no-restricted-modules

A project often has modules that some code shouldn't load, like a package that's been replaced, a Node.js module in code that also runs in the browser, or another package's internal files. This rule reports a require() of them.

The rule does nothing until you give it names. It only looks at require() with a fixed string. For import, use no-restricted-imports.

ESLint has deprecated this rule. Its replacement, n/no-restricted-require from eslint-plugin-n, isn't built into bun lint.

Examples

[lint.rules]
no-restricted-modules = ["error", "fs", {
  name = "request",
  message = "Use fetch().",
}]

Reported:

const fs = require("fs");
const request = require("request");

Not reported:

const path = require("path");
const promises = require("fs/promises");
const nodeFs = require("node:fs");
const plugin = require(pluginName);

A name must match the whole string, so "fs" doesn't cover "fs/promises" or "node:fs".

Options

Each option is a module name, or an object with a name and a message that's added to the report.

To use patterns, pass one object instead:

Option	Default	What it does
paths	[]	The list of modules, written as above.
patterns	[]	Patterns in .gitignore syntax. A pattern that starts with ! makes an exception to the ones before it.

With { paths: ["request"], patterns: ["lodash/*", "!lodash/fp"] }, these are reported:

const request = require("request");
const merge = require("lodash/merge");

And these aren't:

const lodash = require("lodash");
const fp = require("lodash/fp");