
Security News
Critical Security Vulnerability in React Server Components
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.
@kitschpatrol/shared-config
Advanced tools
A collection of shared configurations, linters, and formatting tools for TypeScript projects. All managed as a single dependency, and invoked via a single CLI command.
A collection of shared configurations, linters, and formatting tools for TypeScript projects. All managed as a single dependency, and invoked via a single CLI command.
This project consolidates most of the configuration and tooling shared by my open-source and internal TypeScript-based projects into a single dependency with a single CLI meta-command to lint and fix issues.
By installing @kitschpatrol/shared-config and then running ksc, you can run a half-dozen pre-configured code quality and linting tools in one shot. This spares you from cluttering your project's devDependencies with packages tangential to the task at hand.
If you don't plan to customize tool configurations, ksc init exposes an option to store references to each tool's shared configuration in your package.json instead of in files in your project root (at least where permitted by the tool). This can save a bit of file clutter in your project's root directory, at the expense of the immediate discoverability of the tools.
In addition, each tool exports a typed configuration factory function to simplify specifying and extending the default configuration.
The command name ksc is just an initialism for "Kitschpatrol Shared Configuration".
It takes care of dependencies, configuration, invocation, and reporting for the following tools:
.npmrc, .gitignore, etc.)This particular readme is for the @kitschpatrol/shared-config package, which depends on a number of tool-specific packages included in the kitschpatrol/shared-config monorepo on GitHub, each of which is documented in additional detail in its respective readme.
@kitschpatrol/shared-config (ksc command)@kitschpatrol/cspell-config (ksc-cspell command)@kitschpatrol/eslint-config (ksc-eslint command)@kitschpatrol/knip-config (ksc-knip command)@kitschpatrol/mdat-config (ksc-mdat command)@kitschpatrol/prettier-config (ksc-prettier command)@kitschpatrol/remark-config (ksc-remark command)@kitschpatrol/repo-config (ksc-repo command)@kitschpatrol/stylelint-config (ksc-stylelint command)@kitschpatrol/typescript-config (ksc-typescript command)[!IMPORTANT]
Any of these packages may be installed and run on their own via CLI if desired. However, in general, the idea is to use
@kitschpatrol/shared-configto easily run them all simultaneously over a repo with a single command with options to either check or (where possible) fix problems, with output aggregated into a single report.
Running ksc <command> calls the same command across the entire collection of sub-packages.
So assuming you've installed @kitschpatrol/shared-config...
Running:
ksc init
Is the same as running:
ksc-repo init
ksc-mdat init
ksc-typescript init
ksc-eslint init
ksc-stylelint init
ksc-cspell init
ksc-knip init
ksc-remark init
ksc-prettier init
(Sub-commands are always executed in the above order.)
The top-level ksc command also takes care of some nuances in terms of which sub-packages implement which commands, and which subcommands take arguments.
Node >=20.19.0 is required, and pnpm >=10 is recommended. NPM and yarn might work as well, but I haven't tested them.
There are a few different ways to integrate @kitschpatrol/shared-config into your project, depending on whether you're starting from scratch or adding it to an existing project.
The easiest way to get started is to create a new project from a starter template:
pnpm create @kitschpatrol/project@latest
See the template repository for more details.
Alternatively, this one-liner will bootstrap a new project and open it in VS Code, but the template approach above is preferred:
git init && pnpm init && pnpm pkg set type="module" && pnpm --package=@kitschpatrol/repo-config dlx ksc-repo init && pnpm add -D @kitschpatrol/shared-config && pnpm ksc init && pnpm i && code .
Note that ksc init takes an optional --location package flag will put as much configuration in your package.json as possible instead of creating discrete config files in your project root for each tool. Putting config in package.json can save some clutter, but it makes configs less discoverable and can make it clunkier to extend or customize configurations since you don't have the benefit of type safety and autocomplete.
At any point, you can call ksc init again with the --location package or --location file flag to reinitialize your configuration files in one place or the other and restore the default configurations.
This might overwrite certain config files, so commit first:
pnpm --package=@kitschpatrol/repo-config dlx ksc-repo init && pnpm i && pnpm add -D @kitschpatrol/shared-config && pnpm ksc init
Install the requisite .npmrc:
pnpm --package=@kitschpatrol/repo-config dlx ksc-repo init
Install the package:
pnpm add -D @kitschpatrol/shared-config
Add default config files for all the tools to your project root:
pnpm ksc init
Or, if you don't plan to customize tool configurations, you might want to put as much config as possible under tool-specific keys in 'package.json':
pnpm ksc init --location package
Add helper scripts to your package.json:
These work a bit like npm-run-all to invoke all of the bundled tools.
{
"scripts": {
"fix": "ksc fix",
"lint": "ksc lint"
}
}
Set up GitHub action credentials (if desired)
The GitHub actions included in @kitschpatrol/repo-config require permissions to create releases and update your repository metadata. You can add these through the GitHub website under the Settings → Secrets and variables → Actions page under the key PERSONAL_ACCESS_TOKEN, or with the GitHub CLI and a credential manager like 1Password CLI:
gh secret set PERSONAL_ACCESS_TOKEN --app actions --body $(op read 'op://Personal/GitHub Mika/PERSONAL_ACCESS_TOKEN')
See the @kitschpatrol/repo-config readme for more details.
Various VS Code plugins for the bundled tools should "just work".
To check / lint your entire project, after configuring the package.json as shown above:
pnpm run lint
To run all of the tools in a potentially destructive "fix" capacity:
pnpm run fix
kscRun aggregated @kitschpatrol/shared-config commands.
This section lists top-level commands for ksc.
Usage:
ksc <command>
| Command | Argument | Description |
|---|---|---|
init | Initialize configuration files for the entire suite of @kitschpatrol/shared-config tools. Will use option flags where possible if provided, but some of the invoked tools will ignore them. | |
lint | [files..] | Lint your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope. |
fix | [files..] | Fix your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope. |
print-config | [file] | Print aggregated tool configuration data. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope. |
| Option | Description | Type |
|---|---|---|
--help-h | Show help | boolean |
--version-v | Show version number | boolean |
See the sections below for more information on each subcommand.
ksc initInitialize configuration files for the entire suite of @kitschpatrol/shared-config tools. Will use option flags where possible if provided, but some of the invoked tools will ignore them.
Usage:
ksc init
| Option | Description | Type | Default |
|---|---|---|---|
--location | TK | "file" "package" | "file" |
--help-h | Show help | boolean | |
--version-v | Show version number | boolean |
ksc lintLint your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.
Usage:
ksc lint [files..]
| Positional Argument | Description | Type | Default |
|---|---|---|---|
files | Files or glob pattern to lint. | array | [] |
| Option | Description | Type |
|---|---|---|
--help-h | Show help | boolean |
--version-v | Show version number | boolean |
ksc fixFix your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.
Usage:
ksc fix [files..]
| Positional Argument | Description | Type | Default |
|---|---|---|---|
files | Files or glob pattern to fix. | array | [] |
| Option | Description | Type |
|---|---|---|
--help-h | Show help | boolean |
--version-v | Show version number | boolean |
ksc print-configPrint aggregated tool configuration data. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.
Usage:
ksc print-config [file]
| Positional Argument | Description | Type |
|---|---|---|
file | File or glob pattern to TK. | string |
| Option | Description | Type |
|---|---|---|
--help-h | Show help | boolean |
--version-v | Show version number | boolean |
Recall that the @kitschpatrol/shared-config package aggregates integration and invocation of the other tool-specific packages in this monorepo. Running a cli command on ksc effectively runs the same command against all the tool-specific packages.
check vs lintThis project combines a mix of tools that regard their core task variously as "linting" or "checking" code and prose.
Across all the tools, I've chosen to use the term "lint" instead of "check" to refer to the read-only evaluation process.
Each package has a simple /src/cli.ts file which defines the behavior of its eponymous binary. The build step turns these into node "binary" scripts, providing default implementations where feasible.
The monorepo must be kept intact, as the sub-packages depend on scripts in the parent during build.
The pnpm authors consider module hoisting harmful, and I tend to agree, but certain exceptions are carved out as necessary and accommodated via the .npmrc file included in @kitschpatrol/repo-config:
CSpell, remark, mdat, ESLint, and Prettier all need to be hoisted via public-hoist-pattern to be accessible in pnpm exec scripts and to VS Code plugins.
Even basic file-only packages like repo-config seem to need to be hoisted via for their bin scripts to be accessible via pnpm exec
In earlier version of pnpm, prettier and eslint packages were hoisted by default, but as of pnpm 10 this is no longer the case.
The repo uses placeholders for the bin script for each tool to avoid circular dependency issues during pnpm install.
To tell git to ignore changes to the placeholders, run pnpm run bin-ignore.
For local development via pnpm, use file: dependency protocol instead of link:
Something to investigate: An approach to ignoring style rules in VS Code, and possibly migrate all style handling to ESLint instead of Prettier.
xo is really, really close to what I'm after here, but I wanted a few extra tools and preferred to use "first party" VS Code plugins where possible.
create-typescript-app is also excellent, and probably the best starting point for most people for most new projects. However, it does not take a "single top-level dependency" / "single unified CLI" approach.
antfu/eslint-config and @sxzz/eslint-config inspired the approach to ESLint integration.
@kitschpatrol/shared-config)MIT © Eric Mika
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.

Security News
TypeScript 6.0 will be the last JavaScript-based major release, as the project shifts to the TypeScript 7 native toolchain with major build speedups.