package.json Validator
Validate a package.json: required fields, npm naming rules, semver ranges and structural mistakes.
What is package.json Check?
A package.json validator that works on the raw text, so it can report things JSON.parse hides: duplicate keys keep only the last value, and the error message for broken JSON carries the line number rather than a stack trace.
How it works
The file is parsed and then checked in layers: npm's naming rules, strict semver for the version, npm range evaluation for every dependency spec, `files`, `exports` and `bin` shapes, engines ranges, script hygiene, and overlaps between dependencies, devDependencies, peerDependencies and optionalDependencies. Findings are graded error, warning or note, with an explanation of why each rule exists.
- Paste or fill in the input. Drop in a commit message, a diff, a package.json, a path list or a set of options. The tool reads it locally — nothing is uploaded and no repository is contacted.
- Adjust the rules to match your project. Every linter here takes its convention from a setting you can change: allowed commit types, header length, target branch length, known branch names. Set them once to what your team actually uses.
- Copy the result. Generated files copy straight to the clipboard or download as a real file with the right name (.gitignore, CODEOWNERS, LICENSE, COMMIT_EDITMSG), and Reset returns every field to its default.
Examples
A commit message that fails CI
"Updated(auth): Fixed the expired-token redirect." is rejected by release automation and reported here with the exact reasons: unknown type, capitalised description, past tense and a trailing period.
A .gitignore that only half works
The Checker shows which rule decides a path — and why `!keep.txt` inside an ignored directory never fires, the mistake that sends people to Stack Overflow.
A dependency bump nobody reviewed
The package.json Diff separates added, removed and changed entries per section, so a caret bump of a runtime dependency does not hide inside a lockfile-sized pull request.
A diff pasted from a code review comment
The Diff Viewer understands several `diff --git` blocks, mode-only changes, renames and binary stubs, and calls out a pasted `--stat` summary instead of rendering an empty box.
Common mistakes
Committing a .gitignore without checking it
Rules look right and behave differently: a pattern containing a slash is anchored to the root, a trailing slash means directories only, and a file inside an ignored directory cannot be re-included. Check the paths that matter before you commit the file.
Rewriting published history
A clean commit history is worth having, but amend, rebase and filter-repo change commit hashes. Only rewrite commits that nobody has pulled; after a rewrite, push with --force-with-lease rather than --force.
Treating a generated file as if it were reviewed
These tools produce a starting point, not a decision. Check the licence text against the canonical source, read the security policy before publishing it, and make sure a CODEOWNERS team actually exists — GitHub silently ignores rules whose owner has no write access.
Putting slow checks in a pre-commit hook
A hook that takes 30 seconds gets bypassed with --no-verify within a week, and then it protects nothing. Keep pre-commit to formatting and linting, move type checks and tests to pre-push or CI.
Frequently asked questions
Does this check whether my dependencies exist on npm?
No — that would need a network call and a registry, and this tool runs entirely in the browser. What it checks is whether each spec is a range npm can evaluate at all, which is the class of mistake you can fix without leaving the editor.
Why is a package in both dependencies and devDependencies a problem?
npm resolves it from `dependencies` and warns, so the devDependencies entry silently does nothing. It usually signals a copy-paste during a refactor.
Why does the validator complain about `latest`?
It is valid but not reproducible: `latest` resolves to whatever that tag points at today, so two installs a week apart can produce different trees. Pin a range unless you genuinely want to track the newest release.