惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Attack and Defense Labs
Attack and Defense Labs
aimingoo的专栏
aimingoo的专栏
月光博客
月光博客
D
Darknet – Hacking Tools, Hacker News & Cyber Security
K
Kaspersky official blog
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Stack Overflow Blog
Stack Overflow Blog
T
Threatpost
AWS News Blog
AWS News Blog
小众软件
小众软件
美团技术团队
L
Lohrmann on Cybersecurity
Hacker News: Ask HN
Hacker News: Ask HN
Security Latest
Security Latest
Jina AI
Jina AI
Hacker News - Newest:
Hacker News - Newest: "LLM"
宝玉的分享
宝玉的分享
A
Arctic Wolf
M
MIT News - Artificial intelligence
Scott Helme
Scott Helme
爱范儿
爱范儿
The Cloudflare Blog
博客园 - 聂微东
云风的 BLOG
云风的 BLOG
博客园 - 叶小钗
有赞技术团队
有赞技术团队
The GitHub Blog
The GitHub Blog
T
The Blog of Author Tim Ferriss
I
InfoQ
V
Visual Studio Blog
N
Netflix TechBlog - Medium
Latest news
Latest news
C
CERT Recently Published Vulnerability Notes
T
Tenable Blog
H
Heimdal Security Blog
www.infosecurity-magazine.com
www.infosecurity-magazine.com
Cisco Talos Blog
Cisco Talos Blog
L
LINUX DO - 最新话题
博客园 - 三生石上(FineUI控件)
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
Application and Cybersecurity Blog
Application and Cybersecurity Blog
T
Threat Research - Cisco Blogs
S
Secure Thoughts
The Hacker News
The Hacker News
S
Schneier on Security
博客园 - 【当耐特】
T
The Exploit Database - CXSecurity.com
博客园_首页
N
News | PayPal Newsroom
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org

The Practical Developer

The Libuv Thread Pool Trap: Why Node.js Async APIs Stall Under Load Postgres Covering Indexes with INCLUDE: Eliminate Heap Fetches on Read-Heavy Workloads Postgres DISTINCT ON: The Fastest Way to Get the Latest Row Per Group Postgres Transaction Isolation: The Anomalies Your App Actually Faces in Production Linux TCP Tuning for Node.js Microservices: The Kernel Settings That Stop Silent Connection Drops Under Load Postgres HOT Updates and Fillfactor: Why Not All Writes Are Created Equal Database Connection Pool Leaks: Finding the Promise That Never Returns Its Seat Linux OOM Killer in Production: Why Your Node.js Containers Die Without a Stack Trace Postgres Materialized Views: Refresh Strategies That Do Not Lock Your Dashboards API Dependency Health Checks: Why /health Is Not Enough Authorization with Zanzibar Tuples: How Google Manages Permissions and How To Build the Same Check in Node.js Postgres Advisory Locks: The 20-Character Primitive That Replaces Redis for Coordination Dead Letter Queues: The Message Queue Pattern That Saves You at 2 a.m. File Descriptor Exhaustion: The Kernel Limit That Silently Drops Node.js Connections Graceful Degradation: The Pattern That Turns Total Outages into Partial Success PostgreSQL Full-Text Search: Dropping Elasticsearch for 90% of Use Cases S3 Presigned Multipart Uploads: Stop Your API Server from Being a File Upload Bottleneck MessagePack vs JSON: The Binary Serialization Switch That Cut Our Internal RPC Overhead by 40% DNS Caching in Node.js: The Silent Cause of Production Latency Spikes Reliable Cron Jobs: The Pattern That Stops Double Runs, Missed Executions, And The 2 AM Page GraphQL Query Complexity: Stop the OOM Query Before It Reaches Your Resolver Node.js Event Loop Lag: The Hidden Metric Behind Random Latency Spikes API Request Validation with Zod: The Schema That Catches Bad Input Before It Corrupts Your Database Load Shedding in Node.js: How to Reject Traffic Before You Drown Request Hedging: Cut Tail Latency In Half Without Overprovisioning Git Bisect: The Automated Binary Search That Finds Breaking Commits in Minutes Node.js Garbage Collection Tuning: Stop Letting V8 Pause Your Event Loop Node.js Server Timeouts: The Settings That Stop Slow Clients from Holding Sockets Hostage Postgres BRIN Indexes: The Time-Series Secret That Shrinks Indexes by 99% Event Sourcing with PostgreSQL: The Pragmatic 80% Solution Node.js Cluster Mode: Scaling the Event Loop Across CPU Cores Postgres Partial Indexes: Stopping Soft Deletes from Ruining Your Query Performance Request Coalescing with the Singleflight Pattern: Stop Drowning Your Database on Every Cache Miss The Bulkhead Pattern: Why One Slow Endpoint Should Not Drown Your Whole Service Node.js AsyncLocalStorage: End-to-End Request Context Without the Propagation Hell Postgres Deadlocks: Logging the Victim, Reproducing the Race, and Fixing the Lock Order Your Node.js HTTP Client Is the Bottleneck: Connection Pool Tuning That Works Optimistic Locking in Postgres: Stop Losing Data to Race Conditions Postgres Read Replicas: Stop Serving Stale Data to Your Users Cursor Pagination: Why Offset Queries Explode at Scale and How to Fix Them Node.js Worker Threads: 60 Lines That Stop a CSV Upload from Timing Out Every Other Request Reliable Webhook Delivery: Architecture for Outbound HTTP You Can Trust Request Timeouts and Deadline Propagation: Stop the Chain of Slowness Advanced Security Practices in Node.js Graceful Shutdown in Node.js: The 40 Lines That Stop 502s During Deploys Finding Node.js Memory Leaks with Heap Snapshots Idempotency Keys in 30 Lines: Stop Your Webhook From Charging Customers Twice Backpressure In Node.js: The Fix For Slow-Motion Queue Meltdowns Retries Done Right: Jitter, Budgets, and the Stampede You Did Not See Coming The Cache Stampede: Why Your "Just Add Redis" Layer Crashes Postgres at 3 a.m. Postgres SKIP LOCKED: An 80-Line Job Queue You Can Run Without Redis Stop Doing Work Nobody Wants: AbortController in Node.js, Done Right The N+1 Query Problem: We Found 23 In One Codebase And Killed Every One I Tried 5 AI Coding Tools for a Month. Here Is What I Actually Use CI/CD From Zero to Production in 30 Minutes With GitHub Actions Node.js vs Bun vs Deno: Which Runtime Should You Pick in 2025? Kubernetes Resource Requests And Limits: The Numbers That Decide If Your Cluster Is Stable The Three Pillars of Observability Are A Myth: What Actually Matters In Production pnpm Vs npm Vs yarn Vs Bun For Monorepos: Which One Earns The Migration In 2024 JSONB Indexing In Postgres: GIN Vs Expression Indexes, And When Each Is The Right Choice A Code Review Checklist That Ends The Same Three Arguments Every Sprint gRPC Vs REST In 2024: When The Switch Pays For Itself React Suspense For Data Fetching: The Pattern That Replaces Half Your Loading State Code The Five-Stage Rollout: How To Ship A Risky Change Without Holding Your Breath GitHub Actions In A Monorepo: Caching, Path Filters, And Secret Boundaries That Actually Work The Blameless Postmortem That Actually Improves Things: A Template And Six Hard-Won Rules Recursive CTEs In Postgres: How To Query A Tree Without N Round Trips Node.js Streams: When They Actually Help, And When They Just Add Complexity Playwright Vs Cypress In 2024: The Honest Comparison Of Which One Earns The Test Time React Server Components: The Mental Model That Makes The "use client" Boundary Obvious Pod Disruption Budgets: The K8s Object That Keeps Your Service Up During Cluster Maintenance Postgres LISTEN/NOTIFY: The Pub/Sub You Already Have And Are Not Using Chaos Engineering Starter Kit: The Five Drills That Don't Need Netflix-Scale Spec-Driven API Development With OpenAPI: How To Stop Drifting From Your Docs Kubernetes Autoscaling Beyond CPU: The Custom-Metric HPA Pattern That Actually Works Postgres Partitioning For Time-Series: The Boring Setup That Saves Your Database Distributed Locks With Redis: An Honest Look At Redlock And When You Don't Need It HTTP/2 vs HTTP/3: What Actually Changes For Your App, And What Doesn't Image Optimization For The Web In 2023: srcset, AVIF, And The Lighthouse Score You Actually Want Kafka vs RabbitMQ: A Decision Tree That Doesn't Hate You UUID vs Bigint Primary Keys In Postgres: The Index Math That Decides For You Flame Graphs: How To Find The Slow Function In 30 Seconds Without Profiling Theatre Postgres Streaming Vs. Logical Replication: Which One Solves Your Actual Problem ESLint Rules That Earn Their Keep: The Twelve I Enable On Every Project Pre-Commit Hooks That Pay For Themselves: Husky, lint-staged, And The Five Rules That Stick Zero-Downtime Database Migrations: The Six-Step Pattern That Rules Them All Circuit Breakers In Node.js: 50 Lines That Stop A Failing Dependency From Taking Down Your Service Postgres VACUUM Is Not Magic: How Your Hot Table Bloats To 80GB And How To Fix It Kubernetes Liveness And Readiness Probes: The Difference That Causes Half Your Outages Rate Limiting In Production: A Token Bucket In 30 Lines Of Redis The Outbox Pattern: How To Stop Losing Events When Postgres And Kafka Disagree Load Testing With k6: The Three Scenarios That Find Real Bugs (Not Synthetic Numbers) Postgres Row-Level Security For Multi-Tenant Apps: The Pattern That Stops You From Leaking Data Rebase vs. Merge: The Team Policy That Ends The Argument Forever OpenTelemetry in Node.js: Distributed Tracing That Actually Helps During an Incident Feature Flags That Pay Rent: The 4 Flag Types And When To Delete Each ETag, Last-Modified, and the Caching Headers Most APIs Get Wrong Connection Pooling Without the Cargo Cult: pgbouncer in 100 Lines of Config JSONB Is Not a Schema: When To Reach For It in Postgres, And When To Stop Bash Strict Mode: The Three Lines That Stop Your Deploy Script From Lying To You
ESLint Flat Config Migration: Moving from .eslintrc to eslint.config.js
The Practica · 2026-06-23 · via The Practical Developer

ESLint 9 was released in April 2025, and it makes flat config the default. The old .eslintrc format is deprecated and will be removed in ESLint 10. If you have not migrated yet, your lint setup is running in compatibility mode, and every npm install prints a deprecation warning.

This post covers the migration itself: what changes, what stays the same, and the exact eslint.config.js you should write for a typical TypeScript project with React, imports, and Prettier.

The problem with .eslintrc

The .eslintrc format had accumulated a decade of design debt:

  • extends was a black box. You added "extends": ["airbnb"] and 800 rules appeared. Knowing which ones and overriding them required deep archeology.
  • plugins and rules were decoupled. You listed a plugin in plugins and then referenced it again in rules with a prefixed name. The connection was implicit and easy to get wrong.
  • Shareable configs piled on. Each project had a tower of extends (airbnb, prettier, next, typescript) that resolved at runtime with no ability to trace which rule came from where.
  • Cascading .eslintrc files. Parent directory configs merged with child configs in ways that surprised teams constantly.

Flat config replaces all of this with a single eslint.config.js file that exports an array of flat config objects. Each object is self-contained: it specifies files, rules, plugins, and languageOptions in one place. No inheritance, no merging magic.

What flat config changes

Concept.eslintrceslint.config.js
Config file.eslintrc.json, .eslintrc.js, .eslintrc.yamleslint.config.js (or .mjs, .ts)
FormatSingle object with extends, plugins, rulesArray of flat config objects
ExtendsString array, resolved at runtimeImport and spread manually
Env"env": { "node": true, "browser": true }languageOptions.globals
Parser"parser": "@typescript-eslint/parser"languageOptions.parser
PluginsString array plus prefixed rulesImport the plugin object, reference directly
Overrides"overrides": [{ "files": [...], "rules": {...} }]Just another config object with files
Ignore.eslintignore fileignores property on a config object
CascadingMerged parent/child .eslintrc filesSingle file per project, no merging

Before and after: a concrete migration

Here is a typical .eslintrc.json for a TypeScript project with React:

{
  "root": true,
  "env": {
    "browser": true,
    "es2021": true,
    "node": true
  },
  "extends": [
    "eslint:recommended",
    "plugin:@typescript-eslint/recommended",
    "plugin:@typescript-eslint/recommended-requiring-type-checking",
    "plugin:react/recommended",
    "plugin:react-hooks/recommended",
    "plugin:import/recommended",
    "plugin:import/typescript",
    "prettier"
  ],
  "parser": "@typescript-eslint/parser",
  "parserOptions": {
    "ecmaVersion": "latest",
    "sourceType": "module",
    "project": "./tsconfig.json",
    "ecmaFeatures": { "jsx": true }
  },
  "plugins": ["@typescript-eslint", "react", "react-hooks", "import"],
  "rules": {
    "@typescript-eslint/no-floating-promises": "error",
    "@typescript-eslint/no-explicit-any": "warn",
    "@typescript-eslint/strict-boolean-expressions": "error",
    "react/react-in-jsx-scope": "off",
    "import/no-cycle": "error",
    "import/order": ["error", { "alphabetize": { "order": "asc" } }]
  },
  "settings": {
    "react": { "version": "detect" },
    "import/resolver": { "typescript": true }
  },
  "overrides": [
    {
      "files": ["**/*.test.ts", "**/*.test.tsx"],
      "rules": {
        "@typescript-eslint/no-explicit-any": "off",
        "no-console": "off"
      }
    }
  ]
}

And here is the equivalent flat config:

import js from "@eslint/js";
import tseslint from "typescript-eslint";
import reactPlugin from "eslint-plugin-react";
import reactHooksPlugin from "eslint-plugin-react-hooks";
import importPlugin from "eslint-plugin-import";
import globals from "globals";
import eslintConfigPrettier from "eslint-config-prettier";

export default [
  // Global ignores
  { ignores: ["dist/**", "node_modules/**", "*.config.*"] },

  // Base config: recommended JS rules
  js.configs.recommended,

  // TypeScript config
  ...tseslint.configs.recommended,
  ...tseslint.configs.recommendedTypeChecked,

  // React config
  {
    files: ["**/*.{jsx,tsx}"],
    plugins: {
      react: reactPlugin,
      "react-hooks": reactHooksPlugin,
    },
    languageOptions: {
      globals: { ...globals.browser },
      parserOptions: {
        ecmaFeatures: { jsx: true },
      },
    },
    rules: {
      ...reactPlugin.configs.recommended.rules,
      ...reactHooksPlugin.configs.recommended.rules,
      "react/react-in-jsx-scope": "off",
    },
    settings: {
      react: { version: "detect" },
    },
  },

  // Import plugin
  {
    plugins: { import: importPlugin },
    rules: {
      ...importPlugin.configs.recommended.rules,
      ...importPlugin.configs.typescript.rules,
      "import/no-cycle": "error",
      "import/order": [
        "error",
        { alphabetize: { order: "asc" } },
      ],
    },
    settings: {
      "import/resolver": { typescript: true },
    },
  },

  // Project-specific rules
  {
    files: ["**/*.{ts,tsx,js,jsx}"],
    languageOptions: {
      globals: { ...globals.node, ...globals.browser },
      parser: tseslint.parser,
      parserOptions: {
        project: "./tsconfig.json",
      },
    },
    rules: {
      "@typescript-eslint/no-floating-promises": "error",
      "@typescript-eslint/no-explicit-any": "warn",
      "@typescript-eslint/strict-boolean-expressions": "error",
      "no-console": ["error", { allow: ["warn", "error"] }],
    },
  },

  // Test file overrides
  {
    files: ["**/*.test.{ts,tsx}", "**/__tests__/**"],
    rules: {
      "@typescript-eslint/no-explicit-any": "off",
      "no-console": "off",
    },
  },

  // Must be last: turns off formatting rules
  eslintConfigPrettier,
];

Key differences explained

1. extends is gone. You import configs as objects.

In the flat config world, you do not use strings like "plugin:@typescript-eslint/recommended". Instead you import the config object and spread it into the array:

import tseslint from "typescript-eslint";

export default [
  ...tseslint.configs.recommended,
];

The spread operator is not optional. Each config is an array or an object, and you need to spread arrays to flatten them into the top-level array.

Some packages export their configs differently:

  • @eslint/js exports js.configs.recommended (a single object)
  • typescript-eslint exports tseslint.configs.recommended (an array)
  • eslint-plugin-react uses reactPlugin.configs.recommended.rules

Check each plugin’s migration guide. The pattern varies.

2. env is replaced by languageOptions.globals

The old "env": { "node": true } automatically pulled in global variables for that environment. Now you import from the globals package and spread the ones you need:

import globals from "globals";

export default [
  {
    languageOptions: {
      globals: {
        ...globals.node,
        ...globals.browser,
      },
    },
  },
];

Install globals separately: npm install --save-dev globals. It is not included with ESLint anymore.

3. plugins are imported objects, not strings

Old way: "plugins": ["react"], then "rules": { "react/jsx-key": "error" }.

New way:

import reactPlugin from "eslint-plugin-react";

export default [
  {
    plugins: { react: reactPlugin },
    rules: {
      "react/jsx-key": "error",
    },
  },
];

The key in the plugins object becomes the prefix you use in rule names. If you write plugins: { r: reactPlugin }, rules become "r/jsx-key". Use the convention the plugin expects.

4. overrides are just more config objects

In flat config, every element in the array is an override. Configs with a files property apply only to matching files. Configs without files apply globally. You can repeat this as many times as needed, and the last matching config wins for each rule.

This is more explicit than the old overrides block. It also means you can pull shared configs into separate files:

const testOverrides = {
  files: ["**/*.test.*"],
  rules: { "no-console": "off" },
};

export default [
  js.configs.recommended,
  testOverrides,
  // ...
];

5. ignores replace .eslintignore

The ignores array on a config object tells ESLint which files to skip entirely. Unlike the old .eslintignore, it uses the same glob syntax as files.

Important: a config object with only ignores and no files applies as a global ignore directive. If you add files, the ignores only apply within those files.

// Global ignore: these files are never linted
{ ignores: ["dist/**", "coverage/**"] },

Prettier integration

The eslint-config-prettier package still works, but the import is different:

import eslintConfigPrettier from "eslint-config-prettier";

export default [
  // ... all your other configs ...

  // MUST be last
  eslintConfigPrettier,
];

eslint-config-prettier is now a flat config object (since v10). Spread it as the last element in the array so it can override any conflicting rules from earlier configs.

If you use Prettier as an ESLint rule via eslint-plugin-prettier, stop. The recommended setup is ESLint for code quality and Prettier for formatting, run separately. eslint-plugin-prettier runs Prettier inside ESLint, which makes linting 3x slower and can hide Prettier errors. Run prettier --check in your pre-commit hook and CI instead.

TypeScript in flat config

The typescript-eslint team provides first-class flat config support. Install typescript-eslint (not just @typescript-eslint/eslint-plugin):

npm install --save-dev typescript-eslint

Then import and spread the configs:

import tseslint from "typescript-eslint";

export default [
  ...tseslint.configs.recommended,
  ...tseslint.configs.recommendedTypeChecked,
  {
    languageOptions: {
      parserOptions: {
        project: "./tsconfig.json",
      },
    },
  },
];

The recommendedTypeChecked config requires parserOptions.project to be set, just like the old format. If you do not set it, the type-aware rules disable themselves silently.

Performance note: type-aware rules require ESLint to run the TypeScript compiler internally. Expect lint to be 3-5x slower than without types. The typescript-eslint v8+ project service mode caches the TypeScript program between files, which helps. Enable it by setting ESLINT_USE_PROJECT_SERVICE=true in your environment or by using the experimental projectService parser option:

languageOptions: {
  parserOptions: {
    projectService: true,
  },
},

Common migration pitfalls

Config ordering matters

ESLint merges config objects in array order. Later configs override earlier ones for the same rule. Put broad configs first, specific overrides later.

Wrong:

export default [
  { files: ["*.ts"], rules: { "no-console": "off" } },
  { rules: { "no-console": "error" } },   // overrides the one above!
];

Right:

export default [
  { rules: { "no-console": "error" } },
  { files: ["*.test.ts"], rules: { "no-console": "off" } },  // test override wins
];

Missing globals causes false positives

If you use process, require, or __dirname in a Node.js file and do not include globals.node, ESLint flags them as undefined variables. Add languageOptions.globals explicitly.

Spread arrays, not objects

Some config packages export arrays (typescript-eslint), some export objects (@eslint/js). Check the type. Spreading an array inside an array is fine (...arr). Spreading an object inside an array is an error unless the object is iterable.

If you get a runtime error about spreading a non-iterable, check whether the config is an object or an array.

Custom parsers go in languageOptions

Old way: "parser": "@typescript-eslint/parser"

New way:

import tseslint from "typescript-eslint";

{
  languageOptions: {
    parser: tseslint.parser,
  },
}

Same for other parsers like @babel/eslint-parser.

A minimal flat config to start

If you want to migrate incrementally, start with this and add plugins one at a time:

import js from "@eslint/js";

export default [
  { ignores: ["dist/**", "node_modules/**"] },
  js.configs.recommended,
  {
    languageOptions: {
      globals: {
        // Add what you need: import globals from "globals"
        console: "readonly",
        process: "readonly",
      },
    },
    rules: {
      "no-unused-vars": "warn",
      "no-console": ["error", { allow: ["warn", "error"] }],
    },
  },
];

Run npx eslint . and confirm it works. Then add TypeScript. Then React. Then imports. Then Prettier. Each plugin is just another config object at the end of the array.

The takeaway

Flat config is a cleaner model, but the migration is not a find-and-replace. Each concept maps differently: extends becomes spreads, env becomes globals, plugins become imported objects, and overrides become array elements. The ordering of config objects matters in a way that the old .eslintrc did not.

Migrate in stages. Start with the base JS config, verify it works, then layer on TypeScript, React, and imports one by one. Keep Prettier integration as the last element. Test with npx eslint . after each addition.

The final result is a config that is easier to read, trace, and share than the .eslintrc it replaced. Every plugin and rule set is a first-class import at the top of the file. You can see exactly where each rule comes from, comment out a section to debug a false positive, and split configs into reusable modules without the black-box inheritance that made old ESLint so hard to understand.


A note from Yojji

A migration like this touches every file in the repository, touches CI, and touches every developer’s editor. Getting it right means understanding not just the new API but the architectural difference between extends and composition. Yojji’s teams handle these kinds of toolchain upgrades for clients regularly, treating migration work as an engineering discipline with measurable before-and-after states, not a copy-paste job.