Skip to main content
interlace
Plugin: react-features

eslint-plugin-react-features

React best practices and feature rules.

React Best Practices

Enforce React best practices and feature patterns for maintainable applications.

Install

npm install -D oxlint-plugin-react-features
.oxlintrc.json
{  "jsPlugins": ["oxlint-plugin-react-features"],  "rules": {    "react-features/hooks-exhaustive-deps": "warn",    "react-features/jsx-key": "error",    "react-features/jsx-no-duplicate-props": "error",    "react-features/jsx-no-script-url": "error",    "react-features/jsx-no-target-blank": "error",    "react-features/no-children-prop": "warn",    "react-features/no-danger": "warn",    "react-features/no-danger-with-children": "error",    "react-features/no-deprecated": "warn",    "react-features/no-string-refs": "error",    "react-features/no-unknown-property": "error"  }}
vite.config.ts
import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-react-features'],    rules: {      'react-features/hooks-exhaustive-deps': 'warn',      'react-features/jsx-key': 'error',      'react-features/jsx-no-duplicate-props': 'error',      'react-features/jsx-no-script-url': 'error',      'react-features/jsx-no-target-blank': 'error',      'react-features/no-children-prop': 'warn',      'react-features/no-danger': 'warn',      'react-features/no-danger-with-children': 'error',      'react-features/no-deprecated': 'warn',      'react-features/no-string-refs': 'error',      'react-features/no-unknown-property': 'error',    },  },});

oxlint-plugin-react-features re-exports eslint-plugin-react-features/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.


Live from GitHub

This content is fetched directly from README.md on GitHub and cached for 1 hour.

Live README from GitHubfrom eslint-plugin-react-features/README.md, cached for 1 hour.Edit on GitHub

⭐ If this plugin caught a real bug for you, star the repo β€” it's the signal that keeps these rules maintained.

Description

This plugin provides Advanced React patterns, hook usage, and best practices enforcement.

  • Why β€” a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
  • How β€” evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
  • What β€” every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology Β· results Β· a false positive is a bug.

Getting Started

oxlint / Vite+ β€” the same rules under the same react-features/<rule> IDs, without ESLint:

npm install oxlint-plugin-react-features --save-dev
// .oxlintrc.json
{ "jsPlugins": ["oxlint-plugin-react-features"] }
// vite.config.ts
import { defineConfig } from 'vite-plus';

export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-react-features'] } });

ESLint:

npm install eslint-plugin-react-features --save-dev

βš™οΈ Configuration Presets

PresetDescription
recommendedRecommended React patterns and performance rules

πŸ“¦ Compatibility

PackageVersion
ESLint^8.40.0 || ^9.0.0 || ^10.0.0
Node.js>=18.0.0

See the ESLint Version Support Policy β€” current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

IconDescription
πŸ’ΌRecommended: Included in the recommended preset.
⚠️Warns: Set to warn in recommended preset.
πŸ”§Auto-fixable: Automatically fixable by the --fix CLI option.
πŸ’‘Suggestions: Providing code suggestions in IDE.
🚫Deprecated: This rule is deprecated.
🟒Type-unaware: AST-only, runs in oxlint JS-plugin tier.
🟑Type-aware (refining): pure-AST primary path; types refine precision.
🟠Type-aware (graceful): requires TS program; silent without it.
RuleCWEOWASPCVSSDescriptionπŸ§ πŸ’Όβš οΈπŸ”§πŸ’‘πŸš«
checked-requires-onchange-or-readonlychecked-requires-onchange-or-readonly ruleπŸŸ’πŸ’‘
default-props-match-prop-typesdefault-props-match-prop-types ruleπŸŸ’πŸ’‘
display-namedisplay-name ruleπŸŸ’πŸ’‘
hooks-exhaustive-depshooks-exhaustive-deps ruleπŸŸ’βš οΈπŸ’‘
jsx-handler-namesjsx-handler-names ruleπŸŸ’πŸ’‘
jsx-keyjsx-key ruleπŸŸ’πŸ’ΌπŸ’‘
jsx-max-depthjsx-max-depth ruleπŸŸ’πŸ’‘
jsx-no-bindjsx-no-bind ruleπŸŸ’πŸ’‘
jsx-no-duplicate-propsPrevent duplicate props in JSX elements. This rule is part of eslint-plugin-react-features and provides LLMβ€¦πŸŸ’πŸ’ΌπŸ’‘
jsx-no-literalsjsx-no-literals ruleπŸŸ’πŸ’‘
jsx-no-script-urlPrevent javascript: URLs in JSX. This rule is part of eslint-plugin-react-features and provides LLM-optimizβ€¦πŸŸ’πŸ’ΌπŸ’‘
jsx-no-target-blankRequire rel='noopener noreferrer' with target='_blank'. This rule is part of eslint-plugin-react-features aβ€¦πŸŸ’πŸ’ΌπŸ’‘
no-access-state-in-setstateno-access-state-in-setstate ruleπŸŸ’πŸ’‘
no-adjacent-inline-elementsno-adjacent-inline-elements ruleπŸŸ’πŸ’‘
no-arbitrary-token-class🟒
no-arrow-function-lifecycleno-arrow-function-lifecycle ruleπŸŸ’πŸ’‘
no-children-propno-children-prop ruleπŸŸ’βš οΈπŸ’‘
no-dangerCWE-79no-danger ruleπŸŸ’βš οΈπŸ’‘
no-danger-with-childrenPrevent using children and dangerouslySetInnerHTML together. This rule is part of eslint-plugin-react-featuβ€¦πŸŸ’πŸ’ΌπŸ’‘
no-default-test-id🟒
no-deprecatedWarn about using deprecated React APIs. This rule is part of eslint-plugin-react-features and provides LLM-β€¦πŸŸ’βš οΈπŸ’‘
no-did-mount-set-stateno-did-mount-set-state ruleπŸŸ’πŸ’‘
no-did-update-set-stateno-did-update-set-state ruleπŸŸ’πŸ’‘
no-direct-mutation-stateno-direct-mutation-state ruleπŸŸ’πŸ’‘
no-find-dom-nodePrevent using findDOMNode. This rule is part of eslint-plugin-react-features and provides LLM-optimized errβ€¦πŸŸ’πŸ’‘
no-inline-style🟒
no-invalid-html-attributeno-invalid-html-attribute ruleπŸŸ’πŸ’‘
no-is-mountedno-is-mounted ruleπŸŸ’πŸ’‘
no-is-prefix-prop🟒
no-kind-prop-discriminator🟒
no-multi-compno-multi-comp ruleπŸŸ’πŸ’‘
no-namespaceno-namespace ruleπŸŸ’πŸ’‘
no-object-type-as-default-propno-object-type-as-default-prop ruleπŸŸ’πŸ’‘
no-raw-color-literal🟒
no-redundant-should-component-updateno-redundant-should-component-update ruleπŸŸ’πŸ’‘
no-render-return-valueno-render-return-value ruleπŸŸ’πŸ’‘
no-set-stateno-set-state ruleπŸŸ’πŸ’‘
no-string-refsno-string-refs ruleπŸŸ’πŸ’ΌπŸ’‘
no-this-in-sfcno-this-in-sfc ruleπŸŸ’πŸ’‘
no-typosno-typos ruleπŸŸ’πŸ’‘
no-unescaped-entitiesno-unescaped-entities ruleπŸŸ’πŸ’‘
no-unknown-propertyno-unknown-property ruleπŸŸ’πŸ’ΌπŸ’‘
no-unnecessary-rerendersno-unnecessary-rerenders ruleπŸŸ’πŸ’‘
no-unsafeWarn about UNSAFE_ lifecycle methods. This rule is part of eslint-plugin-react-features and provides LLM-opβ€¦πŸŸ’πŸ’‘
no-wrapper-sub-component🟒
prefer-es6-classprefer-es6-class ruleπŸŸ’πŸ’‘
prefer-stateless-functionprefer-stateless-function ruleπŸŸ’πŸ’‘
prop-typesprop-types ruleπŸŸ’πŸ’‘
react-class-to-hooksreact-class-to-hooks ruleπŸŸ’πŸ’‘
react-in-jsx-scopereact-in-jsx-scope ruleπŸŸ’πŸ’‘
react-no-inline-functionsreact-no-inline-functions ruleπŸŸ’πŸ’‘
react-render-optimizationreact-render-optimization ruleπŸŸ’πŸ’‘
require-data-slot🟒
require-default-propsrequire-default-props ruleπŸŸ’πŸ’‘
require-optimizationrequire-optimization ruleπŸŸ’πŸ’‘
require-render-returnrequire-render-return ruleπŸŸ’πŸ’‘
required-attributesrequired-attributes ruleπŸŸ’πŸ’‘
sort-compsort-comp ruleπŸŸ’πŸ’‘
state-in-constructorstate-in-constructor ruleπŸŸ’πŸ’‘
static-property-placementstatic-property-placement ruleπŸŸ’πŸ’‘
void-dom-elements-no-childrenPrevent void DOM elements from receiving children. This rule is part of eslint-plugin-react-features and prβ€¦πŸŸ’πŸ’‘

Part of the Interlace ESLint ecosystem β€” AI-native rules with LLM-optimized error messages:

Security

PluginDownloadsDescription
eslint-plugin-anthropic-securitydownloadsAnthropic SDK security.
eslint-plugin-browser-securitydownloadsXSS, DOM security.
eslint-plugin-drizzle-securitydownloadsDrizzle security.
eslint-plugin-express-securitydownloadsExpress middleware hardening.
eslint-plugin-gemini-securitydownloadsGoogle Gemini SDK security.
eslint-plugin-jwt-securitydownloadsToken security.
eslint-plugin-knex-securitydownloadsKnex security.
eslint-plugin-lambda-securitydownloadsAWS Lambda hardening.
eslint-plugin-mcp-sdk-securitydownloadsMCP SDK security.
eslint-plugin-mongodb-securitydownloadsMongoDB injection.
eslint-plugin-mysql-securitydownloadsMySQL security.
eslint-plugin-nestjs-securitydownloadsNestJS framework hardening.
eslint-plugin-node-securitydownloadsServer-side patterns.
eslint-plugin-openai-securitydownloadsOpenAI SDK security.
eslint-plugin-postgresql-securitydownloadsPostgreSQL security.
eslint-plugin-prisma-securitydownloadsPrisma security.
eslint-plugin-secure-codingdownloadsInjection prevention.
eslint-plugin-sequelize-securitydownloadsSequelize ORM security.
eslint-plugin-sqlite-securitydownloadsSQLite security.
eslint-plugin-supabase-securitydownloadsSupabase security.
eslint-plugin-typeorm-securitydownloadsTypeORM security.
eslint-plugin-vercel-ai-securitydownloadsAI SDK security.

Code quality

PluginDownloadsDescription
eslint-plugin-cli-floordownloadsCLI floor for commander, yargs and burgee.
eslint-plugin-conventionsdownloadsTeam-specific habits and styles.
eslint-plugin-import-nextdownloadsFast cycle + import-graph analysis.
eslint-plugin-maintainabilitydownloadsCognitive load and clean-code patterns.
eslint-plugin-modernizationdownloadsESNext migration + syntax evolution.
eslint-plugin-modularitydownloadsStructural integrity and DDD patterns.
eslint-plugin-operabilitydownloadsProduction readiness and resource health.
eslint-plugin-react-a11ydownloadsReact accessibility / WCAG.
eslint-plugin-reliabilitydownloadsRuntime stability and error safety.

⭐ Support & follow

If this plugin caught a real bug for you, star the repo β€” stars are the signal that keeps the Interlace ESLint ecosystem maintained β€” and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

GitHub stars

πŸ“„ License

MIT Β© Ofri Peretz

View README.md on GitHub β†’

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them β€” or follow the AI-code-security benchmarks behind them.