Linting

Prettier52.3k★

Prettier ends the formatting debate by automatically formatting JavaScript, TypeScript, CSS, HTML, JSON, and Markdown. It's opinionated on purpose: fewer config options means everyone's code looks the same. MIT license, JavaScript. The most widely adopted code formatter in the JS ecosystem. Supports JS, TS, JSX, CSS, SCSS, Less, HTML, Vue, Angular, GraphQL, Markdown, YAML, and more. Integrates with every editor, runs in CI, and has plugins for additional languages. Fully free. No paid tier, no premium plugins, no hosted service. Every language, every integration, every feature: $0. Every JavaScript/TypeScript team should use this. That's not a suggestion, it's the industry default at this point. Solo to enterprise: install it, add it to your editor's format-on-save, add it to CI. Done. The catch: "opinionated" means you don't get to customize much. If you hate Prettier's formatting choices (and some people really do), your options are limited to a handful of config flags. It also doesn't lint; it formats. You still need ESLint for catching actual bugs. And occasionally a new Prettier version reformats your entire codebase, creating massive diffs that pollute git history.

Ruff49.7k★

Ruff does the work of flake8, black, isort, pylint, and pyupgrade in one pass, fast enough that linting stops being a step you wait on. It is a Python linter and formatter written in Rust, MIT licensed, no paid tier, no account. Version 0.16 flipped the default rule set from 59 rules to 413. Nothing to host: one binary, one config block in pyproject.toml, one CI step. The upgrade is where the work is, because 413 default rules pointed at a mature codebase produces a wall of new findings to triage. Solo and small teams should install it and delete the other five tools. Medium teams should budget an afternoon for the migration. Large teams should pin the version so a patch bump does not change what fails in CI. In JavaScript, biomejs/biome and oxc-project/oxc do the same job, and astral-sh/uv comes from the same team. The catch: Ruff still has no custom plugin system, so team-specific flake8 plugins have nowhere to go. Astral was acquired by OpenAI in March 2026 and its paid registry pyx stopped taking signups. MIT means a fork stays possible, but the roadmap now belongs to a company whose main business is not Python tooling.

ShellCheck40.0k★

ShellCheck finds bugs in your shell scripts before they bite you in production. It's a linter that reads your shell scripts and tells you about quoting errors, unsafe variable expansions, and portability issues. The kind of bugs that work fine on your machine and explode on the server. GPL v3. Written in Haskell but you don't need to know or care about that; it's a standalone binary. Integrates with every major editor (VS Code, Vim, Emacs), runs in CI, and has a web version at shellcheck.net for quick checks. Fully free. No paid tier, no premium rules, no hosted service beyond the free web checker. Every rule, every check, every integration, $0. Every team that writes shell scripts should use this. Solo or enterprise, the answer is the same: install it, add it to CI, stop shipping broken bash. Takes 5 minutes to set up. The catch: ShellCheck only handles sh/bash/dash/ksh. If you're writing Zsh scripts, coverage is limited. And it catches syntax and common pitfalls but won't validate your script's logic; it'll tell you your variable is unquoted, not that your deployment script deletes the wrong directory. Also, GPL v3 means you can't embed it in proprietary tools without licensing implications.

ESLint27.5k★

ESLint catches bugs, enforces code standards, and fixes problems automatically before your JavaScript or TypeScript code ever runs. It's a spell checker for code. It reads your files, finds problems (unused variables, missing error handling, inconsistent formatting), and can auto-fix many of them. What's free: Everything. MIT license. The core linter, every built-in rule, the plugin system, the flat config format. All free, forever. ESLint is funded by donations and sponsorships, not by gating features. ESLint is non-negotiable for JavaScript projects. Used in essentially every professional JS/TS codebase. The plugin ecosystem covers React, Vue, TypeScript, accessibility, import ordering. Whatever your stack, there's an ESLint plugin for it. The catch: configuration. ESLint recently moved to a 'flat config' system that's simpler than the old `.eslintrc` approach, but migrating existing configs takes effort. The sheer number of rules and plugins can be overwhelming. And for pure formatting (tabs vs spaces, semicolons), Prettier is better. Use both together: ESLint for logic bugs, Prettier for formatting.

Biome25.8k★

Biome replaces ESLint and Prettier with a single tool, ending the config fights and the slow lint runs. It formats and lints JavaScript, TypeScript, JSX, JSON, CSS, and GraphQL in one pass, with HTML behind an opt-in. Written in Rust, so the speed is the point: the project's own benchmarks put it around 25 to 35 times faster than Prettier and about 15 times faster than ESLint without plugins. Everything is free, dual licensed under MIT or Apache 2.0. There is nothing to host. Install it, keep one config file, run it. The enterprise page is contributors offering paid support, not a gated edition. Version 2 added type-aware lint rules that do not need the TypeScript compiler, and the rule count has passed 500, including React hooks rules, an accessibility group, and import sorting with custom groups. Solo: switch unless your ESLint setup is heavily customized. Small teams: one config replaces two, with less bikeshedding. Medium and large: the CI time saved adds up, so test it on one project first. oxc-project/oxc is the other Rust contender worth a look for linting alone. The catch is at the edges. Vue, Svelte, and Astro support is experimental, and SCSS, YAML, and Markdown are still in progress. Plugins are written in GritQL, so custom ESLint plugins do not carry over. And the type-aware floating promise rule catches about 75% of what typescript-eslint does, by Biome's own count.

infer15.7k★

Infer reads your code without running it and tells you where it will crash. Meta built it to catch null pointer bugs, memory leaks, and data races in Java, C, C++, and Objective-C before they ever hit production, then open-sourced the whole thing under MIT. It runs from the command line and hooks into your build, so it sees exactly what your compiler sees. There's no server and no subscription. You grab a prebuilt binary or build it from OCaml source, wire it into your build system, and it runs in CI like any other check. The real work isn't infrastructure, it's tuning. Infer is an interprocedural analyzer, meaning it traces bugs across function boundaries, and out of the box it will surface findings you'll need to triage and quiet down. Budget time for that first pass. This runs in production at Meta, Amazon, Uber, and Spotify, so the engine is proven. Solo devs on a small codebase probably won't feel the need. Where it earns its keep is on large C/C++/Objective-C or Android codebases, where a single null deref can ship to millions of devices. If you're paying for Coverity, or leaning on SonarCloud's paid tier mainly for deep bug detection, Infer covers a lot of that for free. The catch is scope. Infer is a specialist, not a platform. It finds a specific class of correctness and concurrency bugs extremely well, but it won't give you the security rule packs, quality-gate dashboards, or broad language coverage that a SonarQube or Snyk sells. It's a sharp knife, not a Swiss Army one.

knip12.3k★

Knip finds the dead weight in your JavaScript and TypeScript projects: files nothing imports, dependencies you installed and forgot, exports nothing else uses. Run it and it tells you exactly what you can delete. It is free and open source under the permissive ISC license, installed as a single npm package. There is a VS Code extension and an MCP server too, so your AI assistant can flag dead code as you write. Running it is one command. The work is in the config. Knip reads simple projects automatically, but monorepos, custom frameworks, and build setups usually need a config file and the right plugins so it stops flagging things that are actually used. It ships plugins for most major tools (Next.js, Jest, Storybook, and dozens more), so tuning is mostly picking the right ones, not writing rules from scratch. This is the tool for shrinking a codebase before a refactor or a dependency audit. Solo or small team: install it, run it in CI, done. Big monorepo: budget an afternoon to dial in the config, then it earns its keep every release by catching cruft before it ships. The catch is false positives. On a complex setup, knip flags things that look unused but get loaded dynamically or by a tool it has no plugin for. Read the report, do not pipe it straight into fix mode. Once it is tuned it is accurate, but the first run on a messy repo is a conversation, not a verdict.

sonarqube11.0k★

SonarQube analyzes your code for bugs, security vulnerabilities, and code smells across 30+ languages. It integrates with every major CI/CD pipeline and gives you a quality gate you can fail builds on. The Community Edition is free and self-hosted. Deploy via Docker or a dedicated server. You need 2GB+ RAM for the process, plus a Postgres database. The Docker Compose setup handles it in minutes. The web interface is comprehensive and developers actually use it without being forced. Quality gates plug directly into your CI pipeline. Solo developers and small teams run the Community Edition free. The Developer Edition adds branch analysis and deeper security rules starting at around 150 USD/year per developer. Enterprise Edition adds datacenter mode and portfolio management. The catch: Community Edition does not do branch analysis. You analyze main only. If your team uses feature branches heavily, you either upgrade to Developer Edition or run multiple SonarQube instances.

eslint-config6.3k★

Anthony Fu's personal ESLint config, published as a preset. One line of setup in your eslint.config.js and you get linting, formatting, sorted imports, and reasonable defaults across TypeScript, JSX, Vue, JSON, YAML, and Markdown. The selling point is that it replaces Prettier entirely. Formatting happens inside ESLint, which means one tool, one config, one CI step. It uses ESLint's flat config format, so you'll need ESLint 9.5 or newer. Framework support for React, Next.js, Svelte, UnoCSS, Astro, Solid, and Angular is opt-in via flags. Vue and TypeScript detection is automatic. The starter wizard at `pnpm dlx @antfu/eslint-config@latest` will scaffold the config and the package.json scripts for you. Use this if you trust Antony Fu's taste, which most of the Vue and Nuxt ecosystem does. Solo: install it. Small teams: install it and commit to the opinions. Large teams with existing style guides: it's a hard rip-and-replace, but worth evaluating if you're tired of the ESLint plus Prettier plus stylelint stack. The catch: it's opinionated. Single quotes, no semicolons, dangling commas, sorted imports, all non-negotiable by default. The README literally says "changes might not always work for everyone." If your team has strong existing conventions, expect arguments.

anti-slop4.7k★

Anti-slop is 15 Oxlint rules that reject TypeScript which throws away type information. Chained as-assertions, functions returning unknown, object as a parameter type, ad hoc typeof narrowing where a parser belongs, Vitest and Jest module mocks. The name points at what coding agents write when they need something to compile. MIT, free. It is built to be vendored, not depended on. There is no npm package. You copy the rules into your repo, register the plugin entry point in oxlint.config.ts, and from then on they are your files to edit. A bundled agent skill does the copy and wiring. Updates are a manual re-copy, by design. Solo developers shipping agent-written TypeScript: worth an afternoon. Small and medium teams on oxlint: read all 15 rules first, because no-module-mocking and the required comment on every type assertion will reshape your tests and your boundaries. Large teams: this is an addition to eslint/eslint or SonarSource/sonarqube, never a replacement. The catch is the age. This landed days ago with a dozen commits and no tagged release. The rules are one developer's strong opinions, and a few (banning Reflect.get outright, banning object parameters) will fight code that is perfectly fine. Vendoring means you own the fallout, which is the point and also the work.

qlty3.2k★

Qlty orchestrates dozens of existing tools under one CLI. Instead of configuring ESLint, Pylint, Rubocop, and Semgrep separately, qlty runs them all with a single command and unified output. The CLI is free. It auto-detects your languages, installs the right linters, and runs them. Supports 20+ languages and wraps established tools (ESLint, Ruff, Clippy, etc.) rather than reinventing analysis from scratch. That's smart: you get battle-tested rules without learning each tool's config format. The cloud dashboard (qlty.sh) adds PR-level quality gates, trend tracking, and team analytics. Free for open source, paid plans for private repos starting at $30/mo per seat. The catch: qlty is still early. The tool orchestration approach means you're depending on qlty to correctly configure and update the underlying linters. When an underlying tool changes its output format or rules, qlty needs to adapt. And the cloud pricing at $30/seat/mo puts it in SonarCloud territory: you're paying for the unified dashboard, not the analysis itself.

django-stubs2.0k★

Django leans hard on runtime magic. Models grow attributes you never declared, managers appear out of nowhere, Meta options reshape classes on the fly. That magic is also why a plain type checker throws up its hands on Django code. django-stubs is the fix: a full set of type hints plus a mypy plugin that actually understands the ORM, so your editor and your CI can catch a wrong field name or a bad query before it ships. Setup is trivial. It is a dev dependency you pip install and a few lines of mypy config. Nothing to host, nothing to run in production. It tracks current Django and Python versions, and there is a sibling project, djangorestframework-stubs, if you live in DRF. The whole thing is MIT and completely free. There is no paid tier and nothing gated. Solo devs, small teams, large teams: same deal, install it and move on. On Pyright instead of mypy you already get a lot of Django typing for free, so the value here is highest for mypy shops. The catch is the coupling. The mypy plugin is tied to specific mypy and Django versions, so a major upgrade on either side can mean waiting for the stubs to catch up before your type check goes green again.