
Security News
pnpm 10.16 Adds New Setting for Delayed Dependency Updates
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
@morgan-stanley/eslint-plugin-externalincludes
Advanced tools
Suite of @html-eslint ESLint rules for working with external references such as script src and link hrefs
Suite of @html-eslint ESLint rules for working with external references such as script src and link hrefs.
You'll first need to install ESLint:
npm i eslint --save-dev
Next, install @morgan-stanley/eslint-plugin-externalincludes
:
npm install @morgan-stanley/eslint-plugin-externalincludes --save-dev
While @morgan-stanley/eslint-plugin-externalincludes
installs @html-eslint/eslint-plugin and @html-eslint/parser as peerDependencies you can optionally install directly.
Update your .eslintrc
configuration file to add ESLint override for html files to specify the @html-eslint/parser and extend recommended rules if desired.
Add @html-eslint
and externalincludes
to the plugins section.
You can omit the eslint-plugin-
prefix:
overrides: [
{
files: ["*.html"],
parser: "@html-eslint/parser",
extends: ["plugin:@html-eslint/recommended"],
},
],
plugins: [
"@html-eslint",
"@morgan-stanley/externalincludes"
],
Then configure the rules you want to use under the rules section:
{
"rules": {
"@morgan-stanley/externalincludes/enforce-no-external-url": "error",
"@morgan-stanley/externalincludes/require-script-integrity": "error",
}
}
If you are using the VS Code ESLint extension, update settings.json to include validation of html:
{
"eslint.enable": true,
"eslint.validate": ["javascript", "html"]
}
Name | Description |
---|---|
enforce-no-external-url | Disallow external includes. |
require-script-integrity | Require integrity attribute at <script> tag. |
FAQs
Suite of @html-eslint ESLint rules for working with external references such as script src and link hrefs
We found that @morgan-stanley/eslint-plugin-externalincludes demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.
Product
Socket now lets you customize pull request alert headers, helping security teams share clear guidance right in PRs to speed reviews and reduce back-and-forth.