
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
eslint-plugin-react-refresh
Advanced tools
Validate that your components can safely be updated with Fast Refresh
Validate that your components can safely be updated with Fast Refresh.
"Fast Refresh", also known as "hot reloading", is a feature in many modern bundlers. If you update some React component(s) on disk, then the bundler will know to update only the impacted parts of your page -- without a full page reload.
eslint-plugin-react-refresh
enforces that your components are structured in a way that integrations such as react-refresh expect.
⚠️ To avoid false positives, by default this plugin is only applied on tsx
& jsx
files. See Options to run on JS files. ⚠️
The plugin relies on naming conventions (i.e. use PascalCase for components, camelCase for util functions). This is why there are some limitations:
export *
are not supported and will be reported as an errorexport default function() {}
)const CMS = () => <></>; export { CMS }
)npm i -D eslint-plugin-react-refresh
This plugin provides a single rule, react-refresh/only-export-components
. There are multiple ways to enable it.
import reactRefresh from "eslint-plugin-react-refresh";
export default [
/* Main config */
reactRefresh.configs.recommended,
];
This enables the allowConstantExport
option which is supported by Vite React plugins.
import reactRefresh from "eslint-plugin-react-refresh";
export default [
/* Main config */
reactRefresh.configs.vite,
];
import reactRefresh from "eslint-plugin-react-refresh";
export default [
{
// in main config for TSX/JSX source files
plugins: {
"react-refresh": reactRefresh,
},
rules: {
"react-refresh/only-export-components": "error",
},
},
];
{
"plugins": ["react-refresh"],
"rules": {
"react-refresh/only-export-components": "error"
}
}
These examples are from enabling react-refresh/only-exports-components
.
export const foo = () => {};
export const Bar = () => <></>;
export default function () {}
export default compose()(MainComponent)
export * from "./foo";
const Tab = () => {};
export const tabs = [<Tab />, <Tab />];
const App = () => {};
createRoot(document.getElementById("root")).render(<App />);
export default function Foo() {
return <></>;
}
const foo = () => {};
export const Bar = () => <></>;
import { App } from "./App";
createRoot(document.getElementById("root")).render(<App />);
These options are all present on react-refresh/only-exports-components
.
interface Options {
allowExportNames?: string[];
allowConstantExport?: boolean;
customHOCs?: string[];
checkJS?: boolean;
}
const defaultOptions: Options = {
allowExportNames: [],
allowConstantExport: false,
customHOCs: [],
checkJS: false,
};
Default:
[]
If you use a framework that handles HMR of some specific exports, you can use this option to avoid warning for them.
Example for Remix:
{
"react-refresh/only-export-components": [
"error",
{ "allowExportNames": ["meta", "links", "headers", "loader", "action"] }
]
}
Default:
false
(true
invite
config)
Don't warn when a constant (string, number, boolean, templateLiteral) is exported aside one or more components.
This should be enabled if the fast refresh implementation correctly handles this case (HMR when the constant doesn't change, propagate update to importers when the constant changes.). Vite supports it, PR welcome if you notice other integrations works well.
{
"react-refresh/only-export-components": [
"error",
{ "allowConstantExport": true }
]
}
Enabling this option allows code such as the following:
export const CONSTANT = 3;
export const Foo = () => <></>;
Default:
false
If you're using JSX inside .js
files (which I don't recommend because it forces you to configure every tool you use to switch the parser), you can still use the plugin by enabling this option. To reduce the number of false positive, only files importing react
are checked.
{
"react-refresh/only-export-components": ["error", { "checkJS": true }]
}
If you're exporting a component wrapped in a custom HOC, you can use this option to avoid false positives.
{
"react-refresh/only-export-components": [
"error",
{ "customHOCs": ["observer", "withAuth"] }
]
}
FAQs
Validate that your components can safely be updated with Fast Refresh
The npm package eslint-plugin-react-refresh receives a total of 3,806,377 weekly downloads. As such, eslint-plugin-react-refresh popularity was classified as popular.
We found that eslint-plugin-react-refresh demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.