How to find out which own dependencies Webpack uses at runtime?

[mike-lischke]

This is a pretty special question I have which Stackoverflow is not able to answer.

What I need to know is what parts of Webpack and which 3rd party code it relies on are actually shipped in generated code. For legal approval I need to list all 3rd/4th party libraries that are shipped to customers.

I looked at the package.json file of the project, but to me it looks as if that contains many build/dev dependencies. I installed [email protected] explicitly (this is the version used by current react-scripts) which leaves me with a 600 lines long dependency tree. This cannot all be runtime dependencies. Much of that is certainly for build/dev time only, right?

So, how can I tell which dep is shipped?

[alexander-akait]

What is wrong with tool that I recommend? What do you want from webpack here?

This cannot all be runtime dependencies.

All dependencies are used, because they are in dependencies

[alexander-akait]

@babel/runtime is not the same The generated JS code that's executed, you need plugin for this, what you need? Licenses or just list or licenses + list

[mike-lischke]

I would need a list of libraries used by webpack, that are shipped in the final bundles. I know that these libraries are not directly shipped, but embedded in the final code. Yet this code is licensed and I need to know from which library any code ended up in these final bundles.

[alexander-akait]

You can try https://github.com/xz64/license-webpack-plugin

[mike-lischke]

Thanks for your help, Alex. I already use that plugin for the other licenses. Only Webpack wasn't clear. However, I inspected more deeply what the bundle analyzer provides and I can see all the code and their node module origin. This is a super helpful analysis and this tool will certainly be part of my toolset for future tasks. In the graphic I see no reference to webpack, so I assume nothing from the webpack code actually ends up in the generated bundles. Webpack is a build-time only tool. Again, many thanks for your patience and help Alex!

[alexander-akait]

Yes, webpack doesn't include something extra, only own core

[sokra]

The webpack core doesn't add any 3rd party code automatically (plugins and other tooling might do).

But we add a bunch of runtime code depending on what you use. You find this code in this repo in these files:

• webpack/hot/*
• *.runtime.js
• *RuntimeModule.js

[mike-lischke]

Excellent, that's the answer I was hoping for. Many thanks @sokra.