🚀 Big News: Socket Acquires Coana to Bring Reachability Analysis to Every Appsec Team.Learn more
Socket
Sign inDemoInstall
Socket

Security News

ESLint Adds Official Support for Linting HTML

ESLint now supports HTML linting with 48 new rules, expanding its language plugin system to cover more of the modern web development stack.

ESLint Adds Official Support for Linting HTML

Sarah Gooding

May 13, 2025

ESLint’s transformation into a truly language-agnostic linter continues to gain momentum. Following previous rollouts for JSON, Markdown, and CSS, HTML is the latest language to join the party, thanks to a powerful new integration with @html-eslint/eslint-plugin, which is now fully compatible with ESLint’s new language plugin architecture.

This marks a significant milestone in ESLint’s long-term vision: one unified linter for all the markup and code that developers touch, not just JavaScript.

Language-Agnostic Linting #

In 2024, ESLint began a major transition toward becoming a language-agnostic platform. This move followed years of community interest in using ESLint to lint non-JavaScript files, something many developers were already doing unofficially, with mixed results. The ESLint Technical Steering Committee decided to formalize this capability after seeing plugin authors attempt to lint languages like GraphQL and HTML through brittle workarounds.

By extracting JavaScript-specific logic from the core and introducing a plugin API for other languages, ESLint created a foundation for official support across formats like JSON, Markdown, CSS, and now HTML. This shift not only modernizes the architecture, but also opens the door for broader ecosystem collaboration, where language-specific tooling can be built and maintained by domain experts, not just core ESLint contributors.

"The vision for language plugins was always to enable the community to lint any language they want," ESLint creator Nicholas C. Zakas said. "We expect to see more like this in the future."

Designed for Today’s Frontend Stack#

Unlike traditional HTML linters, this isn’t just about static files. The plugin supports HTML wherever it shows up, including inside JavaScript or TypeScript template literals, a common pattern in libraries like Lit. It’s also built to accommodate templating syntaxes like Handlebars or EJS, allowing developers to lint markup without fighting their tooling.

This modern, extensible approach puts html-eslint on solid footing, not just for static sites, but for complex component-driven architectures and full-stack web apps.

What Can It Catch?#

The plugin ships with 48 rules out of the box, covering a wide range of quality concerns:

  • Best practices: no-duplicate-attrs, no-obsolete-tags, require-doctype
  • Accessibility: require-img-alt, no-positive-tabindex, require-input-label
  • SEO: require-meta-description, require-title, require-lang
  • Code style: indent, quotes, sort-attrs

Among these, 15 rules are marked as recommended (⭐), and 16 are auto-fixable (🔧), making it easy to catch issues early and clean them up automatically.

Standout rules include:

  • require-closing-tags (⭐🔧): Helps enforce consistent tag structure.
  • require-button-type (🔧): Prevents broken button behavior across browsers.
  • require-meta-viewport: Encourages mobile-friendly design practices.

This ruleset doesn’t just catch obvious errors. It also helps enforce consistent, semantic HTML.

A Growing Ecosystem#

The plugin already sees nearly 55,000 downloads per week, signaling real demand for unified tooling across JavaScript ecosystems. Whether you’re maintaining static HTML, building components in Lit, or working with server-rendered templates, this release brings HTML into ESLint users' workflow with no extra tooling required.

Meanwhile, the JSON plugin has climbed past 84,000 weekly downloads on npm, and the CSS plugin is holding steady at over 41,000. The most widely adopted so far is the Markdown plugin, with 193,000+ downloads per week, which is unsurprising given its central role in READMEs, docs, and developer content. Together, these numbers highlight a growing shift toward unified tooling, where developers can lint everything from code to content with a single, extensible engine.

Subscribe to our newsletter

Get notified when we publish new security blog posts!

Try it now

Ready to block malicious and vulnerable dependencies?

Install GitHub AppBook a demo

Related posts

Back to all posts