
Security News
GitHub Actions Supply Chain Attack Puts Thousands of Projects at Risk
A compromised GitHub Action exposed secrets in CI/CD logs, putting thousands of projects at risk and forcing developers to urgently secure their workflows.
@vercel/style-guide
Advanced tools
This repository is the home of Vercel's style guide, which includes configs for popular linting and styling tools.
The following configs are available, and are designed to be used together.
Please read our contributing guide before creating a pull request.
All of our configs are contained in one package, @vercel/style-guide
. To install:
# If you use npm
npm i --save-dev @vercel/style-guide
# If you use pnpm
pnpm i --save-dev @vercel/style-guide
# If you use Yarn
yarn add --dev @vercel/style-guide
Some of our ESLint configs require peer dependencies. We'll note those alongside the available configs in the ESLint section.
Note: Prettier is a peer-dependency of this package, and should be installed at the root of your project.
To use the shared Prettier config, set the following in package.json
.
{
"prettier": "@vercel/style-guide/prettier"
}
Note: ESLint is a peer-dependency of this package, and should be installed at the root of your project.
See: https://eslint.org/docs/user-guide/getting-started#installation-and-usage
This ESLint config is designed to be composable.
The following base configs are available. You can use one or both of these
configs, but they should always be first in extends
:
@vercel/style-guide/eslint/browser
@vercel/style-guide/eslint/node
Note that you can scope configs, so that configs only target specific files.
For more information, see: Scoped configuration with overrides
.
The following additional configs are available:
@vercel/style-guide/eslint/jest
@vercel/style-guide/eslint/jest-react
(includes rules for @testing-library/react
)@vercel/style-guide/eslint/next
(requires @next/eslint-plugin-next
to be installed at the same version as next
)@vercel/style-guide/eslint/playwright-test
@vercel/style-guide/eslint/react
@vercel/style-guide/eslint/typescript
(requires typescript
to be installed and additional configuration)@vercel/style-guide/eslint/vitest
You'll need to use
require.resolve
to provide ESLint with absolute paths, due to an issue around ESLint config resolution (see eslint/eslint#9188).
For example, use the shared ESLint config(s) in a Next.js project, set the
following in .eslintrc.js
.
module.exports = {
extends: [
require.resolve('@vercel/style-guide/eslint/browser'),
require.resolve('@vercel/style-guide/eslint/react'),
require.resolve('@vercel/style-guide/eslint/next'),
],
};
Some of the rules enabled in the TypeScript config require additional type
information, you'll need to provide the path to your tsconfig.json
.
For more information, see: https://typescript-eslint.io/docs/linting/type-linting
const { resolve } = require('node:path');
const project = resolve(__dirname, 'tsconfig.json');
module.exports = {
root: true,
extends: [
require.resolve('@vercel/style-guide/eslint/node'),
require.resolve('@vercel/style-guide/eslint/typescript'),
],
parserOptions: {
project,
},
settings: {
'import/resolver': {
typescript: {
project,
},
},
},
};
jsx-a11y
It's common practice for React apps to have shared components like Button
,
which wrap native elements. You can pass this information along to jsx-a11y
via the components
setting.
The below list is not exhaustive.
module.exports = {
root: true,
extends: [require.resolve('@vercel/style-guide/eslint/react')],
settings: {
'jsx-a11y': {
components: {
Article: 'article',
Button: 'button',
Image: 'img',
Input: 'input',
Link: 'a',
Video: 'video',
},
},
},
};
overrides
ESLint configs can be scoped to include/exclude specific paths. This ensures that rules don't "leak" into places where those rules don't apply.
In this example, Jest rules are only being applied to files matching Jest's default test match pattern.
module.exports = {
extends: [require.resolve('@vercel/style-guide/eslint/node')],
overrides: [
{
files: ['**/__tests__/**/*.[jt]s?(x)', '**/?(*.)+(spec|test).[jt]s?(x)'],
extends: [require.resolve('@vercel/style-guide/eslint/jest')],
},
],
};
By default, all TypeScript rules are scoped to files ending with .ts
and
.tsx
.
However, when using overrides, file extensions must be included or ESLint will
only include .js
files.
module.exports = {
overrides: [
{ files: [`directory/**/*.[jt]s?(x)`], rules: { 'my-rule': 'off' } },
],
};
This style guide provides multiple TypeScript configs. These configs correlate to the LTS Node.js versions, providing the appropriate lib
, module
, target
, and moduleResolution
settings for each version. The following configs are available:
Node.js Version | TypeScript Config |
---|---|
v16 | @vercel/style-guide/typescript/node16 |
v18 | @vercel/style-guide/typescript/node18 |
v20 | @vercel/style-guide/typescript/node20 |
To use the shared TypeScript config, set the following in tsconfig.json
.
{
"extends": "@vercel/style-guide/typescript/node16"
}
The base TypeScript config is also available as @vercel/style-guide/typescript
which only specifies a set of general rules. You should inherit from this file when setting custom lib
, module
, target
, and moduleResolution
settings.
FAQs
Vercel's engineering style guide
The npm package @vercel/style-guide receives a total of 204,193 weekly downloads. As such, @vercel/style-guide popularity was classified as popular.
We found that @vercel/style-guide demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A compromised GitHub Action exposed secrets in CI/CD logs, putting thousands of projects at risk and forcing developers to urgently secure their workflows.
Research
Security News
A malicious Maven package typosquatting a popular library is secretly stealing OAuth credentials on the 15th of each month, putting Java developers at risk.
Security News
Socket and Seal Security collaborate to fix a critical npm overrides bug, resolving a three-year security issue in the JavaScript ecosystem's most popular package manager.