react/jsx-no-script-url

A javascript: URL runs its text as code when someone follows the link. That's a common way to inject a script into a page, and React 19 blocks these URLs. Use an event handler instead.

By default the rule looks at the href of <a>. It only sees URLs written as a plain string, not values in braces.

Configure

Off by default. To turn it on:

[lint.rules]
"react/jsx-no-script-url" = "error" # or "warn"

Every option, set to its default:

[lint.rules]
"react/jsx-no-script-url" = ["error", {
  includeFromSettings = false,
}]

Examples

Reported:

const close = <a href="javascript:closeDialog()">Close</a>;

Not reported:

const close = <button onClick={closeDialog}>Close</button>;

const home = <a href="/home">Home</a>;

Options

The first option is a list of your own link components and the props that hold a URL:

[lint.rules]
"react/jsx-no-script-url" = ["error", [{ name = "Link", props = ["to"] }]]

const close = <Link to="javascript:closeDialog()">Close</Link>;

You can pass an object after the list, or instead of it: