CodeVetter
← All unpacks
CodeVetter · Repo Unpack evidence

prettier/prettier

Scanned commit 1a36a7defd dated 2026-09-22 — last upstream commit. Generated by codevetter 1.12.0 on 2026-09-22.

github.com/prettier/prettier ↗ · 3999 files · 7.7 MB · scan capped

Opinionated Code Formatter JavaScript · TypeScript · Flow · JSX · JSON CSS · SCSS · Less HTML · Vue · Angular GraphQL · Markdown · YAML Your favorite language? Intro Prettier is an opinionated code formatter.

Deep analysis by grok-4.6-build via the grok CLI on 2026-09-22 (318s) — every claim below links to its cited source files.

Overview

Prettier 3.10.0-dev is an opinionated, plugin-based code formatter: it parses source into an AST, attaches comments, converts that AST to a Wadler-style Doc IR, then pretty-prints to a string. The public Node API in src/index.js is fully async (format, check, formatWithCursor, resolveConfig, getFileInfo, getSupportInfo); the CLI enters through bin/prettier.cjs into src/cli/index.js, with an opt-in rewrite re-exported from @prettier/cli. Built-in languages (JS/TS/Flow, JSON, CSS/Less/SCSS, HTML/Vue/Angular/LWC/MJML, GraphQL, Markdown/MDX, YAML, Handlebars) are themselves plugins, lazily loaded, and last-registered plugins win when resolving parsers and printers.

System map

The runtime has three public surfaces: the Node ESM/CJS API (src/index.js / src/index.cjs), the CLI (bin/prettier.cjs → src/cli), and a browser standalone bundle (src/standalone.js, no config/plugin autoload). Formatting is owned by src/main/core.js; languages live under src/language-*; plugins are assembled by src/main/plugins and the generated builtin registries. Config search/load lives in src/config; the Doc printer in src/document. Development requires Node >=22 and Yarn 4; production tests still exercise dist/ down to Node 14. The website is a Docusaurus + Vite playground published via Netlify; npm packages are built by scripts/build/build.js into dist/.

Feature catalog

Users format via CLI, Node API, or browser standalone. The CLI writes, checks, lists, caches, and inspects files; the API formats text, maps cursor offsets, resolves config, and infers parsers. Built-in languages cover the web stack with multiple JS parsers (babel/acorn/espree/meriyah/oxc/yuku/typescript/flow/hermes). Plugins, EditorConfig, ignore files, pragmas, range format, and a playground are first-class. Prettier refuses new formatting options by policy.

Data flow

Text enters via CLI files/stdin or the format() API. Options are normalized, a parser is inferred or selected, plugins are loaded, and the parser produces an AST. Comments are attached, embedded languages may be re-parsed, printers emit a Doc, and printDocToString measures/breaks groups to a string. CLI then writes, diffs, or caches that string. Config, ignore, and EditorConfig are filesystem side channels that never run in standalone.

Behavior traces

Three user-visible flows were walked in source. CLI startup validates Node, builds a Context from argv/plugins, then dispatches to version/help/support/config-path/file-info, stdin, or formatFiles. Formatting a file expands globs, resolves per-file options, optionally hits cache, then runs the parse→doc→string pipeline. Persistence is either in-place write via mockable.writeFormattedFile, stdout, or a check/list-different exit code.

Testing signals

Jest 30 with jest-light-runner drives four suites: snapshot format tests, CLI/API integration tests, unit tests, and dts tests. Format tests are directory fixtures plus runFormatTest, which implicitly adds extra JS parsers and, under FULL_TEST=1, AST-compare, second-format, EOL, and BOM checks. Production tests install dist/prettier and also run standalone and browser (Puppeteer) matrices. Unit tests are skipped in production; integration tests are skipped in standalone/browser.

Risk map

The largest security surface is intentional code execution: config files and plugins are imported from user-controlled paths, and --write overwrites arbitrary matched files. Plugin last-wins lets a later plugin replace builtin parsers/printers. Cache writes with restrictAccessToCwd:false. Generated plugin registries and the dist/ publish boundary are easy to edit in the wrong place. Option policy and the removed custom-parser API are social/API traps, not memory-safety bugs.

Extension points

New languages are plugins: export languages/parsers/printers/options and load via --plugin, options.plugins, or config. Builtins are the same API, registered in the generated lazy-load tables. JS syntax work lands in src/language-js/parse and the printAngular/printJsx/printFlow/printTypescript/printEstree chain. Doc commands are the IR extension point. CLI flags are two tables (cli-options.evaluate.js and core-options.evaluate.js). Config file names are the CONFIG_FILES array.

Contributor handoff

Read src/index.js, src/main/core.js, and the language module you are touching before editing. Do not add formatting options. Do not hand-edit generated builtin-plugin files; run generate-builtin-plugins. Format tests are snapshots — yarn test -u then git diff. Prefer small, reviewable diffs. Dev Node is >=22; production behavior is what dist/ does after yarn build. Run the matching tests/format/<lang> directory plus yarn test tests/unit if you change Doc/parser resolve.

Languages

LanguageFilesShare of source
JavaScript513685%
TypeScript69211%
Markdown478docs/config
YAML395docs/config
HTML251docs/config
CSS185docs/config
JSON112docs/config
Vue992%

Start reading here

Probable source entrypoint: index.js — inferred from the directory tree and manifest, not the upstream docs.

Source roots

src/ (542 files) packages/ (12 files)

Source layout — src/

PathFiles
src/cli/24
src/common/7
src/config/9
src/document/29
src/experimental-cli/3
src/language-css/29
src/language-graphql/0
src/constants.js1
src/index.cjs1
src/index.d.ts1
src/index.js1

Repository structure

Top-level pathFiles
tests/3036
src/542
website/182
scripts/79
changelog_unreleased/65
docs/24
.github/23
packages/12

Docs found: CONTRIBUTING.mdREADME.mddocs/api.mddocs/browser.mddocs/ci.mddocs/cli.mddocs/comparison.mddocs/configuration.mddocs/editors.mddocs/for-enterprise.md

Package

package.json — prettier v3.10.0-dev, 80 declared dependencies.

@angular/compiler@babel/code-frame@babel/generator@babel/parser@babel/types@braindb/mdast-util-wiki-link@braindb/micromark-extension-wiki-link@bybrave/json5@clack/prompts@eslint/js@glimmer/syntax@prettier/cli

CI & config entrypoints

Structural health signals

Average score 7.2/10 across 96 analyzed source files; 19 hotspots surfaced.

These are deterministic review leads — size, churn, and structural signals — not proof of a bug in this project.

Recent history