
Security News
CISA Kills Off RSS Feeds for KEVs and Cyber Alerts
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.
Security News
Sarah Gooding
May 13, 2025
ESLint’s transformation into a truly language-agnostic linter continues to gain momentum. Following previous rollouts for JSON, Markdown, and CSS, HTML is the latest language to join the party, thanks to a powerful new integration with @html-eslint/eslint-plugin
, which is now fully compatible with ESLint’s new language plugin architecture.
This marks a significant milestone in ESLint’s long-term vision: one unified linter for all the markup and code that developers touch, not just JavaScript.
In 2024, ESLint began a major transition toward becoming a language-agnostic platform. This move followed years of community interest in using ESLint to lint non-JavaScript files, something many developers were already doing unofficially, with mixed results. The ESLint Technical Steering Committee decided to formalize this capability after seeing plugin authors attempt to lint languages like GraphQL and HTML through brittle workarounds.
By extracting JavaScript-specific logic from the core and introducing a plugin API for other languages, ESLint created a foundation for official support across formats like JSON, Markdown, CSS, and now HTML. This shift not only modernizes the architecture, but also opens the door for broader ecosystem collaboration, where language-specific tooling can be built and maintained by domain experts, not just core ESLint contributors.
"The vision for language plugins was always to enable the community to lint any language they want," ESLint creator Nicholas C. Zakas said. "We expect to see more like this in the future."
Unlike traditional HTML linters, this isn’t just about static files. The plugin supports HTML wherever it shows up, including inside JavaScript or TypeScript template literals, a common pattern in libraries like Lit. It’s also built to accommodate templating syntaxes like Handlebars or EJS, allowing developers to lint markup without fighting their tooling.
This modern, extensible approach puts html-eslint on solid footing, not just for static sites, but for complex component-driven architectures and full-stack web apps.
The plugin ships with 48 rules out of the box, covering a wide range of quality concerns:
no-duplicate-attrs
, no-obsolete-tags
, require-doctype
require-img-alt
, no-positive-tabindex
, require-input-label
require-meta-description
, require-title
, require-lang
indent
, quotes
, sort-attrs
Among these, 15 rules are marked as recommended (⭐), and 16 are auto-fixable (🔧), making it easy to catch issues early and clean them up automatically.
Standout rules include:
require-closing-tags
(⭐🔧): Helps enforce consistent tag structure.require-button-type
(🔧): Prevents broken button behavior across browsers.require-meta-viewport
: Encourages mobile-friendly design practices.This ruleset doesn’t just catch obvious errors. It also helps enforce consistent, semantic HTML.
The plugin already sees nearly 55,000 downloads per week, signaling real demand for unified tooling across JavaScript ecosystems. Whether you’re maintaining static HTML, building components in Lit, or working with server-rendered templates, this release brings HTML into ESLint users' workflow with no extra tooling required.
Meanwhile, the JSON plugin has climbed past 84,000 weekly downloads on npm, and the CSS plugin is holding steady at over 41,000. The most widely adopted so far is the Markdown plugin, with 193,000+ downloads per week, which is unsurprising given its central role in READMEs, docs, and developer content. Together, these numbers highlight a growing shift toward unified tooling, where developers can lint everything from code to content with a single, extensible engine.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.
Security News
The MCP community is launching an official registry to standardize AI tool discovery and let agents dynamically find and install MCP servers.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.