Gathering detailed insights and metrics for stylelint
Gathering detailed insights and metrics for stylelint
A mighty CSS linter that helps you avoid errors and enforce conventions.
Installations
npm install stylelintDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS, ESM
Min. Node Version
>=18.12.0
Node Version
23.11.0
NPM Version
11.3.0
Score
90.5
Supply Chain
98.3
Quality
94.7
Maintenance
100
Vulnerability
98.9
License
Releases
245
Languages
7
JavaScript
CSS
TypeScript
SCSS
HTML
Shell
Less
JavaScript (99%)
CSS (0.64%)
TypeScript (0.21%)
SCSS (0.11%)
HTML (0.03%)
Shell (0.02%)
Developer
Download Statistics
Total Downloads
1,028,369,708
Last Day
980,949
Last Week
5,219,434
Last Month
22,890,197
Last Year
246,637,883
GitHub Statistics
MIT License
11,241 Stars
7,332 Commits
965 Forks
98 Watchers
13 Branches
408 Contributors
Updated on May 08, 2025
Sponsor this package
Maintainers
7
Package Meta Information
Latest Version
16.19.1
Package Id
stylelint@16.19.1
Unpacked Size
1.57 MB
Size
316.39 kB
File Count
659
NPM Version
11.3.0
Node Version
23.11.0
Published on
Apr 25, 2025
Total Downloads
Cumulative downloads
Total Downloads
1,028,369,708
Last Day
47.2%
980,949
Compared to previous day
Last Week
2%
5,219,434
Compared to previous week
Last Month
-5.8%
22,890,197
Compared to previous month
Last Year
14.8%
246,637,883
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
38
@csstools/css-parser-algorithms@csstools/css-tokenizer@csstools/media-query-list-parser@csstools/selector-specificity@dual-bundle/import-meta-resolvebalanced-matchcolordcosmiconfigcss-functions-listcss-treedebugfast-globfastest-levenshteinfile-entry-cacheglobal-modulesglobbyglobjoinhtml-tagsignoreimurmurhashis-plain-objectknown-css-propertiesmathml-tag-namesmeowmicromatchnormalize-pathpicocolorspostcsspostcss-resolve-nested-selectorpostcss-safe-parserpostcss-selector-parserpostcss-value-parserresolve-fromstring-widthsupports-hyperlinkssvg-tagstablewrite-file-atomic
Dev Dependencies
45
@changesets/cli@changesets/get-github-info@jest/globals@stylelint/prettier-config@stylelint/remark-preset@types/balanced-match@types/css-tree@types/debug@types/file-entry-cache@types/global-modules@types/globjoin@types/imurmurhash@types/micromatch@types/normalize-path@types/postcss-less@types/postcss-resolve-nested-selector@types/postcss-safe-parser@types/svg-tags@types/write-file-atomicbenchmarkcommon-tagsdeepmergeeslinteslint-config-stylelinteslint-plugin-importeslint-plugin-jesthuskyjestjest-preset-stylelintjest-watch-typeaheadlint-stagedlz-stringnpnpm-run-allpatch-packagepostcss-htmlpostcss-importpostcss-lesspostcss-sasspostcss-scssprettierremark-clirollupsugarsstypescript
Stylelint
A mighty CSS linter that helps you avoid errors and enforce conventions.
Features
It's mighty as it:
- has over 100 built-in rules for modern CSS syntax and features
- supports plugins so you can create your own custom rules
- automatically fixes problems where possible
- supports shareable configs that you can create or extend
- can be customized to your exact needs
- has 15k unit tests making it robust
- is trusted by companies worldwide like Google and GitHub
And it can be extended to:
- extract embedded styles from HTML, Markdown and CSS-in-JS template literals
- parse CSS-like languages like SCSS, Sass, Less and SugarSS
How it'll help you
It'll help you avoid errors, for example:
- invalid things, e.g. malformed grid areas
- valid things that are problematic, e.g. duplicate selectors
- unknown things, e.g. misspelled property names
And enforce conventions, for example:
- disallow things, e.g. specific units
- enforce naming patterns, e.g. for custom properties
- set limits, e.g. the number of ID selectors
- specify notations, e.g. for modern color functions
We recommend using a pretty printer like Prettier alongside Stylelint. Linters and pretty printers are complementary tools that work together to help you write consistent and error-free code.
Example output
Guides
- User guide
- Developer guide
- Migration guide
- Maintainer guide
- About
Contributors
Stylelint is maintained by volunteers. Without the code contributions from all these fantastic people, Stylelint would not exist. Become a contributor.
Alumni
We'd like to thank all past members for their invaluable contributions, including two of Stylelint's co-creators @davidtheclark and @MoOx.
Sponsors
Thank you to all our sponsors! Become a sponsor.
Backers
Thank you to all our backers! Become a backer.
Website hosting
License
Low
0/10
Summary
Stylelint has vulnerability in semver dependency
Affected Versions
>= 8.0.0, < 15.10.1
Patched Versions
15.10.1
Reason
30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
no binaries found in the repo
Reason
SAST tool is not run on all commits -- score normalized to 9
Details
- Warn: 27 commits out of 28 are checked with a SAST tool
Reason
Found 16/18 approved changesets -- score normalized to 8
Reason
2 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Reason
dependency not pinned by hash detected -- score normalized to 5
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new-comment.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new-comment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new-comment.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new-comment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new-comment.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new-comment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new-comment.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new-comment.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pkg.pr.new.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/pkg.pr.new.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preparing-github-release.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/preparing-github-release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releasing.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/releasing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releasing.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/releasing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/testing.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/stylelint/stylelint/testing.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/releasing.yml:36
- Warn: npmCommand not pinned by hash: .github/workflows/testing.yml:74
- Warn: pipCommand not pinned by hash: .github/workflows/testing.yml:93
- Warn: npmCommand not pinned by hash: .github/workflows/testing.yml:43
- Info: 0 out of 16 GitHub-owned GitHubAction dependencies pinned
- Info: 3 out of 3 third-party GitHubAction dependencies pinned
- Info: 5 out of 8 npmCommand dependencies pinned
- Info: 0 out of 1 pipCommand dependencies pinned
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'main'
- Info: 'force pushes' disabled on branch 'main'
- Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'
- Warn: 'stale review dismissal' is disabled on branch 'main'
- Warn: required approving review count is 1 on branch 'main'
- Info: codeowner review is required on branch 'main'
- Warn: 'last push approval' is disabled on branch 'main'
- Warn: 'up-to-date branches' is disabled on branch 'main'
- Info: status check found to merge onto on branch 'main'
- Info: PRs are required in order to make changes on branch 'main'
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/stylelint/.github/.github/SECURITY.md:1
- Warn: no linked content found
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/stylelint/.github/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/stylelint/.github/.github/SECURITY.md:1
Reason
badge detected: InProgress
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/preparing-github-release.yml:18
- Warn: no topLevel permission defined: .github/workflows/commenting-on-old-issues.yml:1
- Warn: no topLevel permission defined: .github/workflows/preparing-github-release.yml:1
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/releasing.yml:9
- Info: topLevel 'contents' permission set to 'read': .github/workflows/testing.yml:14
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
6.5
/10
Last Scanned on 2025-04-28
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More