oxc-project/oxc · warning · OxcDiagnostic

Use `path.join()` or `path.resolve()` instead of string conc

Error message

Use `path.join()` or `path.resolve()` instead of string concatenation

What it means

Diagnostic from oxlint rule node/no-path-concat (restriction). Building filesystem paths by concatenating __dirname/__filename with literals (binary + or template literals) hard-codes forward slashes: the code happens to work on POSIX and breaks on Windows, where the separator is backslash. path.join()/path.resolve() insert the platform separator and normalize '.', '..' segments, so the rule demands them instead.

Source

Thrown at crates/oxc_linter/src/rules/node/no_path_concat.rs:15

use oxc_ast::{
    AstKind,
    ast::{Expression, TemplateLiteral},
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_semantic::IsGlobalReference;
use oxc_span::Span;
use oxc_str::static_ident;
use oxc_syntax::operator::BinaryOperator;

use crate::{AstNode, context::LintContext, rule::Rule};

fn no_path_concat_diagnostic(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Use `path.join()` or `path.resolve()` instead of string concatenation")
        .with_help("Replace string concatenation of `__dirname` or `__filename` with `path.join()` or `path.resolve()`.")
        .with_label(span)
}

#[derive(Debug, Default, Clone)]
pub struct NoPathConcat;

declare_oxc_lint!(
    /// ### What it does
    ///
    /// Disallows string concatenation with `__dirname` and `__filename`.
    ///
    /// ### Why is this bad?
    ///
    /// In Node.js, the `__dirname` and `__filename` global variables contain the directory path and the file path of the currently executing script file, respectively.
    /// Sometimes, developers try to use these variables to create paths to other files, such as:
    ///
    /// ```js

View on GitHub (pinned to e1e7af627c)

Solutions

1. Use path.join(__dirname, 'config.json') — no leading slash on the segment
2. Use path.resolve(__dirname, 'a', 'b') when you specifically want an absolute path result
3. For file URLs (import() of assets) use pathToFileURL() from the 'url' module instead of concatenation
4. Keep node/no-path-concat on in CI to catch Windows-only path bugs before review

Example fix

// before
const configPath = __dirname + '/config.json';

// after
const path = require('path');
const configPath = path.join(__dirname, 'config.json');

// .oxlintrc.json
"rules": { "node/no-path-concat": "error" }

npx oxlint -c .oxlintrc.json --deny-warning .

When it happens

Trigger: A binary + expression or template literal with an operand referencing the unshadowed globals __dirname or __filename (checked via IsGlobalReference, so a local variable named __dirname does not trigger). Triggers: const p = __dirname + '/config.json'; const t = `${__dirname}/data/x.json`;

Common situations: Scripts and config loaders developed on macOS/Linux that fail for Windows coworkers or on Windows CI runners; file-server route mapping; test fixture paths; the classic silent cross-platform bug because '/' mostly works as a separator on Windows except drive-absolute and UNC cases.

Related errors

• Expected error to be handled.
• Expected return with your callback function.
• Unexpected access to `exports`.
• Unexpected access to `module.exports`.
• Unexpected assignment to `exports`.

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/df8b38e09f1d3f65. Report an issue: GitHub.