
Security News
Free Certified Patch for Critical Rails Active Storage Vulnerability
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.
@figma/eslint-plugin-html-cem
Advanced tools
ESLint plugin that lints custom-element usage in HTML files against a Custom Elements Manifest (CEM).
CEM-aware HTML linting for ESLint. Validates custom-element usage in .html files (and HTML-in-JS template literals) against a project's Custom Elements Manifest (custom-elements.json).
Built on top of @html-eslint/parser — uses its AST, doesn't fork it.
@html-eslint/eslint-plugin ships rules for standard HTML5 only. It has no concept of a custom element's contract, so usages like <my-button labl="Save" variant="ghost"> slip through. This plugin loads your CEM and adds rules that catch unknown elements, unknown attributes, missing required attributes, invalid attribute values, unknown slot names, and deprecated usage.
npm i -D @figma/eslint-plugin-html-cem @html-eslint/parser
// eslint.config.js
import htmlParser from "@html-eslint/parser";
import htmlCem from "@figma/eslint-plugin-html-cem";
export default [
{
files: ["**/*.html"],
languageOptions: { parser: htmlParser },
plugins: { "html-cem": htmlCem },
settings: {
"html-cem": {
manifests: [
"./custom-elements.json",
"./node_modules/@my-org/components/custom-elements.json",
],
},
},
rules: {
...htmlCem.configs.recommended.rules,
},
},
];
| Rule | Description |
|---|---|
html-cem/no-unknown-element | Flag dashed tags not registered in any loaded CEM. |
html-cem/no-unknown-attr | Flag attributes on a known custom element that aren't in its CEM. |
html-cem/require-attrs | Flag missing attributes marked @required in the CEM description. |
html-cem/no-invalid-attr-value | Validate values against CEM types (boolean / number / string-literal unions). |
html-cem/no-unknown-slot | Flag slot="x" not declared in the parent element's CEM slots[]. |
html-cem/no-deprecated | Warn on elements/attrs marked deprecated in CEM. |
v0 — APIs may change. Feedback welcome.
MIT
FAQs
ESLint plugin that lints custom-element usage in HTML files against a Custom Elements Manifest (CEM).
The npm package @figma/eslint-plugin-html-cem receives a total of 0 weekly downloads. As such, @figma/eslint-plugin-html-cem popularity was classified as not popular.
We found that @figma/eslint-plugin-html-cem demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 55 open source maintainers collaborating on the project.

Security News
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.

Security News
/Threat Research
A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.