
Security News
Software Engineering Daily Podcast: Feross on AI, Open Source, and Supply Chain Risk
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.
@automattic/eslint-changed
Advanced tools
Run eslint on files, but only report warnings and errors from lines that were changed.
Run ESLint on files and only report new warnings and errors.
Install via your favorite JS package manager. Note the peer dependency on eslint.
For example,
npm install @automattic/eslint-changed eslint
To identify the changes, eslint-changed needs the ESLint output for both the old and new versions of the file, as well as the diff between them.
If you use git, it can determine this automatically. Otherwise, you can supply the necessary information manually.
Options used in both modes are:
--debug: Enable debug output.--ext <list>: Comma-separated list of JavaScript file extensions. Ignored if files are listed. (default: ".js")--format <name>: ESLint format to use for output. (default: "stylish")--in-diff-only: Only include messages on lines changed in the diff. This may miss things like deleting a var that leads to a new no-undef elsewhere.The following options are used with manual mode:
--diff <file>: A file containing the unified diff of the changes.--diff-base <dir>: Base directory the diff is relative to. Defaults to the current directory.--eslint-orig <file>: A file containing the JSON output of eslint on the unchanged files.--eslint-new <file>: A file containing the JSON output of eslint on the changed files.In git mode, eslint-changed needs to be able to run git. If this is not available by that name in the shell path,
set environment variable GIT as appropriate.
The following options are used with git mode:
--git: Signify that you're using git mode.--git-staged: Compare the staged version to the HEAD version (this is the default).--git-unstaged: Compare the working copy version to the staged (or HEAD) version.--git-base <ref>: Compare the HEAD version to the HEAD of a different base (e.g. branch).--eslint-options <name=value...>: Pass additional options for ESLint. Value is interpreted as JSON if possible, otherwise it's treated as a literal string.
See https://eslint.org/docs/latest/integrate/nodejs-api#-new-eslintoptions (or the equivalent for the version of eslint in use) for details on available options.This will compare the staged changes with HEAD.
npx @automattic/eslint-changed --git
This will compare HEAD with origin/trunk.
npx @automattic/eslint-changed --git --git-base origin/trunk
This does much the same as the previous example, but manually. If you're using something other than git, you might do something like this.
# Produce a diff.
git diff origin/trunk...HEAD > /tmp/diff
# Check out the merge-base of origin/trunk and HEAD.
git checkout origin/trunk...HEAD
# Run ESLint.
npx eslint --format=json . > /tmp/eslint.orig.json
# Go back to HEAD.
git checkout -
# Run ESLint again.
npx eslint --format=json . > /tmp/eslint.new.json
# Run eslint-changed.
npx @automattic/eslint-changed --diff /tmp/diff --eslint-orig /tmp/eslint.orig.json --eslint=new /tmp/eslint.new.json
Note that, to be exactly the same as the above, you'd want to extract the list of files from the diff instead of linting everything. But this will work.
This will compare file.js in HEAD with origin/trunk, with the equivalent of passing --flag v10_config_lookup_from_file to eslint.
npx @automattic/eslint-changed --git --git-base origin/trunk --eslint-options flags='["v10_config_lookup_from_file"]' -- file.js
We had been using phpcs-changed for a while, and wanted the same thing for ESLint.
FAQs
Run eslint on files, but only report warnings and errors from lines that were changed.
The npm package @automattic/eslint-changed receives a total of 3,567 weekly downloads. As such, @automattic/eslint-changed popularity was classified as popular.
We found that @automattic/eslint-changed demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 52 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.

Security News
GitHub has revoked npm classic tokens for publishing; maintainers must migrate, but OpenJS warns OIDC trusted publishing still has risky gaps for critical projects.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.