Rule node/no-unpublished-require should ignore webpack config file

[sindresorhus]

I'm currently getting:

  webpack.config.js:3:25
  ✖    3:25  "webpack" is not published.                  node/no-unpublished-require
  ✖    4:31  "node-env-webpack-plugin" is not published.  node/no-unpublished-require
  ✖    5:28  "copy-webpack-plugin" is not published.      node/no-unpublished-require
  ✖    6:36  "clean-webpack-plugin" is not published.     node/no-unpublished-require

With v5.2.1

[mysticatea]

Thank you for this issue.

The webpack.config.js seems to be published by npm publish command and import packages from devDependencies. Do you have files field of package.json or .npmignore file?

https://github.com/mysticatea/eslint-plugin-node/blob/master/docs/rules/no-unpublished-require.md#rule-details

[sindresorhus]

No, I'm working on an app, not a module, so it makes no sense to use files or .npmignore.

Webpack is common enough, so IMHO, makes sense to make an exception for it, for convenience.

[mysticatea]

node/no-unpublished-require is a rule to prevent runtime errors (require("foo") imports not-published file or devDep package) after npm publish. If the package isn't intended to publish, I think better to disable the rule.

[mysticatea]

node/no-missing-require and node/no-extraneous-require rules will catch "Module not found" errors in local.

[sindresorhus]

I use the same config for modules and apps. I don’t see what’s wrong in the rule being a little bit smart. I rather just remove the rule from XO than turning it off manually in each app project.

[mysticatea]

The rule requires distinguishing published (production) files and dev files to work, and it's using files field and .npmignore to distinguish because those decide which files are published (production).

[mysticatea]

I won't add exceptions by file path into the rule because .eslintrc.* files have overrides config.

{
    "plugins": [ ... ],
    "rules": { ... },
    "overrides": [{
        "files": ["webpack.config.js", "test/**/*.js"],
        "rules": {
            "node/no-unpublished-require": "off"
        }
    }]
}

[sindresorhus]

That still requires specifying it manually.

[sholladay]

@sindresorhus I think you should reconsider not using files in your app. If for no other reason than to document which files are intended for production.

It's also functional in many cases, even for apps. For example, everything I deploy to now.sh uses files and they automatically figure out what to deploy based on that, which is awesome. Among other things, this ensures my .env files with secret keys don't get leaked to their cloud unencrypted. This is a huge deal for me, because on their OSS plan, they provide a /_src route to view the deployed code.