[jameshart]

90% of which are development tools - eslint, testing, typescript, webpack, etc.

The actual runtime dependencies of a react app are basically just react and react-dom.

[infogulch]

Are dependencies that run on your development machine any less of a maintenance or security concern?

[jameshart]

No, but the number being quoted is the sum of two different security concerns - and it’s attributing the concern to ‘react apps’, when actually react itself is pretty clean in terms of dependencies.

[xboxnolifes]

Yes, because they aren't running in prod.