Movatterモバイル変換


[0]ホーム

URL:


🚨 Shai-Hulud Strikes Again:834 Packages Compromised.Technical Analysis →

eslint

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

eslint

An AST-based pattern checker for JavaScript.

Version
9.6.0
Version published
Weekly downloads
69M
1.01%
Maintainers
0
Weekly downloads
 
Created

npm versionDownloadsBuild StatusFOSSA Status
Open Collective BackersOpen Collective SponsorsFollow us on Twitter

ESLint

Website |Configure ESLint |Rules |Contribute to ESLint |Report Bugs |Code of Conduct |Twitter |Discord |Mastodon

ESLint is a tool for identifying and reporting on patterns found in ECMAScript/JavaScript code. In many ways, it is similar to JSLint and JSHint with a few exceptions:

  • ESLint usesEspree for JavaScript parsing.
  • ESLint uses an AST to evaluate patterns in code.
  • ESLint is completely pluggable, every single rule is a plugin and you can add more at runtime.

Table of Contents

Installation and Usage

Prerequisites:Node.js (^18.18.0,^20.9.0, or>=21.1.0) built with SSL support. (If you are using an official Node.js distribution, SSL is always built in.)

You can install and configure ESLint using this command:

npm init @eslint/config@latest

After that, you can run ESLint on any file or directory like this:

./node_modules/.bin/eslint yourfile.js

Configuration

After runningnpm init @eslint/config, you'll have aneslint.config.js (oreslint.config.mjs) file in your directory. In it, you'll see some rules configured like this:

import pluginJsfrom"@eslint/js";exportdefault [ pluginJs.configs.recommended, ];

The names"semi" and"quotes" are the names ofrules in ESLint. The first value is the error level of the rule and can be one of these values:

  • "off" or0 - turn the rule off
  • "warn" or1 - turn the rule on as a warning (doesn't affect exit code)
  • "error" or2 - turn the rule on as an error (exit code will be 1)

The three error levels allow you fine-grained control over how ESLint applies rules (for more configuration options and details, see theconfiguration docs).

Code of Conduct

ESLint adheres to theJS Foundation Code of Conduct.

Filing Issues

Before filing an issue, please be sure to read the guidelines for what you're reporting:

Frequently Asked Questions

I'm using JSCS, should I migrate to ESLint?

Yes.JSCS has reached end of life and is no longer supported.

We have prepared amigration guide to help you convert your JSCS settings to an ESLint configuration.

We are now at or near 100% compatibility with JSCS. If you try ESLint and believe we are not yet compatible with a JSCS rule/configuration, please create an issue (mentioning that it is a JSCS compatibility issue) and we will evaluate it as per our normal process.

Does Prettier replace ESLint?

No, ESLint and Prettier have different jobs: ESLint is a linter (looking for problematic patterns) and Prettier is a code formatter. Using both tools is common, refer toPrettier's documentation to learn how to configure them to work well with each other.

Why can't ESLint find my plugins?

  • Make sure your plugins (and ESLint) are both in your project'spackage.json as devDependencies (or dependencies, if your project uses ESLint at runtime).
  • Make sure you have runnpm install and all your dependencies are installed.
  • Make sure your plugins' peerDependencies have been installed as well. You can usenpm view eslint-plugin-myplugin peerDependencies to see what peer dependencieseslint-plugin-myplugin has.

Does ESLint support JSX?

Yes, ESLint natively supports parsing JSX syntax (this must be enabled inconfiguration). Please note that supporting JSX syntaxis not the same as supporting React. React applies specific semantics to JSX syntax that ESLint doesn't recognize. We recommend usingeslint-plugin-react if you are using React and want React semantics.

What ECMAScript versions does ESLint support?

ESLint has full support for ECMAScript 3, 5, and every year from 2015 up until the most recent stage 4 specification (the default). You can set your desired ECMAScript syntax and other settings (like global variables) throughconfiguration.

What about experimental features?

ESLint's parser only officially supports the latest final ECMAScript standard. We will make changes to core rules in order to avoid crashes on stage 3 ECMAScript syntax proposals (as long as they are implemented using the correct experimental ESTree syntax). We may make changes to core rules to better work with language extensions (such as JSX, Flow, and TypeScript) on a case-by-case basis.

In other cases (including if rules need to warn on more or fewer cases due to new syntax, rather than just not crashing), we recommend you use other parsers and/or rule plugins. If you are using Babel, you can use@babel/eslint-parser and@babel/eslint-plugin to use any option available in Babel.

Once a language feature has been adopted into the ECMAScript standard (stage 4 according to theTC39 process), we will accept issues and pull requests related to the new feature, subject to ourcontributing guidelines. Until then, please use the appropriate parser and plugin(s) for your experimental feature.

Which Node.js versions does ESLint support?

ESLint updates the supported Node.js versions with each major release of ESLint. At that time, ESLint's supported Node.js versions are updated to be:

  • The most recent maintenance release of Node.js
  • The lowest minor version of the Node.js LTS release that includes the features the ESLint team wants to use.
  • The Node.js Current release

ESLint is also expected to work with Node.js versions released after the Node.js Current release.

Refer to theQuick Start Guide for the officially supported Node.js versions for a given ESLint release.

Where to ask for help?

Open adiscussion or stop by ourDiscord server.

Why doesn't ESLint lock dependency versions?

Lock files likepackage-lock.json are helpful for deployed applications. They ensure that dependencies are consistent between environments and across deployments.

Packages likeeslint that get published to the npm registry do not include lock files.npm install eslint as a user will respect version constraints in ESLint'spackage.json. ESLint and its dependencies will be included in the user's lock file if one exists, but ESLint's own lock file would not be used.

We intentionally don't lock dependency versions so that we have the latest compatible dependency versions in development and CI that our users get when installing ESLint in a project.

The Twilio blog has adeeper dive to learn more.

Releases

We have scheduled releases every two weeks on Friday or Saturday. You can follow arelease issue for updates about the scheduling of any particular release.

Security Policy

ESLint takes security seriously. We work hard to ensure that ESLint is safe for everyone and that security issues are addressed quickly and responsibly. Read the fullsecurity policy.

Semantic Versioning Policy

ESLint followssemantic versioning. However, due to the nature of ESLint as a code quality tool, it's not always clear when a minor or major version bump occurs. To help clarify this for everyone, we've defined the following semantic versioning policy for ESLint:

  • Patch release (intended to not break your lint build)
    • A bug fix in a rule that results in ESLint reporting fewer linting errors.
    • A bug fix to the CLI or core (including formatters).
    • Improvements to documentation.
    • Non-user-facing changes such as refactoring code, adding, deleting, or modifying tests, and increasing test coverage.
    • Re-releasing after a failed release (i.e., publishing a release that doesn't work for anyone).
  • Minor release (might break your lint build)
    • A bug fix in a rule that results in ESLint reporting more linting errors.
    • A new rule is created.
    • A new option to an existing rule that does not result in ESLint reporting more linting errors by default.
    • A new addition to an existing rule to support a newly-added language feature (within the last 12 months) that will result in ESLint reporting more linting errors by default.
    • An existing rule is deprecated.
    • A new CLI capability is created.
    • New capabilities to the public API are added (new classes, new methods, new arguments to existing methods, etc.).
    • A new formatter is created.
    • eslint:recommended is updated and will result in strictly fewer linting errors (e.g., rule removals).
  • Major release (likely to break your lint build)
    • eslint:recommended is updated and may result in new linting errors (e.g., rule additions, most rule option updates).
    • A new option to an existing rule that results in ESLint reporting more linting errors by default.
    • An existing formatter is removed.
    • Part of the public API is removed or changed in an incompatible way. The public API includes:
      • Rule schemas
      • Configuration schema
      • Command-line options
      • Node.js API
      • Rule, formatter, parser, plugin APIs

According to our policy, any minor update may report more linting errors than the previous release (ex: from a bug fix). As such, we recommend using the tilde (~) inpackage.json e.g."eslint": "~3.1.0" to guarantee the results of your builds.

Stylistic Rule Updates

Stylistic rules are frozen according toour policy on how we evaluate new rules and rule changes.This means:

  • Bug fixes: We will still fix bugs in stylistic rules.
  • New ECMAScript features: We will also make sure stylistic rules are compatible with new ECMAScript features.
  • New options: We willnot add any new options to stylistic rules unless an option is the only way to fix a bug or support a newly-added ECMAScript feature.

License

FOSSA Status

Team

These folks keep the project moving and are resources for help.

Technical Steering Committee (TSC)

The people who manage releases, review feature requests, and meet regularly to ensure ESLint is properly maintained.

Nicholas C. Zakas's Avatar
Nicholas C. Zakas
Francesco Trotta's Avatar
Francesco Trotta
Milos Djermanovic's Avatar
Milos Djermanovic

Reviewers

The people who review and implement new features.

唯然's Avatar
唯然
Nitin Kumar's Avatar
Nitin Kumar

Committers

The people who review and fix bugs and help triage issues.

Josh Goldberg ✨'s Avatar
Josh Goldberg ✨
Tanuj Kanti's Avatar
Tanuj Kanti

Website Team

Team members who focus specifically on eslint.org

Amaresh  S M's Avatar
Amaresh S M
Strek's Avatar
Strek
Percy Ma's Avatar
Percy Ma

Sponsors

The following companies, organizations, and individuals support ESLint's ongoing maintenance and development.Become a Sponsor to get your logo on our README and website.

Platinum Sponsors

AutomatticAirbnb

Gold Sponsors

Eli SchleiferSalesforce

Silver Sponsors

JetBrainsLiftoffAmerican ExpressWorkleap

Bronze Sponsors

notionAnagram SolverIcons8DiscordIgnitionNxHeroCodersNextbase Starter Kit

Technology Sponsors

FAQs

Package last updated on 28 Jun 2024

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks

Research

Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks

Socket Threat Research maps a rare inside look at OtterCookie’s npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean operators.

ByKirill Boychenko  -  Nov 26, 2025
Malicious Chrome Extension Injects Hidden SOL Fees Into Solana Swaps

Research

Malicious Chrome Extension Injects Hidden SOL Fees Into Solana Swaps

Socket researchers identified a malicious Chrome extension that manipulates Raydium swaps to inject an undisclosed SOL transfer, quietly routing fees to an attacker wallet.

ByKush Pandya  -  Nov 25, 2025
Shai Hulud Strikes Again (v2)

Research

/

Security News

Shai Hulud Strikes Again (v2)

Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

BySocket Research Team  -  Nov 24, 2025

[8]ページ先頭

©2009-2025 Movatter.jp