
Product
Reachability for Ruby Now in Beta
Reachability analysis for Ruby is now in beta, helping teams identify which vulnerabilities are truly exploitable in their applications.
eslint-config-wikimedia
Advanced tools
npm install --save-dev eslint-config-wikimedia
Then, configure ESLint with one or more .eslintrc.json files as appropriate.
Below are some potential recommended uses:
This config allows the latest supported ES version code (currently ES2017) and browser native functions. It will complain about ES2018+ code and language features. This target version updates over time.
It also automatically applies the Vue plugin and Vue-specific rules to .vue files.
.eslintrc.json:
{
"extends": "wikimedia/client"
}
If you want to only allow ES6 code and browser native functions, you can use wikimedia/client/es6 instead.
This config adds the jQuery $ global, and additional rules preventing the use of jQuery features which are deprecated, have performance issues, or have simple modern ES alternatives.
.eslintrc.json:
{
"extends": [
"wikimedia/client",
"wikimedia/jquery"
]
}
Code that runs in MediaWiki can use this config. It enforces rules that are specific to the MediaWiki codebase (core and extensions), such as correct documentation of mw.message usage, and prohibiting self-closing tags in Vue templates.
.eslintrc.json:
{
"extends": [
"wikimedia/client",
"wikimedia/mediawiki"
]
}
You can extend the above config by also adding a second .eslintrc.json file in your tests directory:
tests/qunit/.eslintrc.json:
{
"extends": [
"wikimedia/mediawiki/qunit"
]
}
Or for standalone JavaScript libraries and Node.js projects:
tests/.eslintrc.json:
{
"extends": [
"wikimedia/qunit"
]
}
The following config will the Mocha environment and some Mocha related rules:
tests/mocha/.eslintrc.json:
{
"root": true,
"extends": [
"wikimedia/server",
"wikimedia/mocha"
]
}
The following config will enable WDIO globals, as well as the Mocha and server configs:
tests/selenium/.eslintrc.json:
{
"root": true,
"extends": [
"wikimedia/selenium"
]
}
This config allows ES2018 code and Node native functions (i.e., Node 10.x). It will complain about ES2019+ code and language features.
.eslintrc.json:
{
"extends": "wikimedia/server"
}
The wikimedia/server config consists of wikimedia, wikimedia/node and wikimedia/language/es2018. To use later versions of ES, for example ES2019, you can use the following config:
.eslintrc.json:
{
"extends": [
"wikimedia",
"wikimedia/node",
"wikimedia/language/es2019"
]
}
TypeScript cannot be directly handled by the browser (or ResourceLoader), so it will always target either code that runs on the server or tests or code that is compiled to JavaScript first in a non-MediaWiki step. TypeScript files are automatically included, similar to JSON and YAML files.
Please note that the basic project configuration does not specify any language or environmental defaults, and is unlikely to be suitable. However, if you wish to target clients with ES3 language support, or earlier versions of Node, this is a good place from which to start.
.eslintrc.json:
{
"extends": "wikimedia"
}
Major changes should be discussed on mediawiki.org or on the Wikitech mailing list beforehand.
Same approach as in ESLint, see https://github.com/eslint/eslint#user-content-semantic-versioning-policy.
FAQs
ESLint config following Wikimedia code conventions.
We found that eslint-config-wikimedia demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 23 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Reachability analysis for Ruby is now in beta, helping teams identify which vulnerabilities are truly exploitable in their applications.

Research
/Security News
Malicious npm packages use Adspect cloaking and fake CAPTCHAs to fingerprint visitors and redirect victims to crypto-themed scam sites.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.