Adds a second library for a job an installed one already does (dayjs beside moment)

Code that already exists: one of the ways AI coding agents bloat software, from lessloc's pattern catalog. What lessloc does: new-dependency names the library that is already installed.

What makes a second library for a job an installed one already does a bad practice?

The standards that call it a bad practice: One obvious way to do it (PEP 20); OWASP Top 10 A06:2021 and A03:2025 Software Supply Chain Failures.

What does lessloc do about a second library for a job an installed one already does?

new-dependency names the library that is already installed.

• new-dependency (tier 2): A new dependency, when there is no approvedDependencies list. It says when an installed one already does the job, or when the lockfile does not pin it.

Related patterns

The other patterns in Code that already exists:

• Reimplementing a helper the project already has: lessloc gives every session the rule: take what is already in the codebase before new code.
• Copying a rule another function owns: lessloc catches it as repeated-literal.
• Keeping old and new versions side by side: lessloc gives every session the rule: one implementation per rule.
• Rebuilding what the standard library or framework has: lessloc gives every session a rule against it and catches it as simpler and reinvented.
• Copy-pasted test cases instead of one parametrized test: lessloc catches it as copied-tests.
• The same data shape in several layers (DTO, model, entity): copy catches identical type bodies.
• The same CSS declarations under another selector: lessloc catches it as style-copy.