Recommended Free Tools
Sherif is a zero-config linter for JavaScript and TypeScript monorepos. It checks package and dependency consistency, workspace definitions, and root-package conventions; it can run from the repository root without an installed node_modules directory. You can invoke it with PNPM, Bun, npm, or Yarn, then decide whether to fix findings automatically or make changes by hand.
What Sherif checks
Sherif’s documented rules aim to standardize package layouts and dependencies across a workspace. They encode conventions, not universal requirements: if your repository intentionally differs, review the finding and use an ignore option where appropriate.
As an Amazon Associate I earn from qualifying purchases.
Dependency consistency
multiple-dependency-versionsflags dependencies whose versions differ across the monorepo.unsync-similar-dependenciesflags related dependencies that should stay aligned within a package, such asreactandreact-dom.- Other checks cover empty dependency fields, type packages placed in runtime dependencies, and alphabetic ordering of dependencies.
Workspace and root-package conventions
- Workspace paths should match packages, and matched packages should contain a
package.json. - The root package should declare its package manager and be marked private.
- Root dependencies should be placed in
devDependencies.
How to run Sherif
From the monorepo root, use the runner for your package manager:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- PNPM:
pnpm dlx sherif@latest - Bun:
bunx sherif@latest - npm:
npx sherif@latest - Yarn:
yarn dlx sherif@latest
These commands use latest, so the version can change over time. For repeatable CI results, pin a version after addressing existing findings rather than relying on a moving tag. Sherif’s documentation also provides a GitHub Action and an npm-based CI workflow; follow the project README for the current setup details: Sherif on GitHub.
#1 Best Overall
How findings affect the command result
By default, errors make Sherif exit with code 1. A clean run or warnings alone exit with code 0. Add --fail-on-warnings if warning-only results should also fail the command—for example, when CI should enforce every enabled check.
Autofix and lockfile effects
Use --fix to let Sherif automatically correct most issues. Autofix is disabled when the $CI environment variable is set, so do not assume a CI run will modify files. When resolving multiple dependency versions, --select highest or --select lowest chooses which version to use without an interactive prompt.
Rank #2
A fix may run the package manager’s install command to update a lockfile. Use --no-install to disable that step, then inspect the resulting changes and run the appropriate install command yourself if needed. Review any automatic dependency choice before merging, especially when packages have different compatibility requirements.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsConfiguration and intentional exceptions
You can set options on the command line or in a sherif field in the root package.json. Documented configuration keys include fix, select, noInstall, failOnWarnings, ignoreDependency, ignorePackage, and ignoreRule. CLI arguments take precedence over file configuration.
Ignore controls let a team keep the checks that match its conventions without treating every intentional exception as a defect. Ignore only the specific dependency, package, or rule that needs an exception, and make sure the remaining checks still reflect the standards you want enforced.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When Sherif fits a monorepo
Sherif is a practical fit when a team wants one command to flag inconsistencies across JavaScript or TypeScript packages and is comfortable with its documented conventions. Before adding it to a required CI check, consider:
Rank #4
- Whether your package manager is PNPM, Bun, npm, or Yarn.
- Whether the dependency alignment, workspace, and root-package rules match your intended layout.
- Whether errors alone should fail CI, or warnings should fail too.
- Whether CI should only report issues or whether developers will use autofix locally.
- Which intentional exceptions need narrow ignore rules.
The useful distinction is between a repository mistake and a deliberate difference: Sherif can surface both, but your team must decide which findings to fix and which to exempt.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
