no-barrel-import
Disallow imports from barrel files to improve build performance and tree-shaking
💼 This rule is enabled in the following configs: recommended, typescript.
Rule Details
Importing a barrel file loads every module it re-exports. This rule reports
a runtime load of a module you declare as a barrel in knownBarrels
(regular expressions over the specifier), by any spelling: import,
side-effect imports, export { a } from, export * from, require(),
import() and TS import x = require().
Not reported:
- type-only imports and re-exports (
import type, an import whose every specifier is an inlinetype,export type ... from): erased at compile time, they load nothing; - a package matched by
ignoredPackages(regular expressions); - with
ignoreNodeModules: true(the default), a package specifier thatknownBarrelsdoes not name.
A specifier spelled with /index (./components/index) is also reported,
whatever that file contains.
// { knownBarrels: ['components$'] }
// ❌ Incorrect
import { Button } from './components';
export * from './components';
// ✅ Correct
import { Button } from './components/Button';
import type { ButtonProps } from './components';Options
[
{
"type": "object",
"properties": {
"knownBarrels": {
"type": "array",
"items": {
"type": "string"
},
"default": [],
"description": "Regex patterns for paths known to be barrels"
},
"ignoreNodeModules": {
"type": "boolean",
"default": true,
"description": "Ignore imports from node_modules"
},
"ignoredPackages": {
"type": "array",
"items": {
"type": "string"
},
"default": [],
"description": "Packages to ignore (good tree-shaking support)"
}
},
"additionalProperties": false
}
]Implementation
OWASP Foundation
- Category: A00:2021 - General Security
Use this rule
npm install -D oxlint-plugin-import-next{ "jsPlugins": ["oxlint-plugin-import-next"], "rules": { "import-next/no-barrel-import": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-import-next'], rules: { 'import-next/no-barrel-import': 'error', }, },});oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.