{"id":13467117,"url":"https://github.com/quick-lint/quick-lint-js","last_synced_at":"2026-10-19T12:05:09.112Z","repository":{"id":37213132,"uuid":"252085348","full_name":"quick-lint/quick-lint-js","owner":"quick-lint","description":"quick-lint-js finds bugs in JavaScript programs","archived":false,"fork":false,"pushed_at":"2025-12-26T04:46:00.000Z","size":36137,"stargazers_count":1592,"open_issues_count":425,"forks_count":197,"subscribers_count":11,"default_branch":"master","last_synced_at":"2026-09-17T05:57:05.544Z","etag":null,"topics":["beginner-friendly","javascript","linter","parser"],"latest_commit_sha":null,"homepage":"https://quick-lint-js.com","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/quick-lint.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":["quick-lint"]}},"created_at":"2020-04-01T05:57:50.000Z","updated_at":"2026-09-13T13:40:16.000Z","dependencies_parsed_at":"2023-10-15T01:29:17.464Z","dependency_job_id":"c338232d-c7f5-4bcc-aaf1-2d7522339895","html_url":"https://github.com/quick-lint/quick-lint-js","commit_stats":null,"previous_names":[],"tags_count":34,"template":false,"template_full_name":null,"purl":"pkg:github/quick-lint/quick-lint-js","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quick-lint%2Fquick-lint-js","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quick-lint%2Fquick-lint-js/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quick-lint%2Fquick-lint-js/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quick-lint%2Fquick-lint-js/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/quick-lint","download_url":"https://codeload.github.com/quick-lint/quick-lint-js/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quick-lint%2Fquick-lint-js/sbom","scorecard":{"id":755799,"data":{"date":"2025-08-11","repo":{"name":"github.com/quick-lint/quick-lint-js","commit":"e1a5cf07e5a31c63c4e6a736a303e6ce6be93264"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.9,"checks":[{"name":"Maintained","score":10,"reason":"16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":0,"reason":"Found 1/30 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: COPYING:0","Info: FSF or OSI recognized license: GNU General Public License v3.0: COPYING:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/arch-linux-package.yml:1","Warn: no topLevel permission defined: .github/workflows/build-and-test-dev-env-nix.yml:1","Warn: no topLevel permission defined: .github/workflows/build-and-test-dev.yml:1","Warn: no topLevel permission defined: .github/workflows/build-and-test-plugin-vscode.yml:1","Warn: no topLevel permission defined: .github/workflows/build-and-test.yml:1","Warn: no topLevel permission defined: .github/workflows/build-static.yml:1","Warn: no topLevel permission defined: .github/workflows/build-website.yml:1","Warn: no topLevel permission defined: .github/workflows/check-copyright.yml:1","Warn: no topLevel permission defined: .github/workflows/check-error-docs.yml:1","Warn: no topLevel permission defined: .github/workflows/check-format.yml:1","Warn: no topLevel permission defined: .github/workflows/ci-self-check.yml:1","Warn: no topLevel permission defined: .github/workflows/cla.yml:1","Warn: no topLevel permission defined: .github/workflows/debian-package.yml:1","Warn: no topLevel permission defined: .github/workflows/simple-build.yml:1","Warn: no topLevel permission defined: .github/workflows/tag-build.yml:1","Warn: no topLevel permission defined: .github/workflows/test-emacs-plugin.yml:1","Warn: no topLevel permission defined: .github/workflows/test-homebrew-package.yml:1","Warn: no topLevel permission defined: .github/workflows/test-install.yml:1","Warn: no topLevel permission defined: .github/workflows/test-nix-install.yml:1","Warn: no topLevel permission defined: .github/workflows/test-vim-plugin.yml:1","Warn: no topLevel permission defined: .github/workflows/unvendored.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: CppLibFuzzer integration found: fuzz/fuzz-configuration-json.cpp:13","Info: CppLibFuzzer integration found: fuzz/fuzz-lex.cpp:12","Info: CppLibFuzzer integration found: fuzz/fuzz-lsp-message-parser.cpp:23","Info: CppLibFuzzer integration found: fuzz/fuzz-lsp-server.cpp:45","Info: CppLibFuzzer integration found: fuzz/fuzz-options.cpp:13","Info: CppLibFuzzer integration found: fuzz/fuzz-parse-lint.cpp:14","Info: CppLibFuzzer integration found: fuzz/fuzz-parse.cpp:12","Info: CppLibFuzzer integration found: fuzz/fuzz-utf-8-decode-encode.cpp:13","Info: CppLibFuzzer integration found: fuzz/fuzz-utf-8-lsp.cpp:13"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 1 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":6,"reason":"dependency not pinned by hash detected -- score normalized to 6","details":["Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-baseline-builder/Dockerfile:1: pin your Docker image by updating debian:buster to debian:buster@sha256:58ce6f1271ae1c8a2006ff7d3e54e9874d839f573d8009c20154ad0f2fb0a225","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-builder-aarch64/Dockerfile:1: pin your Docker image by updating debian:buster to debian:buster@sha256:58ce6f1271ae1c8a2006ff7d3e54e9874d839f573d8009c20154ad0f2fb0a225","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-clang-format/Dockerfile:2","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-clang-format/Dockerfile:32: pin your Docker image by updating alpine:3.17 to alpine:3.17@sha256:8fc3dacfb6d69da8d44e42390de777e48577085db99aa4e4af35f483eb08b989","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-clang/Dockerfile:1: pin your Docker image by updating debian:bullseye to debian:bullseye@sha256:8ec25a9073e8cc89a184a6256e219828196d75203375a8ad4f0977f3011f2115","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-cross-builder/Dockerfile:1: pin your Docker image by updating ubuntu:20.04 to ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-emacs/Dockerfile:1: pin your Docker image by updating ghcr.io/quick-lint/quick-lint-js-github-gcc:v1 to ghcr.io/quick-lint/quick-lint-js-github-gcc:v1@sha256:f6aaa3122a1f6bf9715f42a7ffa9f8ba8743c71d03101f182c7a17b82728d3b8","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-gcc/Dockerfile:1: pin your Docker image by updating debian:bullseye to debian:bullseye@sha256:8ec25a9073e8cc89a184a6256e219828196d75203375a8ad4f0977f3011f2115","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-go-builder/Dockerfile:1: pin your Docker image by updating golang:1.17-alpine to golang:1.17-alpine@sha256:99ddec1bbfd6d6bca3f9804c02363daee8c8524dae50df7942e8e60788fd17c9","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-mingw-builder/Dockerfile:2","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-mingw-builder/Dockerfile:40: pin your Docker image by updating ubuntu:20.04 to ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-vim/Dockerfile:1: pin your Docker image by updating debian:bullseye to debian:bullseye@sha256:8ec25a9073e8cc89a184a6256e219828196d75203375a8ad4f0977f3011f2115","Warn: containerImage not pinned by hash: .github/docker/quick-lint-js-github-website-builder/Dockerfile:1: pin your Docker image by updating ubuntu:20.04 to ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214","Warn: containerImage not pinned by hash: dist/arch/Dockerfile:4: pin your Docker image by updating archlinux:base to archlinux:base@sha256:104d24b4464e89a16566d3e68ce0e2707aa15258c690ee9bef755930e8bc1c2d","Warn: npmCommand not pinned by hash: .github/docker/quick-lint-js-github-website-builder/Dockerfile:27","Warn: npmCommand not pinned by hash: tools/run-benchmarks-straglum.sh:17","Warn: npmCommand not pinned by hash: tools/test-all-js-engines:27","Info:  75 out of  75 GitHub-owned GitHubAction dependencies pinned","Info:  18 out of  18 third-party GitHubAction dependencies pinned","Info:   0 out of  14 containerImage dependencies pinned","Info:   1 out of   4 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Vulnerabilities","score":0,"reason":"38 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv","Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw","Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx","Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v","Warn: Project is vulnerable to: GHSA-52f5-9888-hmc6","Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc","Warn: Project is vulnerable to: GHSA-6p56-wp2h-9hxr","Warn: Project is vulnerable to: GHSA-fpfv-jqm9-f5jm","Warn: Project is vulnerable to: PYSEC-2023-102","Warn: Project is vulnerable to: PYSEC-2023-114","Warn: Project is vulnerable to: CVE-2023-2905","Warn: Project is vulnerable to: CVE-2023-34188","Warn: Project is vulnerable to: CVE-2024-42383","Warn: Project is vulnerable to: CVE-2024-42384","Warn: Project is vulnerable to: CVE-2024-42385","Warn: Project is vulnerable to: CVE-2024-42386","Warn: Project is vulnerable to: CVE-2024-42387","Warn: Project is vulnerable to: CVE-2024-42388","Warn: Project is vulnerable to: CVE-2024-42389","Warn: Project is vulnerable to: CVE-2024-42390","Warn: Project is vulnerable to: CVE-2024-42391","Warn: Project is vulnerable to: CVE-2024-42392","Warn: Project is vulnerable to: OSV-2022-937","Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36","Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7","Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x","Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc","Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx","Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j","Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w","Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg","Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p","Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q","Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6","Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-22T21:38:45.646Z","repository_id":37213132,"created_at":"2025-08-22T21:38:45.646Z","updated_at":"2025-08-22T21:38:45.646Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38356448,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-19T02:00:06.414Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["beginner-friendly","javascript","linter","parser"],"created_at":"2024-07-31T15:00:53.280Z","updated_at":"2026-10-19T12:05:07.817Z","avatar_url":"https://github.com/quick-lint.png","language":"C++","funding_links":["https://github.com/sponsors/quick-lint"],"categories":["C++","打包工具"],"sub_categories":["非 JavaScript 编译工具"],"readme":"# \u003cimg src=\"dist/artwork/dusty-right.svg\" alt=\"\" title=\"Dusty, the quick-lint-js mascot\" width=\"46.4\" height=\"36\" align=\"top\"\u003e quick-lint-js\n\nquick-lint-js finds bugs in JavaScript programs.\n\nquick-lint-js finds many bugs, including:\n\n* Using a variable which does not exist\n* Assigning to a `const` variable\n* Using `await` in a non-`async` function\n* Syntax errors\n\n![Demonstration of quick-lint-js in Visual Studio Code](plugin/vscode/demo.webp)\n\n## Installing\n\nThere are many ways to install quick-lint-js, depending on how you prefer to\nwork! Here are the environments we support:\n\n- CLI (Command-Line Interface)\n- LSP (Language Server Protocol)\n- Editor Plugins for:\n  - Visual Studio Code (VSCode)\n  - VSCodium\n  - Vim/Neovim\n  - Sublime Text\n  - Emacs\n  - Kate\n\nFor detailed installation instructions, visit the [quick-lint-js installation\nguide](https://quick-lint-js.com/install/).\n\n## Examples\n\nHere are some common bugs that quick-lint-js can catch:\n\n### Example 1: Undefined Variable\n\n```js\nconst occupation = \"Engineer\";\nconsole.log(\"Welcome, \" + ocupation); // Typo: 'ocupation' should be 'occupation'\n```\nOutput: `use of undeclared variable: ocupation`\n\n### Example 2: Reassigning a const variable\n\n```js\nconst name = \"John\";\nname = \"Doe\"; // Error: Cannot reassign a constant\n```\nOutput: `assignment to const variable: name`\n\n### Example 3: Using await in a non-async function\n\n```js\nfunction getData() {\n  await fetch(\"/data\");\n}\n```\nOutput: `await used in non-async function`\n\nThese are just a few examples of how quick-lint-js can help identify common\nissues in your JavaScript code.\n\n## Contributing\n\nWe’re always happy to welcome new contributors! If you’d like to contribute to\nquick-lint-js, please refer to the contributing guide on our website for all the\ndetails.\n\nCheck out the [contributing guide here](https://quick-lint-js.com/contribute/).\n\n## Contact\n\nIf you have any questions or feedback, feel free to reach out:\n\n- **Bugs and feature requests**: File an issue on GitHub.\n- **IRC**: Ask questions in the [#quick-lint-js][quick-lint-js-irc-web] channel\n  on Libera.Chat.\n- **Security bug reports** (private disclosure): Email us at\n  [strager.nds@gmail.com](mailto:strager.nds@gmail.com).\n\n[quick-lint-js-irc-web]: https://kiwiirc.com/nextclient/irc.libera.chat/#quick-lint-js\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquick-lint%2Fquick-lint-js","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fquick-lint%2Fquick-lint-js","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquick-lint%2Fquick-lint-js/lists"}