no-legacy-imports
Detect imports from deprecated internal paths and suggest alternatives
💼 This rule is enabled in the following configs: recommended, typescript.
🔧 This rule is automatically fixable by the --fix CLI option.
Rule Details
The user maps deprecated import paths to their replacements; an import of a deprecated path is reported, with a fix that writes the replacement. Every way a module is loaded or re-exported is checked: import, side-effect import, export … from, export * from, require(), import() and TypeScript's import x = require(). Type-only imports count: the deprecated path is going away, and its types with it.
Each mappings entry has deprecated - a regular expression tested against the specifier (anchor it with ^ / $ to match a whole path) - and replacement, plus optional reason, since and deadline, which appear in the message. With no mappings nothing is reported. severity is informational: the ESLint severity in your config decides warn vs error.
❌ Incorrect
// { mappings: [{ deprecated: '^@old/lib', replacement: '@new/lib' }] }
import { format } from '@old/lib';
export * from '@old/lib/x';✅ Correct
import { format } from '@new/lib';
import vendored from './vendor/@old/lib';Options
[
{
"type": "object",
"properties": {
"mappings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"deprecated": {
"type": "string"
},
"replacement": {
"type": "string"
},
"reason": {
"type": "string"
},
"since": {
"type": "string"
},
"deadline": {
"type": "string"
}
},
"required": [
"deprecated",
"replacement"
]
}
},
"severity": {
"type": "string",
"enum": [
"warn",
"error"
],
"default": "warn"
}
},
"required": [
"mappings"
],
"additionalProperties": false
}
]Implementation
OWASP Foundation
- Category: A00:2021 - General Security
Use this rule
npm install -D oxlint-plugin-import-next{ "jsPlugins": ["oxlint-plugin-import-next"], "rules": { "import-next/no-legacy-imports": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-import-next'], rules: { 'import-next/no-legacy-imports': 'error', }, },});oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.