
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@vercel/style-guide
Advanced tools
This repository is the home of Vercel's style guide, which includes configs for popular linting and styling tools.
The following configs are available, and are designed to be used together.
Please read our contributing guide before creating a pull request.
All of our configs are contained in one package, @vercel/style-guide
. To install:
# If you use npm
npm i --save-dev @vercel/style-guide
# If you use pnpm
pnpm i --save-dev @vercel/style-guide
# If you use Yarn
yarn add --dev @vercel/style-guide
Some of our ESLint configs require peer dependencies. We'll note those alongside the available configs in the ESLint section.
Note: Prettier is a peer-dependency of this package, and should be installed at the root of your project.
To use the shared Prettier config, set the following in package.json
.
{
"prettier": "@vercel/style-guide/prettier"
}
Note: ESLint is a peer-dependency of this package, and should be installed at the root of your project.
See: https://eslint.org/docs/user-guide/getting-started#installation-and-usage
This ESLint config is designed to be composable.
The following base configs are available. You can use one or both of these
configs, but they should always be first in extends
:
@vercel/style-guide/eslint/browser
@vercel/style-guide/eslint/node
Note that you can scope configs, so that configs only target specific files.
For more information, see: Scoped configuration with overrides
.
The following additional configs are available:
@vercel/style-guide/eslint/jest
@vercel/style-guide/eslint/jest-react
(includes rules for @testing-library/react
)@vercel/style-guide/eslint/next
(requires @next/eslint-plugin-next
to be installed at the same version as next
)@vercel/style-guide/eslint/playwright-test
@vercel/style-guide/eslint/react
@vercel/style-guide/eslint/typescript
(requires typescript
to be installed and additional configuration)@vercel/style-guide/eslint/vitest
You'll need to use
require.resolve
to provide ESLint with absolute paths, due to an issue around ESLint config resolution (see eslint/eslint#9188).
For example, use the shared ESLint config(s) in a Next.js project, set the
following in .eslintrc.js
.
module.exports = {
extends: [
require.resolve('@vercel/style-guide/eslint/browser'),
require.resolve('@vercel/style-guide/eslint/react'),
require.resolve('@vercel/style-guide/eslint/next'),
],
};
Some of the rules enabled in the TypeScript config require additional type
information, you'll need to provide the path to your tsconfig.json
.
For more information, see: https://typescript-eslint.io/docs/linting/type-linting
const { resolve } = require('node:path');
const project = resolve(__dirname, 'tsconfig.json');
module.exports = {
root: true,
extends: [
require.resolve('@vercel/style-guide/eslint/node'),
require.resolve('@vercel/style-guide/eslint/typescript'),
],
parserOptions: {
project,
},
settings: {
'import/resolver': {
typescript: {
project,
},
},
},
};
jsx-a11y
It's common practice for React apps to have shared components like Button
,
which wrap native elements. You can pass this information along to jsx-a11y
via the components
setting.
The below list is not exhaustive.
module.exports = {
root: true,
extends: [require.resolve('@vercel/style-guide/eslint/react')],
settings: {
'jsx-a11y': {
components: {
Article: 'article',
Button: 'button',
Image: 'img',
Input: 'input',
Link: 'a',
Video: 'video',
},
},
},
};
overrides
ESLint configs can be scoped to include/exclude specific paths. This ensures that rules don't "leak" into places where those rules don't apply.
In this example, Jest rules are only being applied to files matching Jest's default test match pattern.
module.exports = {
extends: [require.resolve('@vercel/style-guide/eslint/node')],
overrides: [
{
files: ['**/__tests__/**/*.[jt]s?(x)', '**/?(*.)+(spec|test).[jt]s?(x)'],
extends: [require.resolve('@vercel/style-guide/eslint/jest')],
},
],
};
By default, all TypeScript rules are scoped to files ending with .ts
and
.tsx
.
However, when using overrides, file extensions must be included or ESLint will
only include .js
files.
module.exports = {
overrides: [
{ files: [`directory/**/*.[jt]s?(x)`], rules: { 'my-rule': 'off' } },
],
};
This style guide provides multiple TypeScript configs. These configs correlate to the LTS Node.js versions, providing the appropriate lib
, module
, target
, and moduleResolution
settings for each version. The following configs are available:
Node.js Version | TypeScript Config |
---|---|
v16 | @vercel/style-guide/typescript/node16 |
v18 | @vercel/style-guide/typescript/node18 |
v20 | @vercel/style-guide/typescript/node20 |
To use the shared TypeScript config, set the following in tsconfig.json
.
{
"extends": "@vercel/style-guide/typescript/node16"
}
The base TypeScript config is also available as @vercel/style-guide/typescript
which only specifies a set of general rules. You should inherit from this file when setting custom lib
, module
, target
, and moduleResolution
settings.
FAQs
Vercel's engineering style guide
The npm package @vercel/style-guide receives a total of 204,193 weekly downloads. As such, @vercel/style-guide popularity was classified as popular.
We found that @vercel/style-guide demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.