prefer-tree-shakeable-imports
Prefer import patterns that enable effective tree-shaking
💼 This rule is enabled in the following configs: recommended, typescript.
Rule Details
Prefers import forms a bundler can tree-shake. For each package in targetPackages, the rule reports a namespace import of the package or one of its subpaths, and a default import of the package itself. With blockAllNamespaceImports every namespace import is reported. subpathPattern and preferNamed only shape the message. When targetPackages is not set, a built-in list is used (lodash, @mui/material, @mui/icons-material, date-fns, rxjs, ramda, antd and others).
Not reported: named imports, a default import of a subpath (import debounce from 'lodash/debounce'), side-effect imports, and type-only imports (import type X from 'pkg', import type * as X from 'pkg'): they are erased and bundle nothing.
❌ Incorrect
import * as _ from 'lodash';
import dateFns from 'date-fns';✅ Correct
import { debounce } from 'lodash';
import format from 'date-fns/format';
import type * as Fns from 'date-fns';Options
[
{
"type": "object",
"properties": {
"targetPackages": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"subpathPattern": {
"type": "string"
},
"preferNamed": {
"type": "boolean"
}
},
"required": [
"name"
]
},
"default": [],
"description": "Packages to enforce tree-shakeable imports"
},
"blockAllNamespaceImports": {
"type": "boolean",
"default": false,
"description": "Block all namespace imports"
}
},
"additionalProperties": false
}
]Implementation
OWASP Foundation
- Category: A00:2021 - General Security
Use this rule
npm install -D oxlint-plugin-import-next{ "jsPlugins": ["oxlint-plugin-import-next"], "rules": { "import-next/prefer-tree-shakeable-imports": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-import-next'], rules: { 'import-next/prefer-tree-shakeable-imports': 'error', }, },});oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.