A mighty CSS linter that helps you avoid errors and enforce conventions.
Installations
npm install stylelintDeveloper Guide
Typescript
Yes
Module System
CommonJS, ESM
Min. Node Version
>=18.12.0
Node Version
22.11.0
NPM Version
10.9.1
Score
79.7
Supply Chain
98.3
Quality
92.5
Maintenance
100
Vulnerability
98.9
License
Releases
Contributors
Languages
JavaScript (99.18%)
CSS (0.52%)
TypeScript (0.17%)
SCSS (0.09%)
Shell (0.02%)
HTML (0.02%)
Developer
Download Statistics
Total Downloads
932,380,746
Last Day
247,368
Last Week
3,165,501
Last Month
19,554,202
Last Year
232,904,262
GitHub Statistics
11,084 Stars
7,099 Commits
939 Forks
101 Watching
14 Branches
402 Contributors
Sponsor this package
Maintainers
Package Meta Information
Latest Version
16.12.0
Package Id
stylelint@16.12.0
Unpacked Size
1.45 MB
Size
292.75 kB
File Count
621
NPM Version
10.9.1
Node Version
22.11.0
Publised On
15 Dec 2024
Total Downloads
Cumulative downloads
Total Downloads
932,380,746
Last day
-73%
247,368
Compared to previous day
Last week
-35.3%
3,165,501
Compared to previous week
Last month
-4.6%
19,554,202
Compared to previous month
Last year
13.1%
232,904,262
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
38
Dev Dependencies
44
Stylelint
A mighty CSS linter that helps you avoid errors and enforce conventions.
Features
It's mighty as it:
- has over 100 built-in rules for modern CSS syntax and features
- supports plugins so you can create your own custom rules
- automatically fixes problems where possible
- supports shareable configs that you can create or extend
- can be customized to your exact needs
- has 15k unit tests making it robust
- is trusted by companies worldwide like Google and GitHub
And it can be extended to:
- extract embedded styles from HTML, Markdown and CSS-in-JS template literals
- parse CSS-like languages like SCSS, Sass, Less and SugarSS
How it'll help you
It'll help you avoid errors, for example:
- invalid things, e.g. malformed grid areas
- valid things that are problematic, e.g. duplicate selectors
- unknown things, e.g. misspelled property names
And enforce conventions, for example:
- disallow things, e.g. specific units
- enforce naming patterns, e.g. for custom properties
- set limits, e.g. the number of ID selectors
- specify notations, e.g. for modern color functions
We recommend using a pretty printer like Prettier alongside Stylelint. Linters and pretty printers are complementary tools that work together to help you write consistent and error-free code.
Example output
Guides
- User guide
- Developer guide
- Migration guide
- Maintainer guide
- About
Contributors
Stylelint is maintained by volunteers. Without the code contributions from all these fantastic people, Stylelint would not exist. Become a contributor.
Alumni
We'd like to thank all past members for their invaluable contributions, including two of Stylelint's co-creators @davidtheclark and @MoOx.
Sponsors
Thank you to all our sponsors! Become a sponsor.
Backers
Thank you to all our backers! Become a backer.
Website hosting
License
Stable Version
Stable Version
16.12.0
LOW
1
0/10
Summary
Stylelint has vulnerability in semver dependency
Affected Versions
>= 8.0.0, < 15.10.1
Patched Versions
15.10.1
Reason
30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (29) are checked with a SAST tool
Reason
Found 18/19 approved changesets -- score normalized to 9
Reason
1 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/stylelint/.github/.github/SECURITY.md:1
- Warn: no linked content found
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/stylelint/.github/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/stylelint/.github/.github/SECURITY.md:1
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'main'
- Info: 'force pushes' disabled on branch 'main'
- Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'
- Warn: 'stale review dismissal' is disabled on branch 'main'
- Warn: required approving review count is 1 on branch 'main'
- Info: codeowner review is required on branch 'main'
- Warn: 'last push approval' is disabled on branch 'main'
- Warn: 'up-to-date branches' is disabled on branch 'main'
- Info: status check found to merge onto on branch 'main'
- Info: PRs are required in order to make changes on branch 'main'
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code-scanning.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/code-scanning.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code-scanning.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/code-scanning.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code-scanning.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/code-scanning.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/code-scanning.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/code-scanning.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preparing-github-release.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/preparing-github-release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/preparing-github-release.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/preparing-github-release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releasing.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/releasing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releasing.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/releasing.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/releasing.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/releasing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:86: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/testing.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/releasing.yml:36
- Warn: npmCommand not pinned by hash: .github/workflows/testing.yml:40
- Warn: npmCommand not pinned by hash: .github/workflows/testing.yml:71
- Warn: pipCommand not pinned by hash: .github/workflows/testing.yml:90
- Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 3 third-party GitHubAction dependencies pinned
- Info: 3 out of 6 npmCommand dependencies pinned
- Info: 0 out of 1 pipCommand dependencies pinned
Reason
badge detected: InProgress
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/code-scanning.yml:25
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/code-scanning.yml:26
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/preparing-github-release.yml:18
- Info: topLevel 'contents' permission set to 'read': .github/workflows/code-scanning.yml:17
- Warn: no topLevel permission defined: .github/workflows/commenting-on-old-issues.yml:1
- Warn: no topLevel permission defined: .github/workflows/preparing-github-release.yml:1
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/releasing.yml:9
- Warn: no topLevel permission defined: .github/workflows/testing.yml:1
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
6.6
/10
Last Scanned on 2024-12-16
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More