\n\n---\n\n\n\n## About\n\nSherif is an opinionated, zero-config linter for TypeScript & JavaScript monorepos. It runs fast in any monorepo and enforces rules to provide a better, standardized DX.\n\n## Features\n\n- ✨ **PNPM, Bun, NPM, Yarn...**: sherif works with all package managers\n- 🔎 **Zero-config**: it just works and prevents regressions\n- ⚡ **Fast**: doesn't need `node_modules` installed, written in 🦀 Rust\n\n## Installation\n\nRun `sherif` in the root of your monorepo to list the found issues. By default, any error will cause Sherif to [exit with a code 1](#exit-code):\n\n```bash\n# PNPM\npnpm dlx sherif@latest\n# Bun\nbunx sherif@latest\n# NPM\nnpx sherif@latest\n# Yarn\nyarn dlx sherif@latest\n```\n\nWe recommend running Sherif in your CI once [all errors are fixed](#autofix). Run it by **specifying a version instead of latest**. This is useful to prevent regressions (e.g. when adding a library to a package but forgetting to update the version in other packages of the monorepo).\n\nWhen using the GitHub Action, it will search for a `sherif` script in the root `package.json` and use the same arguments automatically to avoid repeating them twice. You can override this behaviour with the `args` parameter.\n\n\n\nGitHub Actions example\n\n```yaml\n# Using the `QuiiBz/sherif` action\nname: Sherif\non:\n pull_request:\njobs:\n check:\n name: Run Sherif\n runs-on: ubuntu-22.04\n steps:\n - uses: actions/checkout@v4\n - uses: QuiiBz/sherif@v1\n # Optionally, you can specify a version and arguments to run Sherif with:\n # with:\n # version: 'v1.13.0'\n # args: '--ignore-rule root-package-manager-field'\n\n# Using `npx` to run Sherif\nname: Sherif\non:\n pull_request:\njobs:\n check:\n name: Run Sherif\n runs-on: ubuntu-22.04\n steps:\n - uses: actions/checkout@v4\n - uses: actions/setup-node@v3\n with:\n node-version: 24\n - run: npx sherif@1.13.0\n```\n\n\n\n## Autofix\n\nMost issues can be automatically fixed by using the `--fix` (or `-f`) flag. Sherif will automatically run your package manager's `install` command (see [No-install mode](#no-install-mode) to disable this behavior) to update the lockfile. Note that autofix is disabled in CI environments (when `$CI` is set):\n\n```bash\nsherif --fix\n```\n\n### Autofixing the [`multiple-dependency-versions`](#multiple-dependency-versions-) rule\n\nBy default, running `--fix` with the `multiple-dependency-versions` rule will ask you to select which version to use for each dependency with multiple versions across the monorepo. If that doesn't work for you (e.g., you are running Sherif in a non-interactive environment), you can use the `--select` (of `-s`) flag to automatically select the highest or lowest version of every dependency:\n\n```bash\n# Autofix and select the highest version for each dependency matching the `multiple-dependency-versions` rule\nsherif --fix --select highest\n```\n\n### No-install mode\n\nIf you don't want Sherif to run your packager manager's `install` command after running autofix, you can use the `--no-install` flag:\n\n```bash\n# Autofix without running the package manager's install command\nsherif --fix --no-install\n```\n\n## Exit code\n\nBy default, Sherif will exit with code `1` if any error issues are found. If you only have warning issues or no issues at all, Sherif will exit with code `0`. You can change this behavior to always exit with code `1` if any issues are found, including warnings, by using the `--fail-on-warnings` option.\n\n## Rules\n\nYou can ignore a specific rule by using `--ignore-rule ` (or `-r `):\n\n```bash\n# Ignore both rules\nsherif -r packages-without-package-json -r root-package-manager-field\n```\n\nYou can ignore all issues in a package by using `--ignore-package ` (or `-p `):\n\n```bash\n# Ignore all issues in the `@repo/tools` package\nsherif -p @repo/tools\n# Ignore all issues for packages inside `./integrations/*`\nsherif -p \"./integrations/*\"\n```\n\n#### `empty-dependencies` ❌\n\n`package.json` files should not have empty dependencies fields.\n\n#### `multiple-dependency-versions` ❌\n\nA given dependency should use the same version across the monorepo.\n\nYou can ignore this rule for a specific dependency and version or all versions of a dependency if it's expected in your monorepo by using `--ignore-dependency ` / `--ignore-dependency ` (or `-i ` / `-i `):\n\n```bash\n# Ignore only the specific dependency version mismatch\nsherif -i react@17.0.2 -i next@13.2.4\n\n# Ignore all versions mismatch of dependencies that start with @next/\nsherif -i @next/*\n\n# Completely ignore all versions mismatch of these dependencies\nsherif -i react -i next\n```\n\n#### `unsync-similar-dependencies` ❌\n\nSimilar dependencies in a given `package.json` should use the same version. For example, if you use both `react` and `react-dom` dependencies in the same `package.json`, this rule will enforce that they use the same version.\n\n\n\nList of detected similar dependencies\n\n- `react`, `react-dom`\n- `eslint-config-next`, `@next/eslint-plugin-next`, `@next/font` `@next/bundle-analyzer`, `@next/third-parties`, `@next/mdx`, `next`\n- `@trpc/client`, `@trpc/server`, `@trpc/next`, `@trpc/react-query`\n- `eslint-config-turbo`, `eslint-plugin-turbo`, `@turbo/gen`, `turbo-ignore`, `turbo`\n- `sb`, `storybook`, `@storybook/codemod`, `@storybook/cli`, `@storybook/channels`, `@storybook/addon-actions`, `@storybook/addon-links`, `@storybook/react`, `@storybook/react-native`, `@storybook/components`, `@storybook/addon-backgrounds`, `@storybook/addon-viewport`, `@storybook/angular`, `@storybook/addon-a11y`, `@storybook/addon-jest`, `@storybook/client-logger`, `@storybook/node-logger`, `@storybook/core`, `@storybook/addon-storysource`, `@storybook/html`, `@storybook/core-events`, `@storybook/svelte`, `@storybook/ember`, `@storybook/addon-ondevice-backgrounds`, `@storybook/addon-ondevice-notes`, `@storybook/preact`, `@storybook/theming`, `@storybook/router`, `@storybook/addon-docs`, `@storybook/addon-ondevice-actions`, `@storybook/source-loader`, `@storybook/preset-create-react-app`, `@storybook/web-components`, `@storybook/addon-essentials`, `@storybook/server`, `@storybook/addon-toolbars`, `@storybook/addon-controls`, `@storybook/core-common`, `@storybook/builder-webpack5`, `@storybook/core-server`, `@storybook/csf-tools`, `@storybook/addon-measure`, `@storybook/addon-outline`, `@storybook/addon-ondevice-controls`, `@storybook/instrumenter`, `@storybook/addon-interactions`, `@storybook/docs-tools`, `@storybook/builder-vite`, `@storybook/telemetry`, `@storybook/core-webpack`, `@storybook/preset-html-webpack`, `@storybook/preset-preact-webpack`, `@storybook/preset-svelte-webpack`, `@storybook/preset-react-webpack`, `@storybook/html-webpack5`, `@storybook/preact-webpack5`, `@storybook/svelte-webpack5`, `@storybook/web-components-webpack5`, `@storybook/preset-server-webpack`, `@storybook/react-webpack5`, `@storybook/server-webpack5`, `@storybook/addon-highlight`, `@storybook/blocks`, `@storybook/builder-manager`, `@storybook/react-vite`, `@storybook/svelte-vite`, `@storybook/web-components-vite`, `@storybook/nextjs`, `@storybook/types`, `@storybook/manager`, `@storybook/csf-plugin`, `@storybook/preview`, `@storybook/manager-api`, `@storybook/preview-api`, `@storybook/html-vite`, `@storybook/sveltekit`, `@storybook/preact-vite`, `@storybook/addon-mdx-gfm`, `@storybook/react-dom-shim`, `create-storybook`, `@storybook/addon-onboarding`, `@storybook/react-native-theming`, `@storybook/addon-themes`, `@storybook/test`, `@storybook/react-native-ui`, `@storybook/experimental-nextjs-vite`, `@storybook/experimental-addon-test`, `@storybook/react-native-web-vite`\n- `prisma`, `@prisma/client`, `@prisma/instrumentation`\n- `typescript-eslint`, `@typescript-eslint/eslint-plugin`, `@typescript-eslint/parser`\n- `@stylistic/eslint-plugin-js`, `@stylistic/eslint-plugin-ts`, `@stylistic/eslint-plugin-migrate`, `@stylistic/eslint-plugin`, `@stylistic/eslint-plugin-jsx`, `@stylistic/eslint-plugin-plus`\n- `playwright`, `@playwright/test`\n\n\n\n#### `non-existant-packages` ⚠️\n\nAll paths defined in the workspace (the root `package.json`' `workspaces` field or `pnpm-workspace.yaml`) should match at least one package.\n\n#### `packages-without-package-json` ⚠️\n\nAll packages matching the workspace (the root `package.json`' `workspaces` field or `pnpm-workspace.yaml`) should have a `package.json` file.\n\n#### `root-package-dependencies` ⚠️\n\nThe root `package.json` is private, so making a distinction between `dependencies` and `devDependencies` is useless - only use `devDependencies`.\n\n#### `root-package-manager-field` ❌\n\nThe root `package.json` should specify the package manager and version to use, either via the `packageManager` field or the `devEngines.packageManager` field. Useful for tools like corepack.\n\n#### `root-package-private-field` ❌\n\nThe root `package.json` should be private to prevent accidentaly publishing it to a registry.\n\n#### `types-in-dependencies` ❌\n\nPrivate packages shouldn't have `@types/*` in `dependencies`, since they don't need it at runtime. Move them to `devDependencies`.\n\n#### `unordered-dependencies` ❌\n\nDependencies should be ordered alphabetically to prevent complex diffs when installing a new dependency via a package manager.\n\n## Configuration\n\nWhen using many CLI arguments, it might be easier to move to the configuration format. In your root `package.json`, add a `sherif` field containing the same options as the CLI, but in camelCase. Default values are shown below:\n\n```jsonc\n{\n \"sherif\": {\n \"fix\": false,\n \"select\": \"highest\", // \"highest\" | \"lowest\"\n \"noInstall\": false,\n \"failOnWarnings\": false,\n \"ignoreDependency\": [], // string[]\n \"ignorePackage\": [], // string[]\n \"ignoreRule\": [] // string[]\n }\n}\n```\n\nWhen using both the configuration in the root `package.json` and CLI arguments, the CLI arguments will take precedence.\n\n## Credits\n\n- [dedubcheck](https://github.com/innovatrics/dedubcheck) that given me the idea for Sherif\n- [Manypkg](https://github.com/Thinkmill/manypkg) for some of their rules\n- [This article](https://blog.orhun.dev/packaging-rust-for-npm/) for the Rust releases on NPM\n\n## Sponsors\n\n\n\n## License\n\n[MIT](./LICENSE)\n","readmeFilename":"README.md"}
![\"\"](\"https://github.com/QuiiBz/sherif/blob/main/assets/logo.png\"){kind=logo}
\n