
Security News
Scaling Socket from Zero to 10,000+ Organizations
Socket CEO Feross Aboukhadijeh shares lessons from scaling a developer security startup to 10,000+ organizations in this founder interview.
@aarondewes/wp-eslint-plugin
Advanced tools
ESLint plugin including configurations and custom rules for WordPress development.
Install the module
npm install @wordpress/eslint-plugin --save-dev
Note: This package requires node 12.0.0 or later, and npm 6.9.0 or later. It is not compatible with older versions.
To opt-in to the default configuration, extend your own project's .eslintrc file:
{
"extends": [ "plugin:@wordpress/eslint-plugin/recommended" ]
}
Refer to the ESLint documentation on Shareable Configs for more information.
The recommended preset will include rules governing an ES2015+ environment, and includes rules from the eslint-plugin-jsx-a11y, eslint-plugin-react, and eslint-plugin-prettier projects. It also includes an optional integration with @typescript-eslint/eslint-plugin that gets activated when the typescript package is installed in the project.
There is also recommended-with-formatting ruleset for projects that want to opt out from Prettier. It has the native ESLint code formatting rules enabled instead.
Alternatively, you can opt-in to only the more granular rulesets offered by the plugin. These include:
customes5esnextjsdocjsx-a11yreacti18ntest-e2etest-unitFor example, if your project does not use React, you could consider extending including only the ESNext rules in your project using the following extends definition:
{
"extends": [ "plugin:@wordpress/eslint-plugin/esnext" ]
}
These rules can be used additively, so you could extend both esnext and custom rulesets, but omit the react and jsx-a11y configurations.
The granular rulesets will not define any environment globals. As such, if they are required for your project, you will need to define them yourself.
| Rule | Description | Recommended |
|---|---|---|
| data-no-store-string-literals | Discourage passing string literals to reference data stores | |
| dependency-group | Enforce dependencies docblocks formatting | âś“ |
| gutenberg-phase | Governs the use of the process.env.GUTENBERG_PHASE constant | âś“ |
| no-base-control-with-label-without-id | Disallow the usage of BaseControl component with a label prop set but omitting the id property | âś“ |
| no-unguarded-get-range-at | Disallow the usage of unguarded getRangeAt calls | âś“ |
| no-unused-vars-before-return | Disallow assigning variable values if unused before a return | âś“ |
| react-no-unsafe-timeout | Disallow unsafe setTimeout in component | |
| valid-sprintf | Enforce valid sprintf usage | âś“ |
| i18n-ellipsis | Disallow using three dots in translatable strings | âś“ |
| i18n-no-collapsible-whitespace | Disallow collapsible whitespace in translatable strings | âś“ |
| i18n-no-placeholders-only | Prevent using only placeholders in translatable strings | âś“ |
| i18n-no-variables | Enforce string literals as translation function arguments | âś“ |
| i18n-text-domain | Enforce passing valid text domains | âś“ |
| i18n-translator-comments | Enforce adding translator comments | âś“ |
If you are using WordPress' .jshintrc JSHint configuration and you would like to take the first step to migrate to an ESLint equivalent it is also possible to define your own project's .eslintrc file as:
{
"extends": [ "plugin:@wordpress/eslint-plugin/jshint" ]
}

This fork contains a few cleanups and one style change by not requiring and remooving spaces around parentheses.
FAQs
ESLint plugin for WordPress development.
We found that @aarondewes/wp-eslint-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh shares lessons from scaling a developer security startup to 10,000+ organizations in this founder interview.

Research
Socket Threat Research maps a rare inside look at OtterCookie’s npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean operators.

Research
Socket researchers identified a malicious Chrome extension that manipulates Raydium swaps to inject an undisclosed SOL transfer, quietly routing fees to an attacker wallet.