Skip to main content
interlace

oxlint and Vite+

Run every Interlace plugin on oxlint or Vite+ with an oxlint-plugin-* package. Same rules, same rule IDs, no ESLint install.

Why oxlint and Vite+

Vite+ bundles the Vite toolchain into one dependency, and its linter is oxlint. oxlint loads ESLint-style rules through jsPlugins, so a project on Vite+ can run our rules without adding ESLint at all.

We treat oxlint as an automated peer of ESLint: the same rule tests run on both engines, and a rule declares in meta.interop.runtimes which engines it supports. Rules that need TypeScript type information run on ESLint only.

One implementation, the same rule IDs

Every eslint-plugin-<name> has an oxlint-plugin-<name> twin. The twin is one line, module.exports = require('eslint-plugin-<name>/oxlint'), and it is released at the same version. There is no second copy of any rule to drift.

The rule IDs are identical on both engines: <name>/<rule>, for example jwt-security/no-algorithm-none. oxlint takes the prefix from the plugin's own meta.name, which is the same object ESLint loads.

Installing an alias does not install ESLint

eslint is an optional peer of every plugin. Installing oxlint-plugin-<name> pulls in the plugin and its runtime helpers, not ESLint.

Set it up

Every plugin page and every rule page carries the same two tabs: oxlint / Vite+ first, ESLint second. Your choice is remembered across pages. To link someone straight to the ESLint setup, add #engine-eslint to the page URL.

.oxlintrc.json
{
  "jsPlugins": ["oxlint-plugin-jwt-security"],
  "rules": { "jwt-security/no-algorithm-none": "error" }
}
vite.config.ts
import { defineConfig } from 'vite-plus';

export default defineConfig({
  lint: {
    jsPlugins: ['oxlint-plugin-jwt-security'],
    rules: { 'jwt-security/no-algorithm-none': 'error' },
  },
});

Every alias package

oxlint / Vite+ packageRe-exportsCovers
oxlint-plugin-anthropic-securityeslint-plugin-anthropic-securityAnthropic SDK security
oxlint-plugin-browser-securityeslint-plugin-browser-securityXSS, DOM security
oxlint-plugin-cli-floor (not on npm yet)eslint-plugin-cli-floorCLI floor for commander, yargs and burgee
oxlint-plugin-conventionseslint-plugin-conventionsTeam-specific habits and styles
oxlint-plugin-drizzle-securityeslint-plugin-drizzle-securityDrizzle security
oxlint-plugin-express-securityeslint-plugin-express-securityExpress middleware hardening
oxlint-plugin-gemini-securityeslint-plugin-gemini-securityGoogle Gemini SDK security
oxlint-plugin-import-nexteslint-plugin-import-nextFast cycle + import-graph analysis
oxlint-plugin-jwt-securityeslint-plugin-jwt-securityToken security
oxlint-plugin-knex-securityeslint-plugin-knex-securityKnex security
oxlint-plugin-lambda-securityeslint-plugin-lambda-securityAWS Lambda hardening
oxlint-plugin-maintainabilityeslint-plugin-maintainabilityCognitive load and clean-code patterns
oxlint-plugin-mcp-sdk-securityeslint-plugin-mcp-sdk-securityMCP SDK security
oxlint-plugin-modernizationeslint-plugin-modernizationESNext migration + syntax evolution
oxlint-plugin-modularityeslint-plugin-modularityStructural integrity and DDD patterns
oxlint-plugin-mongodb-securityeslint-plugin-mongodb-securityMongoDB injection
oxlint-plugin-mysql-securityeslint-plugin-mysql-securityMySQL security
oxlint-plugin-nestjs-securityeslint-plugin-nestjs-securityNestJS framework hardening
oxlint-plugin-node-securityeslint-plugin-node-securityServer-side patterns
oxlint-plugin-openai-securityeslint-plugin-openai-securityOpenAI SDK security
oxlint-plugin-operabilityeslint-plugin-operabilityProduction readiness and resource health
oxlint-plugin-postgresql-securityeslint-plugin-postgresql-securityPostgreSQL security
oxlint-plugin-prisma-securityeslint-plugin-prisma-securityPrisma security
oxlint-plugin-react-a11yeslint-plugin-react-a11yReact accessibility / WCAG
oxlint-plugin-react-featureseslint-plugin-react-featuresReact best practices and optimization
oxlint-plugin-reliabilityeslint-plugin-reliabilityRuntime stability and error safety
oxlint-plugin-secure-codingeslint-plugin-secure-codingInjection prevention
oxlint-plugin-sequelize-securityeslint-plugin-sequelize-securitySequelize ORM security
oxlint-plugin-sqlite-securityeslint-plugin-sqlite-securitySQLite security
oxlint-plugin-supabase-securityeslint-plugin-supabase-securitySupabase security
oxlint-plugin-typeorm-securityeslint-plugin-typeorm-securityTypeORM security
oxlint-plugin-vercel-ai-securityeslint-plugin-vercel-ai-securityAI SDK security

import-next fills the gaps in oxlint's import plugin

oxlint ships a native import plugin. oxlint-plugin-import-next adds the rules it does not have yet: resolution (no-unresolved), ordering (order), dependency hygiene (no-extraneous-dependencies, no-unused-modules), and architecture boundaries (no-restricted-paths, no-internal-modules), and path cleanup (no-useless-path-segments). The rules for which oxlint ships a native rule of the same name are listed in the next section.

The 22 rules oxlint does not ship natively, all available as import-next/<rule> through oxlint-plugin-import-next:

Covered natively by oxlint

For some of our rules, oxlint ships a native rule of the same name, mostly in import-next (oxlint's import), react-a11y (jsx_a11y) and react-features (react). Each name match was triaged; matches between unrelated rules are left out.

For 120 of our rules, oxlint 1.88.0 ships a native rule of the same name (it has 871 built-in rules in all). The behaviour has not been compared rule by rule: read both rule docs before you swap one for the other.

conventions: 6 rules
import-next: 34 rules
maintainability: 5 rules
modernization: 3 rules
modularity: 1 rules
operability: 1 rules
react-a11y: 35 rules
react-features: 33 rules
reliability: 2 rules

Similar native rule, different behaviour:

  • browser-security/no-eval · native: eslint/no-eval. ours adds CWE-95 context and browser sinks; keep for the security mapping
  • import-next/no-deprecated · native: typescript/no-deprecated. native rule is type-aware and flags any deprecated API use; ours flags imports of deprecated modules/exports
  • node-security/no-dynamic-require · native: import/no-dynamic-require. ours is a security rule (CWE-706 / code loading from input); native is a module-hygiene rule
  • react-features/no-deprecated · native: typescript/no-deprecated. ours targets deprecated React APIs; native is type-aware over any @deprecated symbol

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.