eslint-plugin-sonarjs

eslint-plugin-sonarjs is an ESLint plugin maintained by Sonar, designed to help developers write Clean Code. This plugin exposes to ESLint users all original JS/TS rules from SonarJS, an analyzer for JavaScript and TypeScript within the Sonar ecosystem. This plugin offers general-purpose rules for detecting code smells and bugs, as well as rules for other aspects of code quality, including testing, accessibility, and more. Additionally, it enhances code security by providing rules to report potential security vulnerabilities.

This ESLint plugin does not contain all the rules from the SonarQube JS/TS analyzer. Aside of the rules available here, SonarQube uses rules from other ESLint plugins (some used as they are, some others have been modified). We recommend installing those ESLint plugins and enabling those rules if you are looking for similar results to SonarQube using ESLint.

If you are a SonarQube Server or a SonarQube Cloud user, to lint your code locally, we suggest using the SonarQube for IDE extension (available for VSCode, JetBrains IDEs and Eclipse). You can connect SonarQube for IDE to your Server or Cloud project to synchronize rules configuration, issue statuses, etc.

Table of Contents

• Prerequisites
• Installation
• Usage
• SonarQube for IDE
• Feedback
• Rules
• ESLint rules
• Improved ESLint rules

Changelog

Prerequisites

The prerequisites for using this plugin depend on the ESLint version you are using:

• For ESLint 8, you need Node.js version >= 18.
• For ESLint 9, you need Node.js version that complies with (^18.18.0 || ^20.9.0 || >=21).

Installation

First, ensure that your project is configured with ESLint. If it is not, please follow the ESLint instructions to set it up.

To install eslint-plugin-sonarjs, use the following npm command (or yarn equivalent):

npm install eslint-plugin-sonarjs --save-dev # locally
npm install eslint-plugin-sonarjs -g         # globally

Usage

The usage of eslint-plugin-sonarjs depends on the ESLint version used by your project.

For ESLint 9

This plugin provides a single configuration named recommended. This configuration enables most of the rules except for a few exceptions, and the rules are enabled with the error severity. You can enable the recommended configuration in your eslint.config.js file:

import sonarjs from 'eslint-plugin-sonarjs';

export default [sonarjs.configs.recommended];

If you don't use the recommended configuration, you need to declare the plugin manually in the plugins field. Enable or disable rules using the rules field:

import sonarjs from 'eslint-plugin-sonarjs';
export default [
  {
    plugins: { sonarjs },
    rules: {
      'sonarjs/no-implicit-dependencies': 'error',
    },
  },
];

For ESLint 8

We include a recommended-legacy configuration to be backward compatible with ESLint v8, equivalent to the recommended configuration for ESLint 9.

Add sonarjs to your .eslintrc file:

{
  "plugins": ["sonarjs"],
  "extends": ["plugin:sonarjs/recommended-legacy"]
}

You can enable some rules manually:

{
  "rules": {
    "sonarjs/cognitive-complexity": "error",
    "sonarjs/no-identical-expressions": "error"
  }
}

TypeScript ESLint parser

Several rules are designed for linting both JavaScript and TypeScript code, and some even rely on type checking through TypeScript. Therefore, you will need to install the @typescript-eslint/parser dependency and instruct ESLint to use this parser through the parserOptions property.

SonarQube for IDE

As an alternative to using this ESLint plugin, you can use SonarQube for IDE. SonarQube for IDE is an IDE extension that helps you detect and fix quality issues as you write code. It provides a broader set of rules compared to the ESLint plugin, improved versions of ESLint rules, and additional features that enhance your linting experience.

Feedback

If you have any questions, encounter any bugs, or have feature requests, please reach out to us through the Sonar Community Forum. Your messages will reach the maintainers of this GitHub repository.

Rules

💼 Configurations enabled in.
✅ Set in the recommended configuration.
🔧 Automatically fixable by the --fix CLI option.
💡 Manually fixable by editor suggestions.
💭 Requires type information.
❌ Deprecated.