search

eslint-types / eslint-define-config

Provide a defineConfig function for .eslintrc.js files
MIT License
361 stars 26 forks source link

Deep freeze flat config in `defineFlatConfig` #264

Open privatenumber opened 11 months ago

privatenumber commented 11 months ago

Flat configs should be deep frozen so they can't be mutated. For example: https://github.com/eslint/eslint/blob/4391b71e62b15e54b0493f0dce1ea053ebbc0689/packages/js/src/configs/eslint-recommended.js#L12

Because the config is now flat and config extending happens in user-land, users may try to extend a config by mutating the actual object. Allowing mutation will cause unexpected behavior in complex configurations where multiple config/plugins depend on a shared config.

I think defineFlatConfig is a good place to freeze the config.

Shinigami92 commented 11 months ago

I'm not sure if this should be done by eslint-define-config

You can easily do this by yourself via wrapping the defineFlatConfig call with Object.freeze

privatenumber commented 11 months ago

Object.freeze would need to be applied recursively. And in the recursion, you also have to handle cyclic relationships.

But my motivation is not actually about reducing code. While the convenience of automatic freezing would be appreciated, I see it more as a holistic approach—sealing the config is a finalizing step in the process of creating it.

The benefits extend beyond to safeguarding the config and, by extension, the end-user. Preventing the possibility of config mutation is a proactive measure against unexpected behaviors.

Considering that many config authors may overlook this step, I think this could be a great place to provide the safeguard.