Remove `https` and other core node modules from `package.json`

[mbtools]

Issue

The https package has no content (https://npmx.dev/package/https) but found in almost 2000 other published packages as a dependency. https has over 3m download/week.

Cause is most likely a confusion with built-in node:https.

See this example of adding node components to deps.

Suggestion

Add e18e lint rule to remove https from package.json.

[43081j]

3 million downloads 😭

we should definitely do some research on largest dependents etc.

its possible we could add it to module-replacements but lets look into who is using it first

[gameroman]

Looking at dependents, looks like a lot are coming from pptxgenjs

[joaopedrodcf]

Yeah it's quite common to have unnecessary modules in package json 😞

[43081j]

https://github.com/search?q=path%3A%2Fpackage.json%24%2F+%22%5C%22https%5C%22%3A+%5C%22%5E%22+AND+NOT+is%3Afork&type=code

this also gives an idea of some usages. maybe we could find popular repos through this.

we obviously can't clean them all up, so we should also create an issue in module-replacements repo to add it as a removal replacement

[rubiesonthesky]

There seems to be also “http” and “fs” (https://github.com/search?q=path%3A%2Fpackage.json%24%2F+%22%5C%22fs%5C%22%3A+%5C%22%5E%22+AND+NOT+is%3Afork&type=code&p=1 ) used. They are less bad because npm is holding them, at least for now.

I wonder, could renovate or dependabot recommend removing these? Most of the projects in GitHub having them are not using those tools, so not sure how much it would help.

[mbtools]

Sorry for extending the scope of the issue... I analyzed all node core module names. All but one have identical npm packages.

Package does not contain any code

This includes packages on hold or deprecated by npm and name squatting (the https case mentioned above).

Suggested e18e recommendation: Remove package from package.json and any require/imports

Deprecated, useless, or built-in packages

These packages are deprecated by author, just contain a require(package) statement, or built-in node now.

Suggested e18e recommendation: Replace with core node module (import * from 'node:...').

Alternative to node

These packages provide similar features as the core node modules.

Suggested e18e recommendation:
If you are on node, use the core module instead.
If you run in browser, some replacements are available:

• buffer → not native, but browsers do have ArrayBuffer/Uint8Array
• stream → partially, via Web Streams API
• url → yes, via the standard Web URL API
• util → partially, but not as the Node util module; some similar functionality exists in web standards

Complete analysis

node-core-modules.xlsx