Plugin: import-nextRules
no-extraneous-dependencies
Forbid the use of extraneous packages not listed in package.json
š¼ This rule is enabled in the following configs: recommended, typescript.
š” This rule is manually fixable by editor suggestions.
Rule Details
This rule aims to prevent issues related to extraneous-dependencies.
Options
[
{
"type": "object",
"properties": {
"devDependencies": {
"type": "boolean",
"default": true,
"description": "Allow imports from devDependencies."
},
"optionalDependencies": {
"type": "boolean",
"default": true,
"description": "Allow imports from optionalDependencies."
},
"peerDependencies": {
"type": "boolean",
"default": true,
"description": "Allow imports from peerDependencies."
},
"bundledDependencies": {
"type": "boolean",
"default": true,
"description": "Allow imports from bundledDependencies."
},
"packageJsonPath": {
"type": "string",
"description": "Path to package.json file to use."
},
"packageJson": {
"type": "object",
"description": "Direct package.json content for testing."
},
"resolutionStrategy": {
"type": "string",
"enum": [
"strict",
"workspace",
"monorepo"
],
"default": "strict",
"description": "Dependency resolution strategy. 'strict' allows only packages declared in the nearest package.json. 'workspace' and 'monorepo' are aliases of each other: they additionally allow the literal '@workspace/' and '@company/' scopes, and do NOT read workspace-root or sibling manifests; for real monorepo scopes use allowPatterns."
},
"allowPatterns": {
"type": "array",
"items": {
"type": "string"
},
"description": "Regex patterns for packages to allow even if not in package.json."
},
"ignore": {
"type": "array",
"items": {
"type": "string"
},
"description": "Specific package names to ignore (don't report as missing)."
},
"verbatimModuleSyntax": {
"type": "boolean",
"default": false,
"description": "Check inline-type-only imports (`import { type X } from 'pkg'`) as runtime imports. Enable when the project compiles with TypeScript's `verbatimModuleSyntax`, under which tsc emits `import {} from 'pkg'` for them. Statement-level `import type` is always ignored."
}
},
"additionalProperties": false
}
]Implementation
OWASP Foundation
- Category: A00:2021 - General Security
Use this rule
npm install -D oxlint-plugin-import-next{ "jsPlugins": ["oxlint-plugin-import-next"], "rules": { "import-next/no-extraneous-dependencies": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-import-next'], rules: { 'import-next/no-extraneous-dependencies': 'error', }, },});oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it ā or follow the AI-code-security benchmarks behind these rules.