# Linters A linter scans source a file at a time, matching it against a rule set of suspicious patterns and reporting likely bugs. It is the cheap, high-volume end of [static analysis](https://quality.stereobooster.com/static-analysis.md), fast enough to run on every save and every diff and tuned to keep false positives low. Only the *logical* rules do verification work; a linter's *stylistic* and *formatting* rules are hygiene, better delegated to a formatter. ## What it catches - **Common defect patterns.** Off-by-one, missing `await`, inconsistent equality, suspicious type cast. - **API misuse.** Calling a deprecated function, passing the wrong type, ignoring a required return value, misusing a standard-library contract. Several defect classes have their own [static-analysis](https://quality.stereobooster.com/static-analysis.md) page even where a lint rule is what ships the check. Taint, secrets, and regular-expression denial of service (ReDoS) are on [deep static analysis](https://quality.stereobooster.com/deep-static-analysis.md). Every kind of dead code is on [dead-code detection](https://quality.stereobooster.com/dead-code-detection.md). Memory-safety and concurrency depth is on [memory safety](https://quality.stereobooster.com/memory.md) and [concurrency](https://quality.stereobooster.com/concurrency.md). ## Tools ### JavaScript / TypeScript - **[ESLint](https://quality.stereobooster.com/eslint.md)** with the typescript-eslint *logical* subset enabled; the *stylistic* and *formatting* subsets go to Prettier. - **[Biome](https://biomejs.dev/)** as a faster ESLint+Prettier alternative. ### Python - **[Ruff](https://docs.astral.sh/ruff/)** — fast, covers a broad rule set, replacing flake8 + many plugins. - **[pylint](https://pylint.readthedocs.io/)** — slower, more checks, harder to configure. - **[Bandit](https://bandit.readthedocs.io/)** — security-focused rules. ### Rust - **[Clippy](https://github.com/rust-lang/rust-clippy)** — built into the Rust toolchain. The Clippy adoption study found ~21 warnings per thousand lines of code on average across crates.io (Li et al. 2024)[^li2024]. - **cargo-audit** for dependencies with known vulnerabilities. ### Java / Kotlin - **[SpotBugs](https://spotbugs.github.io/)** (successor to FindBugs). - **[Error Prone](https://errorprone.info/)** (Google) — runs as a compiler plugin. ### C / C++ - **Coverity** (commercial) — a widely deployed commercial tool; a large-scale retrospective covers it (Bessey et al. 2010)[^bessey2010]. - **[clang-tidy](https://clang.llvm.org/extra/clang-tidy/)** — free, ships with LLVM. - **[Infer](https://fbinfer.com/)** — Facebook's tool, free; especially strong on null-deref and concurrency. - **[Cppcheck](https://cppcheck.sourceforge.io/)**, **scan-build**. ### Go - **[`go vet`](https://pkg.go.dev/cmd/vet)** in the standard toolchain. - **[staticcheck](https://staticcheck.dev/)** — broad, high-quality checks. - **[golangci-lint](https://golangci-lint.run/)** runs many linters in one pass. ## When to use, when not **Use:** - At diff time, with a small high-confidence ruleset expanded over time. - With logical rules only; hand formatting and style to a formatter so the signal is bugs, not whitespace. **Don't:** - Gate the build on a complexity *metric*. Cyclomatic and cognitive complexity are advisory refactoring signals, not verification. A duplicate-branch or identical-condition rule flags an actual likely bug; a complexity threshold flags only "this is large." ## Evidence - **Clippy in the wild.** Across real-world Rust projects, false positives and missing auto-fix are the dominant non-adoption reasons (Li et al. 2024)[^li2024]. - **Complexity metrics are weak gates.** Cyclomatic complexity (McCabe 1976)[^mccabe1976] rests on contested theoretical foundations and in practice largely tracks lines of code, adding little independent predictive value (Shepperd 1988)[^shepperd1988]. SonarSource's Cognitive Complexity (Campbell 2018)[^campbell2018] reformulates it to target human understandability; the one controlled validation found it correlates with comprehension time and subjective ratings, but with mixed results for task correctness — capturing "at least some aspects" of understandability (Muñoz Barón et al. 2020)[^munozbaron2020]. ## Classification - **Quality dimensions:** Functionality, Maintainability. - **Area:** General code quality and common defect patterns; per-language tooling run at diff time; API-misuse and suspicious-construct rules. - **Guarantee:** Empirical — depends on rule precision and recall; a high-confidence signal, not a proof. ## Referenced by - [Abstract interpretation](https://quality.stereobooster.com/abstract-interpretation.md) · Methods - [Checklists](https://quality.stereobooster.com/checklists.md) · Methods - [Database migration safety](https://quality.stereobooster.com/migration-safety.md) · Methods - [Dead-code detection](https://quality.stereobooster.com/dead-code-detection.md) · Methods - [Static analysis](https://quality.stereobooster.com/static-analysis.md) · Methods - [Verifying concurrency](https://quality.stereobooster.com/concurrency.md) · Methods - [Verifying memory safety](https://quality.stereobooster.com/memory.md) · Methods - [Verifying time and date handling](https://quality.stereobooster.com/time-and-date.md) · Methods ## References [^li2024]: Li, Chunmiao, Yijun Yu, Haitao Wu, Yuanliang Zhang, Zhi Jin, and Zhenjiang Hu. 2024. "[Unleashing the Power of Clippy in Real-World Rust Projects](https://arxiv.org/pdf/2310.11738)." *Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings*, 318–19. . [^bessey2010]: Bessey, Al, Ken Block, Ben Chelf, et al. 2010. "[A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World](https://web.stanford.edu/~engler/BLOC-coverity.pdf)." *Communications of the ACM* 53 (2): 66–75. . [^mccabe1976]: McCabe, Thomas J. 1976. "[A Complexity Measure](http://literateprogramming.com/mccabe.pdf)." *IEEE Transactions on Software Engineering* SE-2 (4): 308–20. . [^shepperd1988]: Shepperd, Martin. 1988. "[A Critique of Cyclomatic Complexity as a Software Metric](https://www.researchgate.net/publication/3407068_A_Critique_of_Cyclomatic_Complexity_as_a_Software_Metric)." *Software Engineering Journal* 3 (2): 30–36. . [^campbell2018]: Campbell, G. Ann. 2018. "[Cognitive Complexity: An Overview and Evaluation](https://www.sonarsource.com/docs/CognitiveComplexity.pdf)." *Proceedings of the 2018 International Conference on Technical Debt (TechDebt '18)*, 57–58. . [^munozbaron2020]: Muñoz Barón, Marvin, Marvin Wyrich, and Stefan Wagner. 2020. "[An Empirical Validation of Cognitive Complexity as a Measure of Source Code Understandability](https://arxiv.org/pdf/2007.12520)." *Proceedings of the 14th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM '20)*, 1–12. .