Detecting and removing bloated dependencies in CommonJS packages

TL;DR

This paper investigates bloated dependencies in server-side JavaScript applications using CommonJS, introducing a trace-based dynamic analysis to accurately identify and remove unnecessary dependencies, improving performance and maintainability.

Contribution

It presents the first study on bloated dependencies in server-side CommonJS applications and proposes a novel trace-based analysis method for detection.

Findings

50.6% of dependencies are bloated

Trace-based analysis outperforms static methods

Removing direct bloated dependencies reduces indirect bloat

Abstract

JavaScript packages are notoriously prone to bloat, a factor that significantly impacts the performance and maintainability of web applications. While web bundlers and tree-shaking can mitigate this issue in client-side applications, state-of-the-art techniques have limitations on the detection and removal of bloat in server-side applications. In this paper, we present the first study to investigate bloated dependencies within server-side JavaScript applications, focusing on those built with the widely used and highly dynamic CommonJS module system. We propose a trace-based dynamic analysis that monitors the OS file system to determine which dependencies are not accessed during runtime. To evaluate our approach, we curate an original dataset of 91 CommonJS packages with a total of 50,488 dependencies. Compared to the state-of-the-art dynamic and static approaches, our trace-based analysis demonstrates higher accuracy in detecting bloated dependencies. Our analysis identifies 50.6% of the 50,488 dependencies as bloated: 13.8% of direct dependencies and 51.3% of indirect dependencies. Furthermore, removing only the direct bloated dependencies by cleaning the dependency configuration file can remove a significant share of unnecessary bloated indirect dependencies while preserving functional correctness.