Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deep freeze flat config in defineFlatConfig #264

Open
privatenumber opened this issue Dec 8, 2023 · 2 comments
Open

Deep freeze flat config in defineFlatConfig #264

privatenumber opened this issue Dec 8, 2023 · 2 comments

Comments

@privatenumber
Copy link

Flat configs should be deep frozen so they can't be mutated. For example:
https://github.com/eslint/eslint/blob/4391b71e62b15e54b0493f0dce1ea053ebbc0689/packages/js/src/configs/eslint-recommended.js#L12

Because the config is now flat and config extending happens in user-land, users may try to extend a config by mutating the actual object. Allowing mutation will cause unexpected behavior in complex configurations where multiple config/plugins depend on a shared config.

I think defineFlatConfig is a good place to freeze the config.

@Shinigami92
Copy link
Collaborator

I'm not sure if this should be done by eslint-define-config

You can easily do this by yourself via wrapping the defineFlatConfig call with Object.freeze

@privatenumber
Copy link
Author

Object.freeze would need to be applied recursively. And in the recursion, you also have to handle cyclic relationships.

But my motivation is not actually about reducing code. While the convenience of automatic freezing would be appreciated, I see it more as a holistic approach—sealing the config is a finalizing step in the process of creating it.

The benefits extend beyond to safeguarding the config and, by extension, the end-user. Preventing the possibility of config mutation is a proactive measure against unexpected behaviors.

Considering that many config authors may overlook this step, I think this could be a great place to provide the safeguard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants