Files
millionco__react-doctor/.changeset/fix-1757-headers-helper.md
Skosh 6ac8b71985 fix(rule): scope GET helper safety to exact calls (#1761)
* fix(nextjs-no-side-effect-in-get-handler): track safe Headers passed through helpers

Fixes #1757

The rule now tracks when a locally-constructed safe object (like
`new Headers()`) is passed as an argument to a same-file helper
function. The corresponding parameter in that helper is treated as
safe, preventing false positives when the helper mutates the response
headers.

Added `collectHelperParameterSafeBindings` utility that maps call
arguments to helper parameters, extending the set of safe bindings
when scanning helper bodies.

Regression tests added for:
- Headers passed to helper as first parameter
- Headers passed as second parameter
- Headers passed via destructured parameter
- Module-level Map still correctly flagged (not locally scoped)

Co-authored-by: Skosh <skoshx@users.noreply.github.com>

* chore: add changeset for #1757 fix

Co-authored-by: Skosh <skoshx@users.noreply.github.com>

* fix(rule): scope GET helper safety by call

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Skosh <skoshx@users.noreply.github.com>
Co-authored-by: Aiden Bai <aiden@million.dev>
2026-09-05 14:29:42 -07:00

377 B

oxlint-plugin-react-doctor
oxlint-plugin-react-doctor
patch

Fix false positive in nextjs-no-side-effect-in-get-handler when locally-built Headers object is passed to a same-file helper that mutates it.

The rule now transfers locally-created response object safety through the exact same-file helper call. Calls that pass external state to the same helper remain reportable.

Fixes #1757