4ce5484dc7
fix(rule): avoid false positives in common patterns
2026-08-29 03:30:53 -07:00
5bc88ae6a0
fix: ignore TypeScript type-only positions in no-unguarded-browser-global-at-module-scope ( #1668 )
...
* fix: ignore TypeScript type-only positions in no-unguarded-browser-global-at-module-scope
The rule was incorrectly flagging browser-global names (window, navigator, etc.) when they appeared as property keys in TypeScript interfaces and type aliases. These are type-only positions that TypeScript erases during compilation, so no runtime reference error occurs.
Add isTypeScriptTypePosition check to skip identifiers in TS type contexts before reporting. Add regression tests covering interface properties, type alias properties, and the preserved behavior for actual runtime references.
Fixes #1667
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* chore: add changeset for #1667 fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* test: add edge case tests for TypeScript type positions
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* test: preserve type-only browser global regression
* docs(changeset): clarify type-only global fix
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-08-21 18:56:00 -07:00
6416370836
feat(rules): add UI-library composition and correctness rules behind capability gates ( #1654 )
2026-08-16 23:29:04 -07:00
05ef98926d
fix: scan standalone Three.js projects and preserve TUI layout ( #1646 )
2026-08-13 18:18:45 -07:00
8c2f03aea9
feat: make React cleanup first-class ( #1624 )
...
* feat: make React cleanup first-class
* refactor: remove editor integrations
* fix: harden React cleanup analysis
* fix: detect default export duplication roots
* fix: unwrap typed duplication roots
* feat: add opt-in project analysis rules
* fix: canonicalize project analysis paths
* fix: harden project analysis precision
* fix: recognize cross-platform project entries
* fix: eliminate project analysis false positives
* fix: harden project analysis reachability
* fix: canonicalize project analysis inputs
* fix: resolve project analysis review findings
* fix: eliminate residual project analysis false positives
* fix: ignore commented registry previews
* fix: eliminate project analysis false positives
* fix: normalize project analysis paths across platforms
* fix: normalize Nextra theme path identity
* test: canonicalize convention fixture paths
* fix: preserve project analysis provenance
* fix: harden project analysis precision
* fix: honor project analysis boundaries
* fix: recognize conditional config plugins
* fix: recognize executable project references
* fix: recognize Stencil tool contracts
* fix: recognize nested tool references
* fix: recognize project setup contracts
* fix: recognize generated and local package consumers
* fix: recognize static template package references
* fix: recognize nested package runtime contracts
* fix: close project analysis parser gaps
* fix: parse project conventions structurally
* refactor: replace structural scanners with parsers
* fix: recognize functional Next CSS config
* fix: close remaining project analysis gaps
* fix: apply tag filters to project analysis
* fix: preserve embedded source positions
* fix: validate static config helper bindings
* fix: bound runtime directory discovery
* fix: close final dependency analysis gaps
* fix: preserve declaration dependency references
* chore: refresh generated rule metadata
* fix: make project analysis portable and bounded
* test: stabilize cleanup scaling guard
* refactor: parse project syntax with oxc
* fix: normalize native filesystem paths
* fix: separate path identity from report paths
* fix: match project files by filesystem identity
* fix: match build glob files by package identity
* fix: use native path keys for file identity
* fix: canonicalize Windows file identities
* fix: canonicalize package ownership paths
* test: inspect Windows path identities
* test: trace Windows package ownership
* fix: keep Windows path identities consistent
* fix: classify test contracts by normalized path
* fix: scope test contracts by canonical package path
* fix: keep test package graphs conservative
* test: keep React complexity advisory
2026-08-13 16:26:08 -07:00
bea01b8cf5
feat(r3f): add material rendering diagnostics ( #1633 )
2026-08-12 15:40:07 -07:00
8dfb013067
Add comprehensive Three.js and R3F diagnostics ( #1629 )
2026-08-11 15:40:53 -07:00
c1611428d2
test(fuzz): complete React Bench audit corpus ( #1619 )
2026-08-09 02:04:45 -07:00
27a39dede7
fix(rules): recognize retained cleanup ownership ( #1615 )
...
* fix(rules): recognize retained cleanup ownership
* fix(types): normalize optional AST parents
* test: store imported corpus as source text fixtures
2026-08-08 21:50:44 -07:00
7f028ea904
fix(rules): accept compound unmount guards ( #1606 )
2026-08-08 06:23:37 -07:00
f27fd5d136
fix(rules): close exhaustive React Bench audit gaps ( #1605 )
...
* fix(rules): close exhaustive React Bench audit gaps
* fix(core): fingerprint effect helper imports
* test(fuzz): preserve audit corpus bytes
2026-08-08 04:49:52 -07:00
6a546c2a4c
test(fuzz): pin exhaustive React Bench audit corpus ( #1603 )
...
* test(fuzz): pin exhaustive React Bench audit corpus
* fix(fuzz): normalize corpus paths
* test(fuzz): normalize corpus expectations
* fix(fuzz): skip TypeScript declarations
2026-08-07 17:38:28 -07:00
65d4f46d1a
test(fuzz): preserve React Bench diagnostic callsites ( #1600 )
2026-08-07 00:19:24 -07:00
a4d2c5c8bf
fix: recognize browser media lifecycles ( #1599 )
2026-08-06 23:51:11 -07:00
4ffeb2cb71
fix(rules): preserve state effect provenance ( #1597 )
2026-08-06 18:05:49 -07:00
d62caa575f
fix(rule): harden effect cleanup regressions ( #1596 )
...
* fix(rule): harden effect cleanup regressions
* fix(fuzz): preserve cleanup-local scope
2026-08-06 17:43:18 -07:00
0efadda676
fix(rule): preserve lifecycle synchronization semantics ( #1579 )
2026-08-04 23:54:24 -07:00
881ecfe674
fix: exclude setState updater callbacks from zustand-no-fresh-selector-result ( #1576 )
...
Resolve destructured Zustand imperative APIs by binding and property identity while preserving diagnostics for legitimate bound store hooks with API-like names.
2026-08-04 14:55:58 -07:00
bafef41699
RDFPFNFINAL fix benchmark rule precision and async ownership ( #1574 )
...
* chore: start hook diagnostic dedup
* chore: scaffold zod v4 subpath fix
* fix: repair benchmark rule precision
* fix: exclude repeated mount transitions
* fix(rules): require ownership guards to control clears
2026-08-04 14:15:17 -07:00
afd60dbe69
fix(effect-needs-cleanup): prove effect-owned cleanup ( #1559 )
...
* fix(effect-needs-cleanup): handle returned identifiers for addEventListener/addListener
Fixes #1558 - Part 1
- Allow returning identifiers bound to addEventListener/addListener results as valid cleanup
- Recognize calling such identifiers (e.g., ) as cleanup
- This fixes false positives for React Native's NetInfo.addEventListener and similar APIs
Remaining work: helper function cleanup and array collection cleanup
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* docs: add changeset for addEventListener cleanup fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* fix(effect-needs-cleanup): prove resource ownership
* fix(effect-needs-cleanup): harden ownership proofs
* fix(effect-needs-cleanup): isolate deferred ownership
* fix(effect-needs-cleanup): prove deferred timer ownership
* fix(effect-needs-cleanup): narrow invocation owners
* fix(effect-needs-cleanup): track helper collection mutations
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 13:29:06 -07:00
48ec9a8020
fix(cli): keep large workspace scans responsive ( #1549 )
...
* fix: keep large workspace scans responsive
* fix: harden large workspace scans
* test: normalize workspace path on Windows
* fix: resolve workspace exclusions after root redirects
* fix: honor workspace scan boundaries
* fix: keep bounded workspace scans responsive
* fix: preserve dead-code reachability
* refactor: tighten workspace scan controls
* fix(cli): bound staged workspace scans
* fix: eliminate pathological large-file scans
* fix: handle incomplete and conflicted scans
* test: configure conflict merge identity
* perf: cache repeated module resolution probes
* fix(cli): show all incomplete scan warnings
* fix(core): preserve cooperative scan semantics
* perf(cli): streamline workspace scan startup
* perf(cli): harden large workspace scans
* fix(cli): keep scan progress inline
* fix(scan): correct workspace result completeness
* fix(cli): simplify live scan status
* fix(core): make scan deadlines opt-in
* fix(scan): preserve complete workspace results
* perf(scan): accelerate very large workspaces
* fix(scan): yield CPU to foreground work
* perf(scan): avoid unnecessary project indexing
* fix(cli): keep final report inline
* test(cli): stabilize terminal recording setup
* fix(core): honor scan deadline during index probe
* fix(core): skip lint after incomplete index probe
* fix(core): preserve scoped lint ownership
* fix(cli): restore project picker on cancellation
2026-08-03 04:59:45 -07:00
85e1052289
FPFNFIX82 Detect passive request-owner windows ( #1563 )
...
* feat: detect passively synchronized request owners
* fix: exclude contradictory request-owner paths
* fix: exclude mismatch-branch state updates
* fix(rule): cover passive owner branches
2026-08-03 03:31:34 -07:00
cc2862666b
feat: detect controlled selection focus effects ( #1562 )
2026-08-03 03:03:44 -07:00
44922d6782
FPFNFIX82 Fix form and fragment diagnostics ( #1561 )
...
* fix(rules): correct form and fragment diagnostics
* fix(rules): handle fragment review edge cases
* fix: handle document-top fragment links
* fix(a11y): parse ids from html tags only
* fix(a11y): resolve static fragment aliases
* fix(a11y): retain known fragment targets
* fix(a11y): tokenize html id attributes
* fix: preserve known fragment IDs in mixed spreads
* fix: preserve known fragment ID defaults
2026-08-03 03:03:00 -07:00
3a93a34beb
FPFNFIX82: prove effect cleanup ownership ( #1564 )
2026-08-02 23:39:53 -07:00
02e3188d4b
Add InstancedMesh rules for Three.js and R3F ( #1560 )
2026-08-02 23:01:55 -07:00
4e4740dde3
FPFNFIX82: ignore type-only parent-data references ( #1557 )
...
* fix(no-pass-data-to-parent): ignore type-only refs
* fix(no-pass-data-to-parent): preserve angle assertion flow
2026-08-02 21:49:56 -07:00
4c610803cb
FPFNFIX82: detect stale async request error clears ( #1556 )
...
* feat(rule): detect unowned async error clears
* fix(no-unowned-async-error-clear): require ownership guard
* fix(no-unowned-async-error-clear): preserve keyed component proof
2026-08-02 21:49:37 -07:00
37427c915c
fix(effect-needs-cleanup): recognize reconnect cleanup ( #1555 )
2026-08-02 21:49:15 -07:00
b02bc694f1
FPFNFIX82: RDFPFN82026: preserve mixed effect chains ( #1545 )
...
* fix(rules): detect mixed effect chains
* fix(no-effect-chain): preserve channel lifecycles
* fix(no-effect-chain): preserve external sync boundaries
* fix(no-effect-chain): ignore setter value helpers in cleanup
2026-08-02 07:48:32 -07:00
f7dbdfa399
FPFNFIX82: RDFPFN82026: exclude media latches from all-state resets ( #1547 )
...
* fix(rules): exclude media latches from all-state resets
* test(rules): retain editable reset finding
2026-08-02 03:27:12 -07:00
7f29ecaa32
FPFNFIX82: RDFPFN82026: recognize media failure latches ( #1546 )
...
* fix(rules): recognize media failure latches
* fix(rules): tighten media lifecycle proof
2026-08-02 03:14:02 -07:00
8a22de1263
fix(rules): ignore empty ref registries ( #1544 )
2026-08-02 03:13:59 -07:00
a9a1f40c8b
fix(effect-needs-cleanup): recognize Supabase channel cleanup ( #1541 )
...
* fix(effect-needs-cleanup): recognize removeChannel/removeAllChannels/dispose cleanup
- Add removeChannel and removeAllChannels to GLOBAL_RELEASE_METHOD_NAMES
- Add cleanup verbs to .on() paired release verbs for Supabase chains
- Add special case for .on() calls without handles in chains
- Add comprehensive unit tests for Supabase and Jitsi patterns
Fixes #1539
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* chore: add changeset for #1539 fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* refactor(rule): localize Supabase cleanup verbs
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-31 20:50:25 -07:00
9418a1c01f
RDFPFN792026: recognize external effect synchronization ( #1523 )
...
* fix: recognize external effect synchronization
* test: preserve mixed deferred effect work
2026-07-31 17:12:09 -07:00
b479d7d777
RDFPFN792026: prove ref-owned timer cleanup ( #1522 )
...
* fix(rule): prove ref-owned timer cleanup
* fix(rule): preserve local resource cleanup aliases
* fix(rule): prove socket owner listener cleanup
2026-07-31 17:11:53 -07:00
c672551e42
fix(exhaustive-deps): gate custom hook analysis ( #1509 )
2026-07-31 17:11:38 -07:00
a8115b8257
fix(no-flush-sync): allow awareness selection integrations ( #1508 )
2026-07-31 17:11:22 -07:00
0cc5efbf21
RDFPFN792026: recognize compound stale-request guards ( #1499 )
...
* fix(rule): recognize compound stale-request guards
* fix(rule): continue cleanup scans after safe try blocks
* fix(rule): allow loose compound sequence guards
* fix(rules): accept equivalent cleanup returns
* fix(rule): scope cleanup proof to async invocation paths
* fix(rule): prove conditional cleanup coverage
* fix(rule): bound conditional invocation proofs
* fix(rule): resolve initialized mutable effect helpers
2026-07-31 17:11:04 -07:00
adcee586ad
RDFPFN792026: recognize settling componentDidUpdate guards ( #1495 )
...
* fix(oxlint-plugin): recognize settling did-update guards
* fix(oxlint-plugin): preserve state convergence sources
* fix(oxlint-plugin): reject unstable did-update guards
* fix(oxlint-plugin): close did-update guard review gaps
2026-07-31 17:10:46 -07:00
3d67ca13a2
RDFPFN792026: recognize default HoC feature exports ( #1489 )
...
* fix(oxlint): recognize default HoC feature exports
* fix(oxlint): reject mutable HoC export aliases
* fix(oxlint): unwrap typed HoC export arguments
* fix(oxlint): trace HoC export specifiers
* fix(oxlint): trace composed HoC exports
* fix(oxlint): recognize default HoC export records
* fix(no-multi-comp): trace CommonJS feature exports
* fix(no-multi-comp): trace exported component identity
* fix(rules): preserve compound component members
2026-07-31 17:10:27 -07:00
6b64dfaf9e
RDFPFN792026: detect state updater side effects ( #1525 )
...
* RDFPFN792026: detect state updater side effects
* fix: accept nullish local collection initialization
* fix: preserve updater-local mutable builders
* fix: detect setter callback prop variants
* fix(rule): preserve updater-local mutable receivers
* fix(rule): tighten updater assignment provenance
* fix(rule): detect external platform append mutations
* fix(rule): close state updater parity gaps
* fix(rule): preserve local updater values
* fix(rule): narrow lazy initializer functions
* fix(rule): prove updater property factories
* fix(rule): prove immutable updater dates
* fix(rule): tighten immutable date provenance
* fix(rule): prove immutable date receiver chains
* fix(rule): replay updater property overwrites
* fix(rule): honor dayjs wrapper depth
* fix(cache): fingerprint dayjs mutation graph
* fix: track deep Day.js configuration dependencies
* fix: preserve module service side effects
* fix(cache): bound dependency graph traversal
* fix(rule): ignore unreachable prior state setters
* fix(rule): keep nested component helpers local
* fix(rule): keep unresolved nested helpers conservative
* fix(rule): ignore dead ternary updater branches
* fix(rule): fail closed at dayjs config frontier
2026-07-31 08:18:35 -07:00
a81b3d6573
fix(js-hoist-intl): respect dynamic utility inputs ( #1507 )
2026-07-31 06:45:41 -07:00
57743f827d
RDFPFN792026: recognize mounted callback-ref state ( #1506 )
...
* fix(react): recognize mounted callback-ref state
* fix(react): trace callback ref mount sources
* fix(react): reject computed callback ref writers
* fix(react): detect indirect callback ref writers
* fix(react): inspect only setState payload sources
* fix(react): constrain post-mount source execution
* fix(react): trace invoked post-mount helpers
* fix(rules): harden callback ref field discovery
* fix(rules): share mutation receiver alias tracking
* fix(rules): require fully post-mount state payloads
* fix(rules): reject impure callback ref writers
* fix(rules): prove callback ref value provenance
* fix(rules): track callback ref handler aliases
* fix(rules): inspect nested mutation call writers
* fix(rules): preserve measured mount state provenance
* fix(rules): harden mounted ref provenance
* fix(rules): harden mounted ref execution proofs
2026-07-31 06:45:08 -07:00
443082ae30
RDFPFN792026: preserve ordered shared receiver awaits ( #1521 )
...
* fix(rule): preserve ordered shared receiver awaits
* fix(rule): isolate nested await loops
* fix(rule): scope ordered await exemptions
* fix(async-await-in-loop): narrow ordered output proof
2026-07-31 03:21:59 -07:00
b07af9db5f
fix: preserve guarded createRef persistence ( #1520 )
2026-07-31 01:32:47 -07:00
8170ba24e8
RDFPFN792026: ignore focus-forwarding static wrappers ( #1515 )
...
* fix(a11y): ignore focus-forwarding static wrappers
* fix(a11y): preserve named forwarding handlers
* fix(a11y): preserve wrapped backdrop handlers
* fix(a11y): retain conditional blocker diagnostics
2026-07-30 23:51:15 -07:00
660200e54a
RDFPFN792026: prove render callback prop provenance ( #1514 )
...
* fix(rule): prove custom hook callback origin
* fix(rule): scope options prop provenance
* fix(rule): trace chained hook prop callbacks
* test(rule): preserve defaulted prop options
2026-07-30 23:17:35 -07:00
29e35d59bd
fix(security): ignore client secret metadata literals ( #1513 )
2026-07-30 22:27:05 -07:00
de6d2802c4
RDFPFN792026: avoid local live-state helper false positives ( #1512 )
...
* fix(react): tighten live-state callback provenance
* fix(react): preserve nested callback provenance
2026-07-30 22:09:55 -07:00
Aiden Bai