0b673ccb76
chore: version packages ( #1462 )
2026-07-31 22:57:26 -07:00
5268cb4c5d
fix: [server-auth-actions] skip credential-establishing endpoints ( #1540 )
...
* fix(server-auth-actions): skip credential-establishing actions
The server-auth-actions rule now correctly skips server actions that
perform credential-establishing operations (signup, signin, OTP
verification, password reset) by detecting calls to auth SDK methods
like supabase.auth.signUp(), auth.signInWithPassword(), and
auth.verifyOtp().
These actions legitimately run for anonymous callers, so requiring
authentication would be incorrect. This resolves the documented false
positive where credential-establishing endpoints were incorrectly
flagged as unauthenticated privileged operations.
Closes #1538
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* test(server-auth-actions): cover credential SDK boundaries
* fix(server-auth-actions): verify auth provider receivers
* fix(server-auth-actions): require credential action intent
* fix(server-auth-actions): recognize direct auth namespaces
* fix(server-auth-actions): require leading credential intent
* fix(server-auth-actions): cover credential action aliases
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-31 21:01:31 -07:00
a9a1f40c8b
fix(effect-needs-cleanup): recognize Supabase channel cleanup ( #1541 )
...
* fix(effect-needs-cleanup): recognize removeChannel/removeAllChannels/dispose cleanup
- Add removeChannel and removeAllChannels to GLOBAL_RELEASE_METHOD_NAMES
- Add cleanup verbs to .on() paired release verbs for Supabase chains
- Add special case for .on() calls without handles in chains
- Add comprehensive unit tests for Supabase and Jitsi patterns
Fixes #1539
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* chore: add changeset for #1539 fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* refactor(rule): localize Supabase cleanup verbs
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-31 20:50:25 -07:00
19387631f2
fix(rule): resolve useCallback pointer capture handlers ( #1524 )
2026-07-31 20:27:27 -07:00
992205a31b
fix(rule): detect default clobbers reaching JSX ( #1526 )
2026-07-31 17:12:25 -07:00
9418a1c01f
RDFPFN792026: recognize external effect synchronization ( #1523 )
...
* fix: recognize external effect synchronization
* test: preserve mixed deferred effect work
2026-07-31 17:12:09 -07:00
b479d7d777
RDFPFN792026: prove ref-owned timer cleanup ( #1522 )
...
* fix(rule): prove ref-owned timer cleanup
* fix(rule): preserve local resource cleanup aliases
* fix(rule): prove socket owner listener cleanup
2026-07-31 17:11:53 -07:00
c672551e42
fix(exhaustive-deps): gate custom hook analysis ( #1509 )
2026-07-31 17:11:38 -07:00
a8115b8257
fix(no-flush-sync): allow awareness selection integrations ( #1508 )
2026-07-31 17:11:22 -07:00
0cc5efbf21
RDFPFN792026: recognize compound stale-request guards ( #1499 )
...
* fix(rule): recognize compound stale-request guards
* fix(rule): continue cleanup scans after safe try blocks
* fix(rule): allow loose compound sequence guards
* fix(rules): accept equivalent cleanup returns
* fix(rule): scope cleanup proof to async invocation paths
* fix(rule): prove conditional cleanup coverage
* fix(rule): bound conditional invocation proofs
* fix(rule): resolve initialized mutable effect helpers
2026-07-31 17:11:04 -07:00
adcee586ad
RDFPFN792026: recognize settling componentDidUpdate guards ( #1495 )
...
* fix(oxlint-plugin): recognize settling did-update guards
* fix(oxlint-plugin): preserve state convergence sources
* fix(oxlint-plugin): reject unstable did-update guards
* fix(oxlint-plugin): close did-update guard review gaps
2026-07-31 17:10:46 -07:00
3d67ca13a2
RDFPFN792026: recognize default HoC feature exports ( #1489 )
...
* fix(oxlint): recognize default HoC feature exports
* fix(oxlint): reject mutable HoC export aliases
* fix(oxlint): unwrap typed HoC export arguments
* fix(oxlint): trace HoC export specifiers
* fix(oxlint): trace composed HoC exports
* fix(oxlint): recognize default HoC export records
* fix(no-multi-comp): trace CommonJS feature exports
* fix(no-multi-comp): trace exported component identity
* fix(rules): preserve compound component members
2026-07-31 17:10:27 -07:00
6b64dfaf9e
RDFPFN792026: detect state updater side effects ( #1525 )
...
* RDFPFN792026: detect state updater side effects
* fix: accept nullish local collection initialization
* fix: preserve updater-local mutable builders
* fix: detect setter callback prop variants
* fix(rule): preserve updater-local mutable receivers
* fix(rule): tighten updater assignment provenance
* fix(rule): detect external platform append mutations
* fix(rule): close state updater parity gaps
* fix(rule): preserve local updater values
* fix(rule): narrow lazy initializer functions
* fix(rule): prove updater property factories
* fix(rule): prove immutable updater dates
* fix(rule): tighten immutable date provenance
* fix(rule): prove immutable date receiver chains
* fix(rule): replay updater property overwrites
* fix(rule): honor dayjs wrapper depth
* fix(cache): fingerprint dayjs mutation graph
* fix: track deep Day.js configuration dependencies
* fix: preserve module service side effects
* fix(cache): bound dependency graph traversal
* fix(rule): ignore unreachable prior state setters
* fix(rule): keep nested component helpers local
* fix(rule): keep unresolved nested helpers conservative
* fix(rule): ignore dead ternary updater branches
* fix(rule): fail closed at dayjs config frontier
2026-07-31 08:18:35 -07:00
a81b3d6573
fix(js-hoist-intl): respect dynamic utility inputs ( #1507 )
2026-07-31 06:45:41 -07:00
57743f827d
RDFPFN792026: recognize mounted callback-ref state ( #1506 )
...
* fix(react): recognize mounted callback-ref state
* fix(react): trace callback ref mount sources
* fix(react): reject computed callback ref writers
* fix(react): detect indirect callback ref writers
* fix(react): inspect only setState payload sources
* fix(react): constrain post-mount source execution
* fix(react): trace invoked post-mount helpers
* fix(rules): harden callback ref field discovery
* fix(rules): share mutation receiver alias tracking
* fix(rules): require fully post-mount state payloads
* fix(rules): reject impure callback ref writers
* fix(rules): prove callback ref value provenance
* fix(rules): track callback ref handler aliases
* fix(rules): inspect nested mutation call writers
* fix(rules): preserve measured mount state provenance
* fix(rules): harden mounted ref provenance
* fix(rules): harden mounted ref execution proofs
2026-07-31 06:45:08 -07:00
443082ae30
RDFPFN792026: preserve ordered shared receiver awaits ( #1521 )
...
* fix(rule): preserve ordered shared receiver awaits
* fix(rule): isolate nested await loops
* fix(rule): scope ordered await exemptions
* fix(async-await-in-loop): narrow ordered output proof
2026-07-31 03:21:59 -07:00
b07af9db5f
fix: preserve guarded createRef persistence ( #1520 )
2026-07-31 01:32:47 -07:00
8170ba24e8
RDFPFN792026: ignore focus-forwarding static wrappers ( #1515 )
...
* fix(a11y): ignore focus-forwarding static wrappers
* fix(a11y): preserve named forwarding handlers
* fix(a11y): preserve wrapped backdrop handlers
* fix(a11y): retain conditional blocker diagnostics
2026-07-30 23:51:15 -07:00
660200e54a
RDFPFN792026: prove render callback prop provenance ( #1514 )
...
* fix(rule): prove custom hook callback origin
* fix(rule): scope options prop provenance
* fix(rule): trace chained hook prop callbacks
* test(rule): preserve defaulted prop options
2026-07-30 23:17:35 -07:00
29e35d59bd
fix(security): ignore client secret metadata literals ( #1513 )
2026-07-30 22:27:05 -07:00
de6d2802c4
RDFPFN792026: avoid local live-state helper false positives ( #1512 )
...
* fix(react): tighten live-state callback provenance
* fix(react): preserve nested callback provenance
2026-07-30 22:09:55 -07:00
fb5f881e74
fix(rule): treat custom hook calls as opaque ( #1511 )
2026-07-30 21:12:23 -07:00
65539afe9b
RDFPFN792026: preserve external callback synchronization ( #1532 )
...
* fix(rule): preserve external callback synchronization
* fix(rule): ignore callback registration payloads
* fix(rule): retain reducer state mirrors
2026-07-30 20:57:49 -07:00
d81eedac8e
RDFPFN792026 Fix prefer-use-effect-event capture listener matching ( #1527 )
...
* fix prefer-use-effect-event capture listeners
* fix(rule): harden listener argument matching
2026-07-30 20:43:11 -07:00
3a0b9a0c5e
fix(rule): preserve copied external snapshots ( #1510 )
2026-07-30 20:39:25 -07:00
8402820411
fix only-export-components Vite config callbacks ( #1531 )
2026-07-30 20:32:08 -07:00
69d19b516f
fix(rule): detect URLSearchParams external-store mirrors ( #1528 )
2026-07-30 20:32:05 -07:00
bf470d50fe
fix: detect helpers in compiled forwardRef components ( #1529 )
2026-07-30 20:31:26 -07:00
2db2a97283
perf: reduce scan startup and workspace contention ( #1533 )
2026-07-30 19:42:52 -07:00
5dc936e111
RDFPFN792026: recognize controlled local state fallbacks ( #1503 )
...
* fix(rules): allow controlled local state fallbacks
* test(rules): preserve wrapped prop reseeds
* fix: prune nested controlled fallback scans
2026-07-30 00:12:51 -07:00
c126684f01
RDFPFN792026: suppress tiny js iteration chains ( #1493 )
...
* fix: suppress tiny js iteration chains
* fix: retain destructured iteration diagnostics
2026-07-30 00:05:27 -07:00
2992a03f2e
RDFPFN792026: preserve Next.js page prop serialization ( #1498 )
...
* fix(rules): preserve Next.js page prop serialization
* fix(rule): preserve conditional page props returns
* fix(rule): prove page props binding flow
* fix(rule): trace literal props bindings
* fix(rule): preserve opacity in page props
* fix(rule): keep props shorthand occurrence-safe
2026-07-30 00:04:22 -07:00
1f6e181d38
RDFPFN792026: prove predictable ref initialization ( #1497 )
...
* fix(oxlint-plugin): prove predictable ref initialization
* fix(oxlint-plugin): distinguish deferred ref replacements
* fix(oxlint-plugin): reject nondeterministic ref initialization
* fix(no-ref-current-in-render): classify render initializers
2026-07-30 00:03:18 -07:00
16972aeb83
RDFPFN792026: recognize terminal promise recovery catches ( #1496 )
...
* fix(rule): recognize terminal promise recovery catches
* fix(rule): accept proven terminal catch returns
* fix(rule): accept fulfilled catch promises
2026-07-29 23:59:37 -07:00
5f23826cea
RDFPFN792026: recognize guarded loading finalizers ( #1494 )
...
* fix(rules): recognize guarded loading finalizers
* fix(rules): enforce loading ownership claim order
* fix(rules): require loading snapshot ownership
* fix(rules): harden loading ownership scope
* fix(rules): clarify loading guard boundaries
2026-07-29 23:52:32 -07:00
9512488a5e
fix: report zero-argument ref constructors ( #1492 )
2026-07-29 23:51:27 -07:00
c6bdd2d42b
fix(rule): prove guarded maybe-undefined lookups ( #1491 )
2026-07-29 23:49:25 -07:00
8715808c20
RDFPFN792026 Prove effect cleanup lifecycle ownership ( #1490 )
...
* fix(rule): prove effect cleanup ownership
* fix(rule): resolve conditional effect invocations
2026-07-29 23:48:32 -07:00
d6f02bbcbf
RDFPFN792026: trace hydration branches through rendered values ( #1488 )
...
* fix: trace hydration browser branches through render flow
* fix: require rendered hydration consumers
* fix: suppress stable hydration comparisons
* fix: evaluate hydration equality operands precisely
* fix: resolve hydration equality aliases
* fix: prove hydration render flow precisely
* fix: close hydration branch adversarials
2026-07-29 23:47:04 -07:00
3bc63ea399
fix(rule): preserve ordered async traversal output ( #1477 )
2026-07-29 23:45:33 -07:00
811a2ff33a
RDFPFN792026 Narrow repeated array lookup diagnostics ( #1476 )
...
* fix: narrow repeated array lookup diagnostics
* fix: handle wrapped and empty lookup inputs
2026-07-29 23:43:50 -07:00
01ca0b3f1e
fix(security): skip root test-prefixed source files ( #1505 )
2026-07-29 23:41:45 -07:00
1098b9c10e
RDFPFN792026 detect dynamic array index keys ( #1475 )
...
* fix: detect dynamic array index keys
* fix: validate React children normalization inputs
* fix: unwrap React children normalization
2026-07-29 23:37:46 -07:00
444e177e2f
RDFPFN792026: detect unescaped RegExp path segments ( #1474 )
...
* fix: detect unescaped RegExp path segments
* fix: address RegExp review findings
2026-07-29 23:35:11 -07:00
b10cd4c6a1
RDFPFN792026: recognize conditional focus forwarding wrappers ( #1504 )
...
* fix(a11y): recognize conditional focus forwarding wrappers
* fix(a11y): unwrap focus forwarding receivers
2026-07-29 23:30:22 -07:00
83f3ff8ac7
fix: support Astro project scans ( #1519 )
2026-07-29 23:09:02 -07:00
86add14268
fix: honor project scope in Git hook scans ( #1516 )
2026-07-29 16:54:20 -07:00
b1352a2be4
fix(core): resolve file URL diagnostic paths ( #1473 )
...
* fix(core): handle invisible Unicode characters in disable comments (#1472 )
When TERMINAL_EMULATOR=JetBrains-JediTerm is set (or similar IDE/terminal
configurations), invisible Unicode characters like zero-width spaces
(U+200B, U+200C, U+200D) and zero-width no-break spaces (U+FEFF/BOM) can
appear at the end of lines. These characters are not matched by JavaScript's
\s regex class, causing the $ anchor in react-doctor-disable patterns to
fail despite the characters being invisible in editors and terminal output.
This fix adds explicit matching for common invisible Unicode characters
before the $ anchor in both DISABLE_NEXT_LINE_PATTERN and DISABLE_LINE_PATTERN,
making them resilient to these characters while maintaining the $ precision
that near-miss detection relies on.
The foreign disable patterns (eslint-disable, oxlint-disable) never anchored
to $ and were unaffected, which is why oxlint-disable-next-line worked while
react-doctor-disable-next-line failed in the reproduction case.
Fixes #1472
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* chore: add changeset for invisible Unicode fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* fix(core): resolve file URL diagnostic paths
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-29 00:09:06 -07:00
f1a1b16eb5
fix: detect React Compiler through bundled config wrappers ( #1470 )
2026-07-28 03:12:57 -07:00
3728102af1
chore: upgrade Oxc toolchain ( #1467 )
2026-07-27 19:03:34 -07:00
github-actions[bot]