Warning: React version not specified in eslint-plugin-react

SonarQube for IDE
1
  • Operating system: Ubuntu 24.04
  • IDE name and flavor/env: N/A

Since upgrading to eslint-plugin-sonarjs 2.x, I get this warning running eslint

Warning: React version not specified in eslint-plugin-react settings. See https://github.com/jsx-eslint/eslint-plugin-react#configuration .

I do not use react in any project.

A cleaner solution should probably be to have eslint-plugin-react as an optional depencency.
If that’s not possible or would take too long, is there a way I silence this warning?

Thanks.

1 Like
3

Hello Daniele,

I understand you are not using the recommended config.

Please add this react setting in your eslint config:

  settings: {
    react: {
      version: '999.999.999',
    },
  }

Cheers,
Victor

5

Thanks. This works.

I have to notice that is still an hack: I should not be required to configure something for a whole framework that I do not use. Actually what is not correct is that eslint-plugin-react is always imported. It should be an optional dependency.

1 Like
6

Hello @ildella,

we cannot put it as an optional dependency because we are modifying some of their rules’ behavior.

If you use the plugin’s recommended configuration, that configuration does not need to be set. In any case, I agree we should provide different profiles of recommended configurations depending on each user’s needs. I created a ticket for that.

Thanks

1 Like
10

we are modifying some of their rules’ behavior.

Ah, so that would be why there’s so many rules duplications. I have some issues with how it’s currently handled, but I’ll open a different post with more details and some possible suggestions.

I agree we should provide different profiles of recommended configurations depending on each user’s needs.

That would be lovely, ESLint is already a pretty slow tool, no need to bloat it by enabling more rules I can’t possibly be using in a project :slight_smile: It will simplify our shared configs too.

we cannot put it as an optional dependency because we are modifying some of their rules’ behavior.

If the rules aren’t used, there’s no need to modify them, hence for them to necessarily be present. A clear error could be presented when trying to use one of those rules from an eventual preset, with the plugin missing. (just like ESLint already gives a clear error when trying to use a preset or rule for a plugin not installed or not imported).

Any chance to make JSX/Vue/React dependencies optional as well for non-jsx projects ? It could be a sonarjs-jsx plugin if you don’t want to make the dependencies optional. Here’s 2 reasons I can think of:

  1. Reduce package size. Yes this actually really matters when using a tool like pre-commit.ci on the free tier. See this example where I’ve added special casing to not load and run a bunch of plugins under that context, and have to tell my users to explicitly omit them: eslint-config-beslogic - npm (npmjs.com). An Angular dev, for instance, doesn’t need React/Vue dev packages (it’s also just generally nicer on the ecosystem, JS/npm has a very bad wrap for being bloated for a reason ^^" )
  2. Reduce false-positives from npm audit. You’re probably already aware of this as a company that deals in Software Security, but here’s my 2 usual references: npm audit: Broken by Design — overreacted & https://github.com/facebook/create-react-app/issues/11174
2 Likes
11

For a concrete example: eslint-plugin-sonarjs@2 makes me bust pre-commit’s limit by ~30.2MiB. (meaning the package itself it well over that): pre-commit.ci

Some related tickets that would help:

2 Likes
12

Hello @Avasam,

indeed we are planning to tackle those, but we are still blocked by our usage of ESLint 8 internally in the SonarJS Java plugin (not the ESLint plugin). We will not be able to use context.parser until we move to v9, which we cannot do yet because not all our dependencies have migrated to it.

Hopefully, later this year, we can solve the size issue.

Cheers,
Victor

1 Like