max-dependencies

💼 This rule is enabled in the following configs: recommended, typescript.

Rule DetailsCopy Anchor Link

A module that depends on too many external packages is doing too much. The rule counts the distinct external packages a file loads or re-exports (import, side-effect import, export … from, export * from, require(), import() and TypeScript's import x = require()) and reports the file when the count exceeds max (default 10). Packages are counted by name: lodash and lodash/get are one package, as are @scope/pkg and @scope/pkg/x.

Not counted: relative and absolute paths, # subpath imports (the package's own files), Node.js builtins in any spelling (Node's own list, subpaths included, or the node: scheme), specifiers listed in ignoreImports (exact match), and - with ignoreTypeImports (default true) - import type / export type. Files matching an ignoreFiles pattern (a substring, or * wildcards) are skipped.

❌ IncorrectCopy Anchor Link

// { max: 2 }
import a from 'pkg-a';
import b from 'pkg-b';
export * from 'pkg-c';

✅ CorrectCopy Anchor Link

// { max: 2 }
import a from 'pkg-a';
import get from 'pkg-a/get';
import b from 'pkg-b';
import fs from 'node:fs';
import helper from './helper';

OptionsCopy Anchor Link

[
  {
    "type": "object",
    "properties": {
      "max": {
        "type": "number",
        "minimum": 1,
        "default": 10,
        "description": "Maximum number of dependencies allowed."
      },
      "ignoreTypeImports": {
        "type": "boolean",
        "default": true,
        "description": "Ignore type-only imports."
      },
      "ignoreImports": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Import sources to ignore."
      },
      "ignoreFiles": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "File patterns to ignore."
      }
    },
    "additionalProperties": false
  }
]

ImplementationCopy Anchor Link

• Source Code
• Test Cases

OWASP FoundationCopy Anchor Link

• Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next

{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/max-dependencies": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/max-dependencies': 'error',    },  },});