Registry / testing / eslint-plugin-sonarjs

eslint-plugin-sonarjs

JSON →
library4.0.3jsnpmunverified

ESLint plugin maintained by Sonar that provides original JS/TS rules from the SonarJS analyzer, including code smell, bug detection, testing, accessibility, and security rules. Version 4.0.3 supports ESLint 8/9/10 and ships TypeScript types. Release cadence is frequent with regular bug fixes and rule additions. Key differentiator: direct integration of SonarQube/SonarCloud rules into ESLint, offering a single recommended config for ESLint 9 and a legacy config for ESLint 8.

testingdevops
github ↗package ↗homepage ↗
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
node 18–226 runs
build_error
glibc
node 18–226 runs
build_error
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

Default import for ESLint 9 flat config. For ESLint 8 use require or the legacy config.

import sonarjs from 'eslint-plugin-sonarjs'

Recommended config for ESLint 9 flat config. For ESLint 8 use recommended-legacy.

export default [sonarjs.configs.recommended]

Rules are prefixed with sonarjs/. Use string severity values like 'error' or 'warn'.

rules: { 'sonarjs/no-implicit-dependencies': 'error' }

Shows usage with ESLint 9 flat config, importing plugin and enabling recommended config plus custom rules.

import sonarjs from 'eslint-plugin-sonarjs'; export default [ sonarjs.configs.recommended, { rules: { 'sonarjs/cognitive-complexity': 'warn', 'sonarjs/no-identical-functions': 'error', }, }, ];
Debug
Known footguns
breakingESLint 8 users must use the recommended-legacy config, not the flat config recommended.
gotchaThe plugin only includes original SonarJS rules, not all rules from SonarQube JS/TS analyzer. Some popular rules (e.g., S3776 cognitive complexity) may have different behavior.
deprecatedThe legacy ESLint 8 config (recommended-legacy) may be removed in a future major version.
gotchaNode.js version requirements differ per ESLint version: ESLint 8 needs Node >=16, ESLint 9 needs Node ^18.18.0 || ^20.9.0 || >=21.
gotchaRules enabled in recommended config have error severity by default, which may fail CI pipelines if not expected.
Upgrade
Version history

Breaking-change detection hasn't run for this library yet.

Audit
Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity
39 hits · last 30 days
chatgpt-user
10
gptbot
4
ahrefsbot
4
amazonbot
4
script
1
bingbot
1
Resources
githubhttps://github.com/SonarSource/SonarJS ↗
packagehttps://www.npmjs.com/package/eslint-plugin-sonarjs ↗
homepagehttps://sonarsource.com ↗