Eslint legacy detection & warning (#7831)

* Eslint legacy detection & warning

* jscpd

* fix test class

Author: nvuillam

.automation/test/dependencies/eslint.config.js

@@ -0,0 +1,13 @@
+const { FlatCompat } = require('@eslint/eslintrc');
+const js = require('@eslint/js');
+
+const compat = new FlatCompat({
+    baseDirectory: __dirname,
+    resolvePluginsRelativeTo: __dirname,
+    recommendedConfig: js.configs.recommended,
+    allConfig: js.configs.all,
+});
+
+module.exports = [
+    ...compat.config(require('./.eslintrc.json')),
+];

.github/linters/.jscpd.json

@@ -25,6 +25,7 @@
     "**/megalinter/tests/test_megalinter/mega_linter*",
     "**/megalinter/tests/test_megalinter/plugins_test.py*",
     "**/megalinter/tests/test_megalinter/config_test.py",
+    "**/megalinter/tests/test_megalinter/eslint_linter_test.py",
     "**/megalinter/llm_provider/*.py",
     "**/test_llm_advisor_integration.py",
     "**/TrivySbomLinter.py",

CHANGELOG.md

@@ -8,6 +8,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-linter.yml file, or with `oxsecurity/megalinter:beta` docker image
 
+- (Not) breaking changes, but has to be handled
+  - **ESlint-based linters have been upgraded to v10+**, so legacy .eslintrc-based config files are no longer supported, to keep using ESLint in MegaLinter you need to [migrate to flat-config](https://eslint.org/docs/latest/use/configure/migration-guide).
+
 - Core
   - Security: add [more default hidden environment variables](https://megalinter.io/beta/config-variables-security/), so in case one of the 100+ linters is hacked, the attacker won't get your secrets anyway
   - Upgrade GO version to 1.26.3

megalinter/MegaLinter.py

@@ -128,6 +128,10 @@ def __init__(self, params=None):
         self.default_linter_activation = True
         self.output_sarif = False
         self.result_message = ""
+        # Migration notices raised by linters during activation
+        # (e.g. ESLint v10 flat-config migration). Surfaced in console logs
+        # and PR comment reporters.
+        self.migration_warnings: list[str] = []
 
         # Get enable / disable vars
         self.enable_descriptors = config.get_list(self.request_id, "ENABLE", [])

megalinter/linters/EslintLinter.py

@@ -3,10 +3,113 @@
 Use Eslint to check so many file formats :)
 """
 
+import json
+import logging
+import os
+
 from megalinter import Linter
 
+LEGACY_ESLINTRC_FILES = (
+    ".eslintrc",
+    ".eslintrc.json",
+    ".eslintrc.yml",
+    ".eslintrc.yaml",
+    ".eslintrc.js",
+    ".eslintrc.cjs",
+)
+
+FLAT_ESLINT_FILES = (
+    "eslint.config.js",
+    "eslint.config.mjs",
+    "eslint.config.cjs",
+    "eslint.config.ts",
+    "eslint.config.mts",
+    "eslint.config.cts",
+)
+
+ESLINT_FLAT_CONFIG_MIGRATION_URL = (
+    "https://eslint.org/docs/latest/use/configure/migration-guide"
+)
+
 
 class EslintLinter(Linter):
+    def __init__(self, params=None, linter_config=None):
+        super().__init__(params, linter_config)
+        self._gate_on_eslint10_config(params)
+
+    # ESLint v10 dropped support for the legacy ".eslintrc.*" format.
+    # If only a legacy config is found, disable the linter and surface a
+    # migration notice (also propagated to the master so PR reporters can
+    # include it in their summary).
+    def _gate_on_eslint10_config(self, params):
+        workspace = params.get("workspace") if params else None
+        if not workspace:
+            return
+
+        flat_found = next(
+            (
+                name
+                for name in FLAT_ESLINT_FILES
+                if os.path.isfile(os.path.join(workspace, name))
+            ),
+            None,
+        )
+        if flat_found is not None:
+            return
+
+        legacy_found = next(
+            (
+                name
+                for name in LEGACY_ESLINTRC_FILES
+                if os.path.isfile(os.path.join(workspace, name))
+            ),
+            None,
+        )
+        if legacy_found is None:
+            package_json = os.path.join(workspace, "package.json")
+            if os.path.isfile(package_json):
+                try:
+                    with open(package_json, "r", encoding="utf-8") as fh:
+                        package_data = json.load(fh)
+                except (OSError, ValueError):
+                    package_data = None
+                if isinstance(package_data, dict) and "eslintConfig" in package_data:
+                    legacy_found = "package.json#eslintConfig"
+
+        if legacy_found is None:
+            return
+
+        self.is_active = False
+        self.disabled = True
+        self.disabled_reason = (
+            f"ESLint v10 requires the flat config format. "
+            f"Only legacy `{legacy_found}` was found in this repository. "
+            f"Migrate to `eslint.config.mjs` ({ESLINT_FLAT_CONFIG_MIGRATION_URL})."
+        )
+        logging.warning(
+            f"[Activation] {self.name} has been disabled: ESLint v10 only supports "
+            f"the flat config format (eslint.config.*). Detected legacy "
+            f"`{legacy_found}` only. Please migrate. "
+            f"See {ESLINT_FLAT_CONFIG_MIGRATION_URL}"
+        )
+
+        master = params.get("master") if params else None
+        if master is not None:
+            if (
+                not hasattr(master, "migration_warnings")
+                or master.migration_warnings is None
+            ):
+                master.migration_warnings = []
+            pr_message = (
+                f"⚠️ **{self.name}**: migrate to ESLint v10 flat config. "
+                f"Detected legacy `{legacy_found}` only — ESLint v10 dropped support "
+                f"for `.eslintrc.*`. `{self.name}` is disabled until the project "
+                f"migrates to `eslint.config.mjs`. "
+                f"See the [ESLint migration guide]({ESLINT_FLAT_CONFIG_MIGRATION_URL})."
+            )
+            if pr_message not in master.migration_warnings:
+                master.migration_warnings.append(pr_message)
+
     # Drop ESLint v8-only flags that v9 removed.
     # Keep --no-ignore stripping when an explicit ignore source is present.
     def build_lint_command(self, file=None):

megalinter/reporters/ConsoleReporter.py

@@ -126,6 +126,12 @@ def produce_report(self):
         for table_line in table.table.splitlines():
             logging.info(table_line)
         logging.info("")
+        migration_warnings = getattr(self.master, "migration_warnings", None)
+        if migration_warnings:
+            logging.warning(blue("Migration notices:"))
+            for warning in migration_warnings:
+                logging.warning(blue(f"- {warning}"))
+            logging.info("")
         if self.master.flavor_suggestions is not None:
             active_linter_names = [linter.name for linter in self.master.active_linters]
             custom_flavor_command = (

megalinter/tests/test_megalinter/eslint_linter_test.py

@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+"""
+Unit tests for EslintLinter ESLint v10 activation gate
+"""
+
+import json
+import os
+import tempfile
+import unittest
+
+from megalinter.linters.EslintLinter import (
+    ESLINT_FLAT_CONFIG_MIGRATION_URL,
+    EslintLinter,
+)
+
+
+class _Master:
+    def __init__(self):
+        self.migration_warnings = []
+
+
+def _make_linter(name="TEST_ESLINT"):
+    linter = EslintLinter.__new__(EslintLinter)
+    linter.name = name
+    linter.is_active = True
+    linter.disabled = False
+    linter.disabled_reason = None
+    return linter
+
+
+class EslintLinterTest(unittest.TestCase):
+    def test_gate_with_flat_config_keeps_linter_active(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            with open(
+                os.path.join(workspace, "eslint.config.mjs"), "w", encoding="utf-8"
+            ) as fh:
+                fh.write("export default [];\n")
+            with open(
+                os.path.join(workspace, ".eslintrc.json"), "w", encoding="utf-8"
+            ) as fh:
+                fh.write("{}\n")
+
+            linter = _make_linter()
+            master = _Master()
+            linter._gate_on_eslint10_config(
+                {"workspace": workspace, "master": master}
+            )
+
+            self.assertTrue(linter.is_active)
+            self.assertFalse(linter.disabled)
+            self.assertEqual(master.migration_warnings, [])
+
+    def test_gate_with_legacy_eslintrc_disables_and_warns(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            with open(
+                os.path.join(workspace, ".eslintrc.json"), "w", encoding="utf-8"
+            ) as fh:
+                fh.write("{}\n")
+
+            linter = _make_linter("JAVASCRIPT_ES")
+            master = _Master()
+            linter._gate_on_eslint10_config(
+                {"workspace": workspace, "master": master}
+            )
+
+            self.assertFalse(linter.is_active)
+            self.assertTrue(linter.disabled)
+            self.assertIn(".eslintrc.json", linter.disabled_reason or "")
+            self.assertEqual(len(master.migration_warnings), 1)
+            self.assertIn("JAVASCRIPT_ES", master.migration_warnings[0])
+            self.assertIn(
+                ESLINT_FLAT_CONFIG_MIGRATION_URL, master.migration_warnings[0]
+            )
+
+    def test_gate_with_package_json_eslintconfig_disables_and_warns(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            with open(
+                os.path.join(workspace, "package.json"), "w", encoding="utf-8"
+            ) as fh:
+                json.dump({"name": "demo", "eslintConfig": {"rules": {}}}, fh)
+
+            linter = _make_linter("TYPESCRIPT_ES")
+            master = _Master()
+            linter._gate_on_eslint10_config(
+                {"workspace": workspace, "master": master}
+            )
+
+            self.assertFalse(linter.is_active)
+            self.assertTrue(linter.disabled)
+            self.assertIn("package.json", linter.disabled_reason or "")
+
+    def test_gate_with_no_config_files_is_noop(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            linter = _make_linter()
+            master = _Master()
+            linter._gate_on_eslint10_config(
+                {"workspace": workspace, "master": master}
+            )
+
+            self.assertTrue(linter.is_active)
+            self.assertFalse(linter.disabled)
+            self.assertEqual(master.migration_warnings, [])
+
+    def test_gate_deduplicates_warnings(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            with open(
+                os.path.join(workspace, ".eslintrc.yml"), "w", encoding="utf-8"
+            ) as fh:
+                fh.write("rules: {}\n")
+
+            master = _Master()
+            for _ in range(3):
+                linter = _make_linter("JAVASCRIPT_ES")
+                linter._gate_on_eslint10_config(
+                    {"workspace": workspace, "master": master}
+                )
+
+            self.assertEqual(len(master.migration_warnings), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

megalinter/utils_reporter.py

@@ -177,6 +177,13 @@ def build_markdown_summary_footer(reporter_self, action_run_url=""):
     if reporter_self.master.result_message != "":
         footer += reporter_self.master.result_message + os.linesep
 
+    migration_warnings = getattr(reporter_self.master, "migration_warnings", None)
+    if migration_warnings:
+        footer += os.linesep + "### Migration notices" + os.linesep + os.linesep
+        for warning in migration_warnings:
+            footer += f"- {warning}" + os.linesep
+        footer += os.linesep
+
     if action_run_url != "":
         footer += (
             "See detailed reports in [MegaLinter artifacts"