chore: Ban barrel files and wildcard re-exports by mcmire · Pull Request #10776 · MetaMask/core

mcmire · 2026-10-09T18:10:31Z

Explanation

There are two related practices that we have seen other teams follow:

Using a wildcard to re-export all symbols from a file in one statement
Adding "barrel" files to group together large packages into smaller modules

While they might make sense for application code, we do not advise using these patterns for libraries within this repo for the following reasons:

They make it difficult to view the public surface area of a package at a glance, which is useful for security auditing purposes.
They make it difficult to notice new additions to the surface area. Any time a new export is added to one of these files, it will automatically become an export of the package, so it could be easily missed in a review (and fail to be added to the changelog).
They make it impossible to export a symbol from a file but not expose it publicly to consumers. This can be useful for testing purposes.
They can slow down static analysis tools (TypeScript, linting tools, etc.) because it increases the number of paths it takes to reach a file.

We already added some guidelines discouraging teams from using wildcard re-exports, but we did not advise against creating barrel files (except in cases where it makes sense, such as defining entrypoints for package exports). Crucially, we had nothing in place to enforce either. As a result, problems have accrued.

This commit extends the existing guidelines and adds custom Oxlint plugins in .oxlint-plugins to enforce them (using suppressions to note the existing violations). References have also been updated in AGENTS.md.

Manual testing steps

Open packages/network-controller/src/index.ts.
- You should see a lint error for ./constants.js explaining that named wildcard exports are not allowed.
Open packages/profile-sync-controller/src/controllers/index.ts.
- You should see a lint error explaining that barrel files are not allowed (also that namespace re-exports are not allowed).

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

^{Cursor Bugbot is generating a summary for commit eef6339. Configure here.}

socket-security · 2026-10-09T18:12:29Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@oxlint/plugins@1.86.0

View full report

There are two related practices are common to see across various projects: - Using a wildcard to re-export all symbols from a file in one statement - Adding "barrel" files to group together large packages into smaller modules While they might make sense for application code, we do not advise using these patterns for libraries within this repo for the following reasons: - They make it difficult to view the public surface area of a package at a glance, which is useful for security auditing purposes. - They make it difficult to notice new additions to the surface area. Any time a new export is added to one of these files, it will automatically become an export of the package, so it could be easily missed in a review (and fail to be added to the changelog). - They make it impossible to export a symbol from a file but not expose it publicly to consumers. This can be useful for testing purposes. - They can slow down static analysis tools (TypeScript, linting tools, etc.) because it increases the number of paths it takes to reach a file. We already added some guidelines discouraging teams from using wildcard re-exports, but we did not advise against creating barrel files. Crucially, we had nothing in place to enforce either, so problems have accrued in the meantime. This commit extends the existing guidelines and adds custom Oxlint plugins in `.oxlint-plugins` to enforce them (using suppressions to note the existing violations). References have also been updated in `AGENTS.md`.

mcmire · 2026-10-09T18:14:18Z

-        'scripts/**/*.{ts,js,sh}',
-        'tests/**/*.ts',
        '*.config.{js,cjs,mjs,ts}',
+        '.oxlint-plugins/**/*.ts',


I've alphabetized this list, but .oxlint-plugins is new.

mcmire · 2026-10-09T18:14:49Z

@@ -173,7 +174,8 @@ Use `yarn create-package --name <name> --description <description>` to add a new
 ### General package guidelines

 - Each package should have an `index.ts` file in `src/` that explicitly lists all exports.


I plan on introducing a new PR which tells the agent to read the package guidelines, but for now we repeat the same information.

mcmire · 2026-10-09T18:39:37Z

+  },
+});
+
+ruleTester.run('no-barrel-files', noBarrelFiles, {


I learned about Oxlint's RuleTester class while adding this: https://oxc.rs/docs/guide/usage/linter/writing-js-plugins.html#writing-tests-for-custom-rules

Nice, we should add that to the Oxlint config repo.

Mrtenz

Maybe consider moving this to the Oxlint config repo? I was thinking about creating a plugin for no-restricted-syntax too.

mcmire force-pushed the ban-barrel-exports-2 branch 2 times, most recently from 3be81d1 to d826344 Compare October 9, 2026 18:45

mcmire force-pushed the ban-barrel-exports-2 branch from d826344 to eef6339 Compare October 9, 2026 18:46

mcmire commented Oct 9, 2026

View reviewed changes

mcmire marked this pull request as ready for review October 9, 2026 18:51

mcmire deployed to default-branch October 9, 2026 18:51 — with GitHub Actions Active

Mrtenz reviewed Oct 10, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore: Ban barrel files and wildcard re-exports - #10776

chore: Ban barrel files and wildcard re-exports#10776
mcmire wants to merge 1 commit into
mainfrom
ban-barrel-exports-2

mcmire commented Oct 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

mcmire Oct 9, 2026

Uh oh!

mcmire Oct 9, 2026

Uh oh!

mcmire Oct 9, 2026

Uh oh!

Mrtenz Oct 10, 2026

Uh oh!

Mrtenz left a comment

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -173,7 +174,8 @@ Use `yarn create-package --name <name> --description <description>` to add a new
		### General package guidelines

		- Each package should have an `index.ts` file in `src/` that explicitly lists all exports.

Conversation

mcmire commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Manual testing steps

References

Checklist

Uh oh!

socket-security Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcmire Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

mcmire Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

mcmire Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Mrtenz Oct 10, 2026

Choose a reason for hiding this comment

Uh oh!

Mrtenz left a comment

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mcmire commented Oct 9, 2026 •

edited

Loading

socket-security Bot commented Oct 9, 2026 •

edited

Loading