
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@eslint/compat
Advanced tools
This package contains functions that allow you to wrap existing ESLint rules, plugins, and configurations that were intended for use with ESLint v8.x or v9.x to allow them to work as-is in ESLint v9.x and v10.x.
Note: All plugins are not guaranteed to work in ESLint v9.x or v10.x. This package fixes the most common issues but can't fix everything.
For Node.js and compatible runtimes:
npm install @eslint/compat -D
# or
yarn add @eslint/compat -D
# or
pnpm install @eslint/compat -D
# or
bun add @eslint/compat -D
For Deno:
deno add @eslint/compat
This package exports the following functions in both ESM and CommonJS format:
fixupRule(rule) - wraps the given rule in a compatibility layer and returns the resultfixupPluginRules(plugin) - wraps each rule in the given plugin using fixupRule() and returns a new object that represents the plugin with the fixed-up rulesfixupConfigRules(configs) - wraps all plugins found in an array of config objects using fixupPluginRules()includeIgnoreFile(path) - reads an ignore file (like .gitignore) and converts the patterns into the correct format for the config fileIf you have a rule that you'd like to make compatible with ESLint v9.x or v10.x, you can do so using the fixupRule() function:
// ESM example
import { fixupRule } from "@eslint/compat";
// Step 1: Import your rule
import myRule from "./local-rule.js";
// Step 2: Create backwards-compatible rule
const compatRule = fixupRule(myRule);
// Step 3 (optional): Export fixed rule
export default compatRule;
Or in CommonJS:
// CommonJS example
const { fixupRule } = require("@eslint/compat");
// Step 1: Import your rule
const myRule = require("./local-rule.js");
// Step 2: Create backwards-compatible rule
const compatRule = fixupRule(myRule);
// Step 3 (optional): Export fixed rule
module.exports = compatRule;
If you are using a plugin in your eslint.config.js that is not yet compatible with ESLint v9.x or v10.x, you can wrap it using the fixupPluginRules() function:
// eslint.config.js - ESM example
import { defineConfig } from "eslint/config";
import { fixupPluginRules } from "@eslint/compat";
import somePlugin from "eslint-plugin-some-plugin";
export default defineConfig([
{
plugins: {
// insert the fixed plugin instead of the original
somePlugin: fixupPluginRules(somePlugin),
},
rules: {
"somePlugin/rule-name": "error",
},
},
]);
Or in CommonJS:
// eslint.config.js - CommonJS example
const { defineConfig } = require("eslint/config");
const { fixupPluginRules } = require("@eslint/compat");
const somePlugin = require("eslint-plugin-some-plugin");
module.exports = defineConfig([
{
plugins: {
// insert the fixed plugin instead of the original
somePlugin: fixupPluginRules(somePlugin),
},
rules: {
"somePlugin/rule-name": "error",
},
},
]);
If you are importing other configs into your eslint.config.js that use plugins that are not yet compatible with ESLint v9.x or v10.x, you can wrap the entire array or a single object using the fixupConfigRules() function:
// eslint.config.js - ESM example
import { defineConfig } from "eslint/config";
import { fixupConfigRules } from "@eslint/compat";
import someConfig from "eslint-config-some-config";
export default defineConfig([
...fixupConfigRules(someConfig),
{
// your overrides
},
]);
Or in CommonJS:
// eslint.config.js - CommonJS example
const { defineConfig } = require("eslint/config");
const { fixupConfigRules } = require("@eslint/compat");
const someConfig = require("eslint-config-some-config");
module.exports = defineConfig([
...fixupConfigRules(someConfig),
{
// your overrides
},
]);
If you were using an alternate ignore file in ESLint v8.x, such as using --ignore-path .gitignore on the command line, you can include those patterns programmatically in your config file using the includeIgnoreFile() function.
The includeIgnoreFile() function also accepts a second optional name parameter that allows you to set a custom name for this configuration object. If not specified, it defaults to "Imported .gitignore patterns". For example:
// eslint.config.js - ESM example
import { defineConfig } from "eslint/config";
import { includeIgnoreFile } from "@eslint/compat";
import path from "node:path";
import { fileURLToPath } from "node:url";
const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);
const gitignorePath = path.resolve(__dirname, ".gitignore");
export default defineConfig([
includeIgnoreFile(gitignorePath, "Imported .gitignore patterns"), // second argument is optional.
{
// your overrides
},
]);
Or in CommonJS:
// eslint.config.js - CommonJS example
const { defineConfig } = require("eslint/config");
const { includeIgnoreFile } = require("@eslint/compat");
const path = require("node:path");
const gitignorePath = path.resolve(__dirname, ".gitignore");
module.exports = defineConfig([
includeIgnoreFile(gitignorePath, "Imported .gitignore patterns"), // second argument is optional.
{
// your overrides
},
]);
Limitation: This works without modification when the ignore file is in the same directory as your config file. If the ignore file is in a different directory, you may need to modify the patterns manually.
Apache 2.0
The following companies, organizations, and individuals support ESLint's ongoing maintenance and development. Become a Sponsor to get your logo on our READMEs and website.
FAQs
Compatibility utilities for ESLint
The npm package @eslint/compat receives a total of 2,493,574 weekly downloads. As such, @eslint/compat popularity was classified as popular.
We found that @eslint/compat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.