http-errors package is missing

[fetis]

I got the next error during the compilation of my project

  Try `npm i --save-dev @types/http-errors` if it exists or add a new declaration (.d.ts) file containing `declare module 'http-errors';`

2 import { HttpError } from 'http-errors';
                            ~~~~~~~~~~~~~

Found 1 error in node_modules/csrf-csrf/dist/index.d.ts:2

Installing the suggested types fixed the issue, but it would be nice to have all dependencies out of the box.

I'm on Typescript 5.8 and Node 22

[psibean]

In this case, the types of http-errors are a dev dependency, you shouldn't be parsing the declaration file types. Albeit, perhaps the rollup could be configured to pull those types in and have them exported, but this is a TypeScript error and can also indicate a misconfigured tsconfig.

You don't need to install those types if you fix your tsconfig.

It looks like you may need to:

1. Set skipLibCheck to true in your tsconfig; or
2. Make sure you do not have node_modules in your includes in your tsconfig

By default TypeScript will typically ignore node_modules for types at transpilation time, with the exception of @types as that's their purpose and they're included by default.

Setting skipLibCheck to true just means that the declaration files in your dependencies won't get type-checked at transpiration, your own stuff will still be type checked. It's recommended by the TypeScript configuration docs that you set this to true.

If you have skipLibCheck set to true already, it could indicate that you have node_modules in your tsconfig includes, you shouldn't typically do that, it is not recommended. If there's anything you know you do need to explicitly include, then include the specific paths to those things, not the entire node_modules directory. Adding node_modules on your type paths is typically unnecessary as @types are included by default. There's a reason TypeScript ignores node_modules by default.

[fetis]

@psibean
Thanks for the reply

skipLibCheck fixes the issue without installing additional packages, but I didn't find that it's recommended by the TS team https://www.typescriptlang.org/tsconfig/#skipLibCheck

As I understood, the main purpose of this flag is the build speed optimization or different lib versions resolution

[psibean]

Interesting, I must have misread.

To make csrf-carf compatible with skipLibCheck: false, I'll look at re-exporting the types from http-errors so they're bundled with it, but in a way where it wouldn't conflict if you also had http-errors as your own dependency.

I might need to look at wrapping the types outputs in a module declaration to scope them better.

[psibean]

Just commenting an update here. I'm not currently sure how this should be addressed or how other packages handle this.

@types/http-errors shouldn't be a dependency because it is only a dev dependency, additionally it shouldn't be expected that people using JavaScript are forced to pull in that dependency when it's only for TypeScript development.

Bundling in the used @types/http-errors so they're re-exported from csrf-csrf doesn't seem like the right approach.