chore: migrate from ESLint to Oxlint

[AntonVishal]

why

Oxlint is a newer ESLint alternative with faster linting.

what changed

Configs and scripts updated to use Oxlint instead of ESLint. Root lint was 3.9s warm, now 0.5s so ~7× faster.

test plan

pnpm oxlint
pnpm lint

• Part 1: ESLint → Oxlint — you're here
• Part 2: Prettier → Oxfmt - chore: migrate from Prettier to Oxfmt #2303

---

Summary by cubic

Migrate the repo from eslint to oxlint to speed up linting. Lint at the root drops from ~3.9s warm to ~0.5s (~7× faster).

• Refactors

  • Replace eslint.config.mjs with .oxlintrc.json (root) and packages/cli/.oxlintrc.json.
  • Switch scripts from eslint to oxlint and add oxlint:fix across packages.
  • Keep security and TS rules via eslint-plugin-security, oxlint-plugin-eslint, and the typescript plugin; add explicit bans on the Function constructor (direct, window.Function, and globalThis.Function) for both call and new expressions.
  • Update deps: remove eslint, @eslint/js, and typescript-eslint; add oxlint and oxlint-plugin-eslint.
  • Update turbo.json to watch .oxlintrc.json files.

• Migration

  • pnpm install.
  • Use pnpm oxlint and pnpm oxlint:fix (or pnpm lint which now runs oxlint).
  • If your editor ran eslint, switch to the oxlint integration.

^{Written for commit 08936c9. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 08936c9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

This PR is from an external contributor and must be approved by a stagehand team member with write access before CI can run.
Approving the latest commit mirrors it into an internal PR owned by the approver.
If new commits are pushed later, the internal PR stays open but is marked stale until someone approves the latest external commit and refreshes it.

[cubic-dev-ai]

1 issue found across 11 files

Confidence score: 4/5

• In .oxlintrc.json, the custom no-restricted-syntax pattern appears to cover CallExpression but misses new window.Function(...) / new globalThis.Function(...), so dynamic code construction could slip past lint checks and weaken your intended security guardrail if merged as-is — extend the rule to also match NewExpression variants before merging.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant Turbo as Turbo Task Runner
    participant Oxlint as Oxlint CLI
    participant Config as .oxlintrc.json
    participant PkgConfig as packages/cli/.oxlintrc.json
    participant Plugins as Oxlint Plugins
    participant Files as Source Files
    participant Output as Terminal Output

    Note over Dev,Output: NEW: Linting flow after migrating from ESLint to Oxlint

    Dev->>Turbo: pnpm lint (or pnpm oxlint)
    Turbo->>Oxlint: Run oxlint . (per package)
    Oxlint->>Config: Load root configuration
    Config-->>Oxlint: Provide rules, plugins, env, ignores
    alt Package has own config (e.g., packages/cli)
        Oxlint->>PkgConfig: Load package-specific .oxlintrc.json
        PkgConfig-->>Oxlint: Extend root + overrides
    end
    Oxlint->>Plugins: Activate plugins (typescript, security, eslint-js)
    Plugins-->>Oxlint: Register rules
    Oxlint->>Files: Lint matching source files
    Files-->>Oxlint: File contents
    Oxlint->>Oxlint: Apply rules (e.g., no-eval, typescript/no-unused-vars)
    Oxlint-->>Output: Print lint results (errors, warnings)
    Output-->>Dev: See lint output in terminal

    Note over Dev,Output: ~7x faster than previous ESLint flow (0.5s vs 3.9s warm)

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>