Tool: JSHint (Static Analysis)

[saisankhe]

JSHint is a program that flags suspicious usage in programs written in JavaScript. The core project consists of a library itself as well as a CLI program distributed as a Node module.

Installation: Installed via npm install --save-dev jshint and ran with npx jshint src/

Evidence: See jshint-output.txt for full output. 30488 warnings were produced across the codebase.

Pros of JSHint:

• It is very easy to install and run. It only took one npm install and one command.
• It is very fast. It scanned the entire codebase in seconds.
• It catches a wide range of potential issues like unused variables, missing strict equality and undefined globals
• It is highly configurable via .jshintrc, package.json or inline directives.

Cons of JSHint:

• Most of the 30488 warnings produced were not actual bugs, just outdated syntax complaints which makes it hard to find actual issues without configuration.
• Does not recognise Node.js globals by default, leading to many false positives around require, module and process.
• Defaults to ES5 and hence flags modern JavaScript features like const, arrow functions, and async/await as errors.

Customisation:

• JSHint can be configured through a .jshintrc config file, package.json under jshintConfig or inline comments
• Eventually, teams can enable options like "undef":true to flag undefined variables and "unused": true to catch unused variables
• Specific warnings can be suppressed using inline comments

Quantitative Evidence:

• 30,488 warnings produced in total
• The majority were ES5 syntax warnings
• The second most common category was undefined Node.js globals