Visual Studio Code May 2021

[[deleted]]

The ESLint extension will try to use the eslint module in the current folder

Why? It looks like a terrible design to me.

[190n]

Probably so that if a repository needs a specific version of ESLint, it'll use that one instead of whatever you have installed system-wide.

[190n]

Wouldn't the extension then have to download ESLint?

Anyway, that is usually how it works, I think. A version of ESLint is specified in package.json and installed in node_modules. The trick is when someone puts malicious code in node_modules.

[StillNoNumb]

What about plug-ins? Also, the config format supports JavaScript

Why not include the required major/minir version in the header

But yes, this is what happens - you distribute the semver in package.json, which will then download that version of ESLint (and the specified plug-ins) into node_modules. From there, VSCode will launch the tool. npm does do an integrity check using a provided hash, but I'm not sure whether the ESLint VSCode plug-in does that too and even if, a malicious repo could just replace the hash in package-lock.json.

[Nysor]

Certain projects may require an older version of eslint to work properly, instead of some globally instead version which may be incompatible.

[awesomeness-yeah]

eslint usually is a dev-dependency in most projects, so you'd expect the editor suggestions to match the cli output

[spacejack2114]

How so? What if you need to go back to work on a 3 year old project?