌ Incorrect
✅ Correct

{
  "dependencies": {
    "foo": "file:../foo",
    "bar": "link:../bar",
    "baz": "../baz"
  }
}

{
  "dependencies": {
    "foo": "workspace:^",
    "bar": "^1.2.3",
    "baz": "~0.1.2"
  }
}

{
  "dependencies": {
    "foo": "file:foo.tgz"
  },
  "bundleDependencies": ["foo"]
}

Options

Name	Description	Type	Default
`ignorePrivate`	Determines if this rule should be enforced when the package’s `private` property is `true`.	Boolean	`true`

`ignorePrivate`

When this option is enabled and the package has "private": true, the rule skips its check entirely. This can be useful for internal packages that won’t be published to a registry. Disable it if you want to apply the rule to all packages, regardless of privacy.

{
  "package-json/no-local-dependencies": [
    "error",
    {
      "ignorePrivate": false
    }
  ]
}

unique-dependencies - Checks that a dependency isn’t specified more than once.
valid-dependencies - Enforces that the dependencies property is valid.

Further Reading

npm: package.json > dependencies > Local Paths