Bug: TypeError when using defineConfig with recommended preset

[andrew-pledge-io]

What version of eslint-plugin-security are you using?

3.0.1

ESLint Environment

Node version: v22.14.0
npm version: 10.9.2
Local ESLint version: v9.23.0
Global ESLint version: N/A
Operating System: MacOS

What did you do?

Using the recommended config as an element in defineConfig causes the following TypeScript error:

Type 'FlatConfig' is not assignable to type 'InfiniteArray<ConfigWithExtends>'.

Using the recommended config as an element in extends causes the following TypeScript error:

Type 'FlatConfig' is not assignable to type 'ExtendsElement'.

Config:

// @ts-check

import { defineConfig } from 'eslint/config';
import pluginSecurity from 'eslint-plugin-security';

export default defineConfig([
  pluginSecurity.configs.recommended,
  {
    extends: [
      pluginSecurity.configs.recommended,
    ],
  }
]);

[nzakas]

Thanks for the report. I think this is just because this plugin is referencing an older version of ESLint.

[nzakas]

I'm having some trouble reproducing this. Can you please create a repro case on StackBlitz?

[andrew-pledge-io]

Thanks for taking the time to look into it.

After digging in I've narrowed down the issue to my environment, so I'll close this.

The problem was that TypeScript was referencing global versions of @types/eslint-plugin-security and @types/eslint that had incorrect/mismatching versions (on MacOS these were installed at /Users/<user>/Library/Caches/typescript/5.8/node_modules/@types/eslint/index.d.ts)

I assume VSCode did this instead of just erroring since eslint.config.mjs isn't included in the TypeScript project in tsconfig.json but that's just a guess.

The fix was to install @types/eslint-plugin-security in my project which caused the correct versions of the types to be used.