dcfe06428d
chore: version packages ( #1548 )
2026-08-03 18:25:23 -07:00
c825c59550
Narrow AI training environment detection ( #948 )
...
* fix: narrow AI training environment detection
* fix: remove ambiguous AI training signals
---------
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:56:46 -07:00
a34d6a159e
fix: cover LegendList content container rules ( #1038 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:38:05 -07:00
45e818a34b
fix: clean up config and telemetry drift ( #1023 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:37:34 -07:00
3acb41bad6
fix: align ESLint rule metadata ( #987 )
...
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 17:37:09 -07:00
3466fe11d7
perf: index effect cleanup analysis ( #1568 )
...
* perf: index effect cleanup analysis
* test: stabilize effect cleanup performance check
* test: support coarse CPU timers
2026-08-03 15:30:29 -07:00
ba04952cb3
fix(cli): preserve scrollback during project selection ( #1566 )
2026-08-03 13:34:40 -07:00
afd60dbe69
fix(effect-needs-cleanup): prove effect-owned cleanup ( #1559 )
...
* fix(effect-needs-cleanup): handle returned identifiers for addEventListener/addListener
Fixes #1558 - Part 1
- Allow returning identifiers bound to addEventListener/addListener results as valid cleanup
- Recognize calling such identifiers (e.g., ) as cleanup
- This fixes false positives for React Native's NetInfo.addEventListener and similar APIs
Remaining work: helper function cleanup and array collection cleanup
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* docs: add changeset for addEventListener cleanup fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* fix(effect-needs-cleanup): prove resource ownership
* fix(effect-needs-cleanup): harden ownership proofs
* fix(effect-needs-cleanup): isolate deferred ownership
* fix(effect-needs-cleanup): prove deferred timer ownership
* fix(effect-needs-cleanup): narrow invocation owners
* fix(effect-needs-cleanup): track helper collection mutations
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden@million.dev >
2026-08-03 13:29:06 -07:00
48ec9a8020
fix(cli): keep large workspace scans responsive ( #1549 )
...
* fix: keep large workspace scans responsive
* fix: harden large workspace scans
* test: normalize workspace path on Windows
* fix: resolve workspace exclusions after root redirects
* fix: honor workspace scan boundaries
* fix: keep bounded workspace scans responsive
* fix: preserve dead-code reachability
* refactor: tighten workspace scan controls
* fix(cli): bound staged workspace scans
* fix: eliminate pathological large-file scans
* fix: handle incomplete and conflicted scans
* test: configure conflict merge identity
* perf: cache repeated module resolution probes
* fix(cli): show all incomplete scan warnings
* fix(core): preserve cooperative scan semantics
* perf(cli): streamline workspace scan startup
* perf(cli): harden large workspace scans
* fix(cli): keep scan progress inline
* fix(scan): correct workspace result completeness
* fix(cli): simplify live scan status
* fix(core): make scan deadlines opt-in
* fix(scan): preserve complete workspace results
* perf(scan): accelerate very large workspaces
* fix(scan): yield CPU to foreground work
* perf(scan): avoid unnecessary project indexing
* fix(cli): keep final report inline
* test(cli): stabilize terminal recording setup
* fix(core): honor scan deadline during index probe
* fix(core): skip lint after incomplete index probe
* fix(core): preserve scoped lint ownership
* fix(cli): restore project picker on cancellation
2026-08-03 04:59:45 -07:00
85e1052289
FPFNFIX82 Detect passive request-owner windows ( #1563 )
...
* feat: detect passively synchronized request owners
* fix: exclude contradictory request-owner paths
* fix: exclude mismatch-branch state updates
* fix(rule): cover passive owner branches
2026-08-03 03:31:34 -07:00
cc2862666b
feat: detect controlled selection focus effects ( #1562 )
2026-08-03 03:03:44 -07:00
44922d6782
FPFNFIX82 Fix form and fragment diagnostics ( #1561 )
...
* fix(rules): correct form and fragment diagnostics
* fix(rules): handle fragment review edge cases
* fix: handle document-top fragment links
* fix(a11y): parse ids from html tags only
* fix(a11y): resolve static fragment aliases
* fix(a11y): retain known fragment targets
* fix(a11y): tokenize html id attributes
* fix: preserve known fragment IDs in mixed spreads
* fix: preserve known fragment ID defaults
2026-08-03 03:03:00 -07:00
3a93a34beb
FPFNFIX82: prove effect cleanup ownership ( #1564 )
2026-08-02 23:39:53 -07:00
02e3188d4b
Add InstancedMesh rules for Three.js and R3F ( #1560 )
2026-08-02 23:01:55 -07:00
4e4740dde3
FPFNFIX82: ignore type-only parent-data references ( #1557 )
...
* fix(no-pass-data-to-parent): ignore type-only refs
* fix(no-pass-data-to-parent): preserve angle assertion flow
2026-08-02 21:49:56 -07:00
4c610803cb
FPFNFIX82: detect stale async request error clears ( #1556 )
...
* feat(rule): detect unowned async error clears
* fix(no-unowned-async-error-clear): require ownership guard
* fix(no-unowned-async-error-clear): preserve keyed component proof
2026-08-02 21:49:37 -07:00
37427c915c
fix(effect-needs-cleanup): recognize reconnect cleanup ( #1555 )
2026-08-02 21:49:15 -07:00
19f2148e00
FPFNFIX82 Fix CSS-reserved image dimensions ( #1550 )
...
* fix(rule): recognize CSS-reserved image layout
* fix(rule): scope static CSS image evidence
* fix(no-img-without-dimensions): compose CSS with classes
* fix(no-img-without-dimensions): parse layered CSS
* fix(no-img-without-dimensions): ignore interaction-only CSS
* fix(no-img-without-dimensions): expand selector functions
* fix(no-img-without-dimensions): parse CSS with Lightning CSS
* fix(no-img-without-dimensions): model flex axes
* test(evals): stabilize manifest verification timeout
* test(evals): reset manifest operation deadlines
* fix(no-img-without-dimensions): honor nested CSS cascade
* fix(no-img-without-dimensions): compose Tailwind with CSS
* fix(no-img-without-dimensions): resolve same-layer cascade
2026-08-02 21:48:52 -07:00
91ebe85fdc
FPFNFIX82 Fix symbol-only control names ( #1554 )
2026-08-02 17:30:49 -07:00
b02bc694f1
FPFNFIX82: RDFPFN82026: preserve mixed effect chains ( #1545 )
...
* fix(rules): detect mixed effect chains
* fix(no-effect-chain): preserve channel lifecycles
* fix(no-effect-chain): preserve external sync boundaries
* fix(no-effect-chain): ignore setter value helpers in cleanup
2026-08-02 07:48:32 -07:00
f7dbdfa399
FPFNFIX82: RDFPFN82026: exclude media latches from all-state resets ( #1547 )
...
* fix(rules): exclude media latches from all-state resets
* test(rules): retain editable reset finding
2026-08-02 03:27:12 -07:00
7f29ecaa32
FPFNFIX82: RDFPFN82026: recognize media failure latches ( #1546 )
...
* fix(rules): recognize media failure latches
* fix(rules): tighten media lifecycle proof
2026-08-02 03:14:02 -07:00
8a22de1263
fix(rules): ignore empty ref registries ( #1544 )
2026-08-02 03:13:59 -07:00
c3683a2850
feat(cli): make the interactive report the default ( #1542 )
...
Co-authored-by: Rayhan Noufal Arayilakath <me@rayhanadev.com >
2026-08-02 01:09:19 -07:00
0b673ccb76
chore: version packages ( #1462 )
2026-07-31 22:57:26 -07:00
5268cb4c5d
fix: [server-auth-actions] skip credential-establishing endpoints ( #1540 )
...
* fix(server-auth-actions): skip credential-establishing actions
The server-auth-actions rule now correctly skips server actions that
perform credential-establishing operations (signup, signin, OTP
verification, password reset) by detecting calls to auth SDK methods
like supabase.auth.signUp(), auth.signInWithPassword(), and
auth.verifyOtp().
These actions legitimately run for anonymous callers, so requiring
authentication would be incorrect. This resolves the documented false
positive where credential-establishing endpoints were incorrectly
flagged as unauthenticated privileged operations.
Closes #1538
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* test(server-auth-actions): cover credential SDK boundaries
* fix(server-auth-actions): verify auth provider receivers
* fix(server-auth-actions): require credential action intent
* fix(server-auth-actions): recognize direct auth namespaces
* fix(server-auth-actions): require leading credential intent
* fix(server-auth-actions): cover credential action aliases
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-31 21:01:31 -07:00
a9a1f40c8b
fix(effect-needs-cleanup): recognize Supabase channel cleanup ( #1541 )
...
* fix(effect-needs-cleanup): recognize removeChannel/removeAllChannels/dispose cleanup
- Add removeChannel and removeAllChannels to GLOBAL_RELEASE_METHOD_NAMES
- Add cleanup verbs to .on() paired release verbs for Supabase chains
- Add special case for .on() calls without handles in chains
- Add comprehensive unit tests for Supabase and Jitsi patterns
Fixes #1539
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* chore: add changeset for #1539 fix
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
* refactor(rule): localize Supabase cleanup verbs
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Skosh <skoshx@users.noreply.github.com >
Co-authored-by: Aiden Bai <aiden.bai05@gmail.com >
2026-07-31 20:50:25 -07:00
19387631f2
fix(rule): resolve useCallback pointer capture handlers ( #1524 )
2026-07-31 20:27:27 -07:00
992205a31b
fix(rule): detect default clobbers reaching JSX ( #1526 )
2026-07-31 17:12:25 -07:00
9418a1c01f
RDFPFN792026: recognize external effect synchronization ( #1523 )
...
* fix: recognize external effect synchronization
* test: preserve mixed deferred effect work
2026-07-31 17:12:09 -07:00
b479d7d777
RDFPFN792026: prove ref-owned timer cleanup ( #1522 )
...
* fix(rule): prove ref-owned timer cleanup
* fix(rule): preserve local resource cleanup aliases
* fix(rule): prove socket owner listener cleanup
2026-07-31 17:11:53 -07:00
c672551e42
fix(exhaustive-deps): gate custom hook analysis ( #1509 )
2026-07-31 17:11:38 -07:00
a8115b8257
fix(no-flush-sync): allow awareness selection integrations ( #1508 )
2026-07-31 17:11:22 -07:00
0cc5efbf21
RDFPFN792026: recognize compound stale-request guards ( #1499 )
...
* fix(rule): recognize compound stale-request guards
* fix(rule): continue cleanup scans after safe try blocks
* fix(rule): allow loose compound sequence guards
* fix(rules): accept equivalent cleanup returns
* fix(rule): scope cleanup proof to async invocation paths
* fix(rule): prove conditional cleanup coverage
* fix(rule): bound conditional invocation proofs
* fix(rule): resolve initialized mutable effect helpers
2026-07-31 17:11:04 -07:00
adcee586ad
RDFPFN792026: recognize settling componentDidUpdate guards ( #1495 )
...
* fix(oxlint-plugin): recognize settling did-update guards
* fix(oxlint-plugin): preserve state convergence sources
* fix(oxlint-plugin): reject unstable did-update guards
* fix(oxlint-plugin): close did-update guard review gaps
2026-07-31 17:10:46 -07:00
3d67ca13a2
RDFPFN792026: recognize default HoC feature exports ( #1489 )
...
* fix(oxlint): recognize default HoC feature exports
* fix(oxlint): reject mutable HoC export aliases
* fix(oxlint): unwrap typed HoC export arguments
* fix(oxlint): trace HoC export specifiers
* fix(oxlint): trace composed HoC exports
* fix(oxlint): recognize default HoC export records
* fix(no-multi-comp): trace CommonJS feature exports
* fix(no-multi-comp): trace exported component identity
* fix(rules): preserve compound component members
2026-07-31 17:10:27 -07:00
6b64dfaf9e
RDFPFN792026: detect state updater side effects ( #1525 )
...
* RDFPFN792026: detect state updater side effects
* fix: accept nullish local collection initialization
* fix: preserve updater-local mutable builders
* fix: detect setter callback prop variants
* fix(rule): preserve updater-local mutable receivers
* fix(rule): tighten updater assignment provenance
* fix(rule): detect external platform append mutations
* fix(rule): close state updater parity gaps
* fix(rule): preserve local updater values
* fix(rule): narrow lazy initializer functions
* fix(rule): prove updater property factories
* fix(rule): prove immutable updater dates
* fix(rule): tighten immutable date provenance
* fix(rule): prove immutable date receiver chains
* fix(rule): replay updater property overwrites
* fix(rule): honor dayjs wrapper depth
* fix(cache): fingerprint dayjs mutation graph
* fix: track deep Day.js configuration dependencies
* fix: preserve module service side effects
* fix(cache): bound dependency graph traversal
* fix(rule): ignore unreachable prior state setters
* fix(rule): keep nested component helpers local
* fix(rule): keep unresolved nested helpers conservative
* fix(rule): ignore dead ternary updater branches
* fix(rule): fail closed at dayjs config frontier
2026-07-31 08:18:35 -07:00
a81b3d6573
fix(js-hoist-intl): respect dynamic utility inputs ( #1507 )
2026-07-31 06:45:41 -07:00
57743f827d
RDFPFN792026: recognize mounted callback-ref state ( #1506 )
...
* fix(react): recognize mounted callback-ref state
* fix(react): trace callback ref mount sources
* fix(react): reject computed callback ref writers
* fix(react): detect indirect callback ref writers
* fix(react): inspect only setState payload sources
* fix(react): constrain post-mount source execution
* fix(react): trace invoked post-mount helpers
* fix(rules): harden callback ref field discovery
* fix(rules): share mutation receiver alias tracking
* fix(rules): require fully post-mount state payloads
* fix(rules): reject impure callback ref writers
* fix(rules): prove callback ref value provenance
* fix(rules): track callback ref handler aliases
* fix(rules): inspect nested mutation call writers
* fix(rules): preserve measured mount state provenance
* fix(rules): harden mounted ref provenance
* fix(rules): harden mounted ref execution proofs
2026-07-31 06:45:08 -07:00
443082ae30
RDFPFN792026: preserve ordered shared receiver awaits ( #1521 )
...
* fix(rule): preserve ordered shared receiver awaits
* fix(rule): isolate nested await loops
* fix(rule): scope ordered await exemptions
* fix(async-await-in-loop): narrow ordered output proof
2026-07-31 03:21:59 -07:00
b07af9db5f
fix: preserve guarded createRef persistence ( #1520 )
2026-07-31 01:32:47 -07:00
8170ba24e8
RDFPFN792026: ignore focus-forwarding static wrappers ( #1515 )
...
* fix(a11y): ignore focus-forwarding static wrappers
* fix(a11y): preserve named forwarding handlers
* fix(a11y): preserve wrapped backdrop handlers
* fix(a11y): retain conditional blocker diagnostics
2026-07-30 23:51:15 -07:00
660200e54a
RDFPFN792026: prove render callback prop provenance ( #1514 )
...
* fix(rule): prove custom hook callback origin
* fix(rule): scope options prop provenance
* fix(rule): trace chained hook prop callbacks
* test(rule): preserve defaulted prop options
2026-07-30 23:17:35 -07:00
29e35d59bd
fix(security): ignore client secret metadata literals ( #1513 )
2026-07-30 22:27:05 -07:00
de6d2802c4
RDFPFN792026: avoid local live-state helper false positives ( #1512 )
...
* fix(react): tighten live-state callback provenance
* fix(react): preserve nested callback provenance
2026-07-30 22:09:55 -07:00
fb5f881e74
fix(rule): treat custom hook calls as opaque ( #1511 )
2026-07-30 21:12:23 -07:00
65539afe9b
RDFPFN792026: preserve external callback synchronization ( #1532 )
...
* fix(rule): preserve external callback synchronization
* fix(rule): ignore callback registration payloads
* fix(rule): retain reducer state mirrors
2026-07-30 20:57:49 -07:00
d81eedac8e
RDFPFN792026 Fix prefer-use-effect-event capture listener matching ( #1527 )
...
* fix prefer-use-effect-event capture listeners
* fix(rule): harden listener argument matching
2026-07-30 20:43:11 -07:00
3a0b9a0c5e
fix(rule): preserve copied external snapshots ( #1510 )
2026-07-30 20:39:25 -07:00
8402820411
fix only-export-components Vite config callbacks ( #1531 )
2026-07-30 20:32:08 -07:00
github-actions[bot]