max-parameters
Report functions that take more parameters than a caller can pass correctly.
Report a function that takes more than max parameters. A long positional parameter list is easy to call with arguments in the wrong order.
This rule is part of eslint-plugin-maintainability.
Quick Summary
| Aspect | Details |
|---|---|
| Severity | Error (code quality) |
| Auto-Fix | ❌ No |
| Category | Quality |
| Suggestions | 💡 Use an object parameter, extract a class, split |
Rule Details
The rule counts the parameters a caller passes and reports a function with more
than max (default 4). Every function form is checked: a declaration, a
function expression, an arrow, a class method, a constructor, and an
arrow-function class property.
- A rest parameter (
...rest) is one parameter. - A destructured parameter (
{ a, b }) is one parameter. - TypeScript's
thisparameter is not counted: it is erased before emit and no caller passes it (as in@typescript-eslint/max-params). - A file whose leading comment declares it generated (
@generated) is skipped: a generated signature's arity is the generator's decision.
Configuration
| Option | Type | Default | Description |
|---|---|---|---|
max | number | 4 | Most parameters a function may take |
ignoreConstructors | boolean | false | Skip class constructors (their arity often comes from dependency injection) |
ignoreOverriddenMethods | boolean | false | Skip methods and arrow properties marked override (the base class decides the signature) |
With ignoreConstructors, a function declaration whose name starts with an
uppercase letter (an ES5 constructor function) is skipped as well.
Examples
❌ Incorrect
function createUser(name: string, email: string, age: number, role: Role, team: Team) {}
class Cart {
total = (a: number, b: number, c: number, d: number, e: number) => a + b + c + d + e;
}✅ Correct
function createUser({ name, email, age, role, team }: NewUser) {}
// `this` is not a parameter a caller passes
function onClick(this: HTMLElement, a: number, b: number, c: number, d: number) {}
// With { ignoreOverriddenMethods: true }
class Admin extends User {
override update(a: string, b: string, c: string, d: string, e: string) {}
}Configuration Examples
// eslint.config.mjs
export default [
{
rules: {
'maintainability/max-parameters': ['error', { max: 5, ignoreConstructors: true }],
},
},
];Related Rules
cognitive-complexity- Function complexity limits
Further Reading
- SonarQube RSPEC-107 - Functions should not have too many parameters
- Introduce Parameter Object - The refactoring this rule suggests
Known False Negatives
Overload and declaration signatures
Why: the rule checks function implementations. A declare function
signature, an overload signature or a function type has no body to refactor.
// ❌ NOT DETECTED
declare function legacy(a: number, b: number, c: number, d: number, e: number): void;Use this rule
npm install -D oxlint-plugin-maintainability{ "jsPlugins": ["oxlint-plugin-maintainability"], "rules": { "maintainability/max-parameters": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-maintainability'], rules: { 'maintainability/max-parameters': 'error', }, },});oxlint-plugin-maintainability re-exports eslint-plugin-maintainability/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.