Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
@cody-greene/eslint-config
Advanced tools
eslint@^2.2.0
This package offers two eslint config files:
lax.yml
by adding opinionated styling rulesWhen installing this module manually: be sure to use
npm install cody-greene/eslint-config#vXXX
To configure a project, add something like this to package.json
:
{
"eslintConfig": {
"root": true,
"extends": "./node_modules/eslint-config/strict.yml",
"env": {
"browser": true,
"commonjs": true,
"es6": true
},
"parserOptions": {
"ecmaVersion": 6,
"ecmaFeatures": {
"experimentalObjectRestSpread": true
},
"sourceType": "module"
}
},
"devDependencies": {
"eslint-config": "cody-greene/eslint-config#v1.0.0"
}
}
Once the project is configured, make sure the appropriate eslint plugin is installed for real-time feedback.
eslint --fix <file>
will automatically fix several issues from the strict.yml
ruleset, including:
array-bracket-spacing
eqeqeq
indent
keyword-spacing
no-multi-spaces
no-spaced-func
object-curly-spacing
quotes
semi
space-before-function-paren
space-unary-ops
no-trailing-spaces Remove any trailing whitespace (configure your editor to do this automatically)
eol-last End files with a single newline character (configure your editor to do this automatically)
indent Use soft tabs set to 2 spaces (editor config). And try to limit lines to 100 columns. A complete .editorconfig
is also provided. Install the plugin for sublime, vim, etc if you'd rather have per-project indentation settings.
Why? Same line-length & indentation when looking at the editor, the terminal, or github. Viewing hard-tabs properly in the terminal means adding
tabs -2
to~/.profile
as well as settinggit config --global core.pager 'less --tabs=1,3 --RAW-CONTROL-CHARS'
. Viewing tabs on github as less than the default 8-spaces requires a browser extension.
semi Never use semicolons
quotes Use 'single-quotes'
except when avoiding escape sequences e.g. an apostrophe
space-before-function-paren Place 1 space before the arguments list of anonymous functions
// bad
doSomething(function(err, res) {
console.log(err, res)
})
// good
doSometing(function (err, res) {
console.log(err, res)
})
no-space-func Place no space between a function name the the arguments list
keyword-spacing Place 1 space before the opening parenthesis in control statements.
// bad
if(isJedi) {
fight ()
}
// good
if (isJedi) {
fight()
}
else
& if-else
should not be next to a closing brace.// bad
if (foo){
bar()
}else
{
baz()
}
// good
if (foo) {
bar()
}
else {
baz()
}
// exception: one-liners (good)
function test(){ return 'test' }
if (foo) bar()
else baz()
// bad
function bar() {
console.log(foo)
}
// good
if (baz) {
console.log(qux)
} else {
console.log(foo)
}
// bad
function bar( foo ) {
return foo + baz( qux )
}
// good
if (foo) {
console.log(foo)
}
// bad
const foo = [ 1, 2, 3 ]
console.log(foo[ 0 ])
// good
const foo = [1, 2, 3]
console.log(foo[0])
// bad
if (someCondition ||
otherCondition) {
}
// good
if (someCondition
|| otherCondition) {
}
// bad
const test = function (){ return 'hello' }
// good
function test(){ return 'hello' }
// exception: arrow-functions
const test = () => 'hello'
var/let/const
declaration per variableWhy? It's easier to add/remove variables without messing with commas. Also, v8 will de-optimize any blocks containing
let foo, bar
(but notvar foo, bar
)
// bad
const foo = 867
, bar = 53
, baz = 0.9
// good
const foo = 867
const bar = 53
const baz = 0.9
/** ... */
for multi-line jsdoc style comments/**
* Post a new job for an active worker to execute
* @example
* let redis = require('redis').createClient()
* // You may want to partially bind this:
* // enqueue = enqueue.bind(null, redis)
* enqueue(redis, {queue:'low', type:'ping'}, console.log)
* enqueue(redis, {queue:'hi', type:'ping', params: {
* foo: true,
* bar: 'baz'
* }}, console.log)
* @param {RedisClient} redis
* @param {string} opt.queue e.g. critical, high, low
* @param {string} opt.type Name of the job handler
* @param {object?} opt.params e.g. userid: '123' (may be null)
* @param {number?} opt.time Delay the job until: epoch-time in milliseconds (default: no delay)
* @param {function} done(err, id) Receives a unique job id if successful
* @returns {boolean} false if redis command was added to offline queue
*/
function enqueue(redis, opt, done) {}
TODO
& FIXME
to annotate problemsclass Calculator extends Abacus {
constructor() {
super()
// TODO: total should be configurable by an options param
this.total = 0
}
}
// bad
for (let i = 0; i < list.length; ++i) {
let e = list[i]
console.log(i, e)
}
// good
for (let index = 0; index < attendeeList.length; ++index) {
let person = attendeeList[index]
console.log(index, person)
}
// bad
var isDefault = answer === 1 ? true : false;
// good
var isDefault = answer === 1;
// bad
var foo = foo ? foo : 1;
// good
var foo = foo || 1;
v<eslint-major>.<eslint-minor>.<config-version>[-cp]
example: eslint@2.2.0
FAQs
> eslint@^2.2.0
The npm package @cody-greene/eslint-config receives a total of 13 weekly downloads. As such, @cody-greene/eslint-config popularity was classified as not popular.
We found that @cody-greene/eslint-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.