
Security News
CISA’s 2025 SBOM Guidance Adds Hashes, Licenses, Tool Metadata, and Context
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Sarah Gooding
August 18, 2025
In the latest JavaScript linting news, Oxlint has rolled out a preview of type-aware linting over the weekend, bringing long-requested rules like no-floating-promises
to its Rust-based engine. This marks a significant step for a project that until now has focused on syntax-only linting.
For years, developers have faced a tradeoff between performance and depth. Rust-based linters like Biome and Oxlint deliver blazing speed, but they’ve lacked the type-aware rules that make typescript-eslint
indispensable. That has begun to change: Biome v2 (“Biotype”) introduced its own type inference engine that powers type-aware linting without relying on the TypeScript compiler, while Oxlint is now previewing a different approach by integrating with typescript-go
.
As Josh Goldberg outlined in his January 2024 post Rust-Based JavaScript Linters: Fast, But No Typed Linting Right Now, Rust linters could never be considered full replacements because they lacked type-checked rules. Those rules rely on TypeScript’s compiler APIs, which are inherently slower but allow for more sophisticated checks, such as catching unhandled promises or unsafe assignments.
Goldberg’s post even predicted that this landscape might change with TypeScript’s rewrite in Go. Oxlint’s new preview makes that prediction real.
tsgolint
and typescript-go
#The new functionality builds on tsgolint, a fork of a prototype originally started under the typescript-eslint
project. With permission from that team, Oxc adopted and slimmed down the tool, focusing solely on type-aware linting rules.
"The original project isn’t actively worked on anymore," VoidZero founder Evan You said. "We offered to host and continue the development of the project after getting permission from the ts-eslint team. We have the original author of the prototype @auvred working with us on the new fork.
"We also have direct communication with the TS team on the progress of the project, as tsgo
itself is still very much in development. We are contributing to tsgo
to help improve the performance of both tsgo
and oxlint."
Here’s how it works:
typescript-go
to perform type-aware checks, returning structured diagnostics.This pipeline avoids the bottlenecks of calling into TypeScript’s JavaScript APIs. Instead, it leans on typescript-go
, the new compiler implementation written in Go, to deliver type-aware checks at much higher speed.
Benchmarks from Oxlint’s CI show projects linting in seconds that previously took minutes with typescript-eslint
:
This represents a dramatic performance improvement while still offering rules traditionally considered “too slow” for everyday linting.
The preview isn’t production-ready yet. Known issues include memory and deadlock problems on large monorepos and the need to carefully match versions of typescript-go
. The team is also working on:
These are targeted for a tsgolint v1.0 release.
The announcement was met with interest from developers who have been following the rapid evolution of type-aware linting. Rob Palmer described it as a “fast-moving space” with multiple experimental approaches, noting that the Oxc team’s blog post helped clarify how their design fits into the broader landscape.
Others pointed out the practical benefits. VoidZero developer relations engineer Alexander Lichter explained that many important rules, such as those that detect floating promises, require type information and have traditionally been slow because of the need to invoke the TypeScript compiler. With tsgolint and typescript-go
, that performance barrier is reduced.
Some in the community also looked ahead to possible integrations. Developer Jacob Groß suggested combining linting and compilation in CI to avoid parsing files twice, referencing work in TSSLint that experimented with this approach.
Evan You responded that while technically feasible, Oxlint’s reliance on a vendored version of typescript-go
makes version alignment more complicated than in tools that act as a TypeScript plugin.
"Technically for sure - the tricky part is that tsgolint is a vendored/shimmed version of tsgo, so it will be up to the user to ensure the versions align and I find that icky," You said.
"Tsslint doesn’t have that problem because it functions as a tsc plugin so it can just hook into whatever version of tsc the user is using - unfortunately tsgo will probably never have that level of plugin support."
For developers, this preview signals the beginning of type-aware linting at native speed. The gap that Josh Goldberg described as “a very long time until feasible” is starting to close.
While not yet a replacement for typescript-eslint
, Oxlint’s preview shows how typed rules can be paired with high performance, and sets the stage for a new phase in JavaScript linting.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.