chore: replace ESLint with Oxlint

[Mrtenz]

This replaces ESLint with Oxlint, with the intention of matching the ESLint config as closely as possible.

Examples

MetaMask/core#10151

---

Note

Medium Risk
Large dev-tooling swap can change which issues CI catches versus ESLint, though application/runtime code is untouched.

Overview
Swaps the module template’s primary linter from ESLint to Oxlint, aligned with MetaMask’s shared @metamask/oxlint-config* packages.

eslint.config.mjs is removed and oxlint.config.ts is added with file-based overrides for TypeScript, CommonJS/Node (including scripts and .github), and Vitest/tests, plus type-aware linting via oxlint-tsgolint. lint / lint:fix now run lint:oxlint instead of lint:eslint, and Lavamoat script config is updated to match.

Dev dependencies drop the ESLint core stack (eslint, @metamask/eslint-config-*, typescript-eslint, import/jsdoc/prettier plugins, etc.) in favor of oxlint and the new config packages; eslint-plugin-n remains for the Node oxlint preset. .depcheckrc.json ignores are updated for the new tooling, and yarn.lock reflects the dependency tree change.

^{Reviewed by Cursor Bugbot for commit 5c914cf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​oxlint-config-commonjs@​0.1.1
	@​metamask/​oxlint-config-nodejs@​0.1.1
	@​metamask/​oxlint-config-vitest@​0.1.1
	@​metamask/​oxlint-config-typescript@​0.1.1
	@​metamask/​oxlint-config@​0.1.1
	oxlint@​1.83.0
	oxlint-tsgolint@​7.0.2002
	eslint-plugin-n@​17.12.0 ⏵ 18.3.0				+3

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit 5c914cf. Configure here.}

[cursor]

Depcheck ignores miss oxlint packages

Medium Severity

The ignore list dropped the eslint-plugin-* wildcard and never added oxlint-tsgolint, so eslint-plugin-n and oxlint-tsgolint look unused to depcheck. yarn lint:dependencies fails even though both packages are required peers of the oxlint configs.

 

^{Reviewed by Cursor Bugbot for commit 5c914cf. Configure here.}

[cursor]

Unused Vitest ESLint plugin remains

Low Severity

@vitest/eslint-plugin remains in devDependencies after the ESLint removal, but @metamask/oxlint-config-vitest does not depend on it, so the package is unused.

Additional Locations (1)

• .depcheckrc.json#L10-L11

 

^{Reviewed by Cursor Bugbot for commit 5c914cf. Configure here.}