
Security News
OpenClaw Advisory Surge Highlights Gaps Between GHSA and CVE Tracking
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.
@gooddata/eslint-config
Advanced tools
Unified, modular ESLint configuration for the GoodData.UI monorepo.
This package consolidates ESLint configurations that were previously scattered across:
The new approach provides:
Configuration Modules (src/configurations/)
IConfiguration<RulePrefix> interfaceIndex File (src/index.ts)
common array: Base rules applied to all configsvariants object: Different combinations for specific use casesBuild Process (npm run build)
base.json + base.js (all common configs)browser.json/.js, react.json/.js, etc.require → JSON (v8), import → JS (v9)Package Sync (npm run update-package)
package.json dependencies and peer dependenciesFor a complete list of available variants and their required packages, see:
This package also provides oxlint-* variants designed to be used alongside @gooddata/oxlint-config. These variants have certain ESLint plugins disabled because those rules are handled by oxlint instead, providing faster linting performance.
How it works:
oxlint-* variants contain ESLint rules that oxlint does not supportExample usage:
// eslint.config.ts
import config from "@gooddata/eslint-config/oxlint-esm-react-vitest";
export default config;
See @gooddata/oxlint-config for the corresponding oxlint configuration and detailed setup instructions.
This package supports both ESLint v8 (legacy config) and ESLint v9 (flat config):
| ESLint Version | Config Format | File Extension | Import Type |
|---|---|---|---|
| v8 | Legacy JSON | .eslintrc.js | require() |
| v9 | Flat Config | eslint.config.js | import |
The package uses conditional exports to automatically serve the correct format:
Some packages differ between v8 and v9 (e.g., eslint-plugin-header vs eslint-plugin-headers). See PACKAGES_V8.md and PACKAGES_V9.md for the complete list of required packages for each version.
For ESLint v9 with flat config, create an eslint.config.js or eslint.config.ts file:
// eslint.config.ts
// (C) 2025 GoodData Corporation
import config from "@gooddata/eslint-config/esm-react-vitest";
export default config;
To add custom rules or overrides:
// eslint.config.ts
// (C) 2025 GoodData Corporation
import config from "@gooddata/eslint-config/esm-react-vitest";
export default [
...config,
{
rules: {
// Custom rule overrides (applies to all files)
"no-console": "warn",
},
},
];
To add TypeScript-specific rule overrides, specify a files pattern:
// eslint.config.ts
// (C) 2025 GoodData Corporation
import config from "@gooddata/eslint-config/esm-react-vitest";
export default [
...config,
{
files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
rules: {
// TypeScript rule overrides (applies only to TS files)
"@typescript-eslint/no-namespace": "off",
"@typescript-eslint/no-explicit-any": "warn",
},
},
];
For ESLint v8, use the legacy JSON-based configuration:
// .eslintrc.js
// (C) 2020 GoodData Corporation
module.exports = {
extends: ["@gooddata/eslint-config/react"],
overrides: [
{
files: ["**/*.ts", "**/*.tsx", "**/*.mts", "**/*.cts"],
rules: {
// Custom TypeScript rule overrides
"@typescript-eslint/no-namespace": "off",
},
},
],
};
For non-TypeScript projects using ESLint v8, simply extend the configuration:
module.exports = {
extends: ["@gooddata/eslint-config/react"],
};
Important Notes:
Peer Dependencies: Only packages from the common configuration are listed in peerDependencies. Variant-specific packages (e.g., eslint-plugin-react for the react variant) are not included as peer dependencies since they're not required by all consumers.
Verify Dependencies: After adopting a configuration, run npm run lint (or your lint command) to ensure all necessary dependencies are present in your project. If you get plugin errors, install the missing packages.
src/configurations/ (e.g., my-plugin.ts):// (C) 2025 GoodData Corporation
import type { IConfiguration } from "../types.js";
const configuration: IConfiguration<"my-plugin"> = {
packages: [
{
name: "eslint-plugin-my-plugin",
version: "1.0.0",
},
],
plugin: "my-plugin",
extends: ["plugin:my-plugin/recommended"],
rules: {
"my-plugin/some-rule": "error",
},
};
export default configuration;
src/configurations/index.ts:export { default as myPlugin } from "./my-plugin.js";
common or a variant in src/index.ts:export const common = [
// ... existing configs
myPlugin,
];
Run npm run update-package to sync dependencies to package.json
Run npm run build to generate updated JSON configs
src/index.ts:export const variants = {
// ... existing variants
"my-variant": [browserEnv, myPlugin],
};
Run npm run update-package to update package.json exports
Run npm run build to generate the new variant JSON file
src/configurations/typescript.ts):const configuration: IConfiguration = {
packages: [
{
name: "@typescript-eslint/parser",
version: "8.50.0", // � Update here
},
],
// ...
};
Run npm run update-package to sync to package.json
Run npm run build to regenerate configs
src/configurations/rules: {
"my-plugin/some-rule": "off", // Disable
"my-plugin/another-rule": ["error", { option: true }], // Configure
}
npm run build to regenerate JSON configsnpm run build - Generates JSON configuration files in dist/
npm run update-package - Syncs dependencies and exports
devDependencies and peerDependencies in package.jsonexports field based on available variantsPACKAGES_V8.md and PACKAGES_V9.md documentation filesnpm run validate - Type-checks TypeScript files
npm run lint - Lints the configuration source code
Each configuration module follows this structure:
interface IConfiguration<RulePrefix extends string = ""> {
// Packages required for this configuration
packages?: Array<{
name: string;
version: string;
}>;
// Parser to use (e.g., "@typescript-eslint/parser")
parser?: string;
// Plugin to register (e.g., "react")
plugin?: string;
// Shareable configs to extend
extends?: string[];
// Parser options
parserOptions?: Record<string, number | string>;
// ESLint rules
rules?: Rules<RulePrefix>;
override?: {
files: string[];
parser?: string;
plugin?: string;
extends?: string[];
parserOptions?: Record<string, number | string>;
rules?: Rules<RulePrefix>;
settings?: Record<string, object>;
env?: Record<string, boolean>;
ignorePatterns?: string[];
};
// Plugin settings
settings?: Record<string, object>;
// Environment settings
env?: Record<string, boolean>;
// Ignore patterns (e.g., "**/dist/**/*.*")
ignorePatterns?: string[];
}
Notes:
**/dist/**/*.* and **/esm/**/*.* files.esm configuration sets parserOptions.sourceType: "module" to tell the parser to treat files as ES modules. The importEsm configuration adds the eslint-plugin-import-esm plugin which enforces ESM-specific import rules (e.g., requiring .js extensions in imports). Most ESM projects need both.This package is decoupled from formatters. The formatter configuration (included in all variants by default) disables ESLint rules that conflict with code formatters, allowing you to use any formatter of your choice (Prettier, oxfmt, Biome, etc.) as a separate tool.
How it works:
prettier --write or oxfmt)Recommended setup:
prettier or oxfmt).prettierrc or oxfmt.json)This approach provides:
FAQs
Unified, modular ESLint configuration for the GoodData.UI monorepo.
The npm package @gooddata/eslint-config receives a total of 518 weekly downloads. As such, @gooddata/eslint-config popularity was classified as not popular.
We found that @gooddata/eslint-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 73 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.