restrict-dist-tags

This rule restricts npm dist-tags used in dependency declarations.

By default, it allows these commonly-used tags:

• latest
• dev
• next
• alpha
• beta
• canary
• rc

Any dist-tags not included in the allowed list are reported.

Note

This rule only checks bare dist-tag values. It ignores semver versions and ranges, workspace specifications, local paths, Git specifications, URLs, npm aliases, catalog specifications, and non-string dependency values.

❌ Incorrect

{
  "dependencies": {
    "package-a": "stable"
  }
}

✅ Correct

{
  "dependencies": {
    "package-a": "latest"
  }
}

Options

Name	Type	Default
allowed	string[]	Common npm dist-tags
allowedFor	('dependencies' | 'devDependencies' | 'optionalDependencies' | 'peerDependencies')[]	undefined (all dependency types)

allowed

Define the allowed dist-tags. Use an empty array to disallow all dist-tags.

export default [
  {
    'package-json/restrict-dist-tags': [
      'error',
      {
        allowed: ['rc'],
      },
    ],
  },
];

With this configuration, only rc is allowed (for all dependency types).

allowedFor

Limit the allowed dist-tags to specific dependency types. When omitted, allowed dist-tags apply to all dependency types. Use an empty array to disallow all dist-tags in every dependency type.

export default [
  {
    'package-json/restrict-dist-tags': [
      'error',
      {
        allowedFor: ['devDependencies'],
      },
    ],
  },
];

With this configuration, all common npm dist-tags are allowed in devDependencies, but any dist-tag is reported in dependencies, optionalDependencies, and peerDependencies.

You can also select multiple dependency types:

export default [
  {
    'package-json/restrict-dist-tags': [
      'error',
      {
        allowedFor: ['dependencies', 'devDependencies'],
      },
    ],
  },
];

When allowedFor contains dependency types, the specified dist-tags are allowed only for those types.

Examples

eslint.config.js

export default [
  {
    'package-json/restrict-dist-tags': [
      'error',
      {
        allowed: ['canary', 'rc'],
        allowedFor: ['devDependencies'],
      },
    ],
  },
];

❌ Incorrect

{
  "dependencies": {
    "package-a": "canary"
  },
  "devDependencies": {
    "package-b": "alpha"
  },
  "peerDependencies": {
    "package-c": "rc"
  }
}

✅ Correct

{
  "devDependencies": {
    "package-a": "canary",
    "package-b": "rc"
  }
}

Related Rules

• restrict-dependency-ranges - Restricts dependency semver range types.
• valid-dependencies - Enforces that the dependencies property is valid.
• valid-devDependencies - Enforces that the devDependencies property is valid.
• valid-peerDependencies - Enforces that the peerDependencies property is valid.

Further Reading

• npm: dist-tags
• npm: package spec