You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(deps): update all non-major dependencies - #151
#215915cf592 Thanks @ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.
react-x/purity: builtin member resolution no longer follows computed or unknown middle segments (ex: window[fetch], window.myLibrary.fetch), preventing false reports of non-builtin calls. (#2074)
🏗️ Internal
@eslint-react/eslint: added dual-purpose getText for direct or callback-style source text extraction, replacing repeated context.sourceCode.getText wrappers across packages. (#2073)
react-x/purity: now reports Date calls during render, including Date(), Date(arg), and window.Date(); unlike new Date(arg), Date(arg) ignores its arguments and always returns the current time. (#2071) Thanks to @aki05162525!
🏗️ Internal
Bumped effect and @effect/platform-node to 4.0.6, @tanstack/react-router to 1.170.46, @tanstack/react-start to 1.169.4, and eslint-plugin-de-morgan to 2.3.0.
react-x/set-state-in-effect: the ref-derived parameter exemption now also applies to helpers wrapped in useCallback (ex: measure(ref.current) where measure = useCallback((el) => { setWidth(el.offsetWidth); }, [])). (#2065) Thanks to @amhunt!
react-x/set-state-in-effect: a helper call behind a ref-derived guard (if, ternary, short-circuit, or early return) now exempts the setState calls it reaches, as a setState written in its place would be (ex: if (!anchorRef.current) return; commitPosition(0, true);); call sites are judged individually. (#2065) Thanks to @amhunt!
New Contributors
Andrew Hunt (@amhunt) made their first contribution in #2065.
react-dom/no-unsafe-target-blank: the suggested fix now adds rel="noreferrer" instead of rel="noreferrer noopener", since noreferrer already implies noopener per the HTML spec; values combining both tokens remain valid. (#2068)
Reverted the component-scope-bounded identifier resolution introduced in v5.28.3, including the per-component single-report attribution; class declarations in a component body remain recognized as per-render constructions. (#2062)
Affected rules:
react-x/no-unstable-context-value
react-x/no-unstable-default-props
📝 Documentation
Updated the AST Explorer links across the website docs and recipes.
🏗️ Internal
@eslint-react/var: removed the boundary option from resolve and resolveObjectType, and the ClassDeclaration resolution in resolveObjectType, following the revert. (#2062)
Renamed the Jsx-prefixed @eslint-react/core exports to all-caps JSX (ex: JsxConfig → JSXConfig, isJsxLike → isJSXLike). (#2061)
Identifier resolution is now bounded by the enclosing component scope, so render-scoped values referenced from nested callbacks (ex: items.map((item) => <Context.Provider value={foo}>)) are now detected, values declared outside the component (ex: module-level constants) are treated as stable, and nested components report each value only once, attributed to the innermost component. (#2060)
Affected rules:
react-x/no-unstable-context-value
react-x/no-unstable-default-props
Class declarations (ex: class Foo {} in a component body) are now recognized as per-render constructions, so using one as a context value or default prop is now reported. (#2060)
Affected rules:
react-x/no-unstable-context-value
react-x/no-unstable-default-props
🏗️ Internal
@eslint-react/var: resolve and resolveObjectType now accept a boundary option that bounds scope-chain traversal to an enclosing component or hook; resolveObjectType also resolves ClassDeclaration nodes. (#2060)
Bumped typescript-eslint to 8.72.0, fumadocs-core and fumadocs-ui to 16.17.7, fumadocs-mdx to 15.4.8, lucide-react to 1.60.0, and typedoc-plugin-markdown to 4.14.1.
Website: fixed a build failure caused by an unquoted : sequence in the YAML frontmatter description of the react-x/use-memo doc; the rule scaffold script now emits a YAML-safe quoted description so scaffolded rules cannot reintroduce the issue.
📝 Documentation
Aligned the react-debug/jsx rule doc messages with the actual JSON report format.
Corrected the documented minimum ESLint version to 10.0.0 in the READMEs and getting-started guides.
Documented per-layer isolated testing in the fact-based rule implementation patterns guide.
Generalized the isAPI/isAPICall docs and updated the custom rule samples to use is.APICall. (#2059)
🏗️ Internal
Added unit tests for the react-x immutability rule modules (collect, effects, helpers, origins). (#2056)
react-dom/no-unknown-property: fixed a false positive where the React camelCase SVG prop renderingIntent was reported as an unknown property, including on code produced by this rule's own autofix for rendering-intent. (#2055)
react-jsx/no-useless-fragment: the auto-fixer no longer unwraps fragments outside JSX whose children are all whitespace (ex: const x = <> </>; or return <>\n</> with allowExpressions: false); the previous fix produced syntactically invalid JavaScript such as const x = ;. These fragments are still reported, just without a fix. (#2055)
📝 Documentation
Aligned rule docs, comments, and diagnostic messages with actual behavior across the plugins. (#2055)
🏗️ Internal
Bumped eslint to 10.13.0, pnpm to 12.14.0, tsl-dx to 0.15.0, @effect/language-service to 0.87.5, and lucide-react to 1.59.0.
@eslint-react/eslint-plugin: the general-purpose presets now enable JSX syntax support via languageOptions.parserOptions.ecmaFeatures.jsx: true, so you no longer need to configure it yourself. (#2049)
Affected presets:
recommended
recommended-typescript
recommended-type-checked
strict
strict-typescript
strict-type-checked
🏗️ Internal
Bumped fumadocs-core and fumadocs-ui to 16.17.5, and lucide-react to 1.58.0.
@eslint-react/jsx: resolveAttributeValue now handles a parser-tolerated JSXFragment in attribute value position (ex: <a href=<></> />), reporting it as kind "element" instead of falling through to undefined; as a result, react-dom/no-missing-iframe-sandbox now reports <iframe sandbox=<></> /> instead of silently skipping it. (#2048)
react-jsx/no-key-after-spread: the fast-path text check now matches key assignments with whitespace around = (ex: <div {...props} key = {id} /> or a newline before =), so such elements are no longer silently skipped. (#2043) Thanks to @amir-rahmanii!
react-jsx/no-children-prop: a children prop alongside nested children content (ex: <div children="x">y</div>, createElement("div", { children: "x" }, "y")) is no longer reported by this rule — that conflict case belongs to react-jsx/no-children-prop-with-children — removing the unsafe merge suggestion and the duplicate diagnostics. (#2044) Thanks to @amir-rahmanii!
react-jsx/no-children-prop-with-children: empty expression containers (ex: {}, {/* comment */}) are no longer treated as meaningful children, so <div children="x">{/* comment */}</div> is no longer reported. (#2045) Thanks to @amir-rahmanii!
📝 Documentation
react-naming-convention/ref-name: corrected the additionalRefHooks example to use the /pattern/flags RegExp string form; a bare (a|b) string is treated as exact equality and never matches. (#2042) Thanks to @amir-rahmanii!
The settings docs examples for the additional hooks settings now use full RegExp strings. (#2047)
🏗️ Internal
@eslint-react/jsx: hasChildren now treats empty expression containers as non-meaningful, aligned with getChildren. (#2045)
react-x: refactored the internals of set-state-in-effect, set-state-in-render, and static-components for readability; no behavior change. (#2041)
Bumped vitest to 5.0.5, next to 16.4.2, fumadocs-core and fumadocs-ui to 16.17.4, and undici to 8.12.2.
Lifecycle methods defined as class properties (ex: componentDidMount = () => { this.setState(...) }, including type-expression-wrapped values) are now reported just like the method shorthand form. (#2039)
Affected rules:
react-x/no-set-state-in-component-did-mount
react-x/no-set-state-in-component-did-update
react-x/no-set-state-in-component-will-update
Effect cleanups are now recognized when the useEffect call is nested in an outer return (ex: return useEffect(() => () => { ... })), so resources released there are no longer reported as leaked. (#2039)
Affected rules:
react-web-api/no-leaked-event-listener
react-web-api/no-leaked-fetch
react-web-api/no-leaked-intersection-observer
react-web-api/no-leaked-interval
react-web-api/no-leaked-resize-observer
react-web-api/no-leaked-timeout
🏗️ Internal
@eslint-react/ast: added the Check.isFunctionOrClass and Check.isTypeOrChainExpression helpers; parent lookups across ast, core, and the rules are now bounded at enclosing function/class boundaries. (#2039)
@eslint-react/core: isUseEffectSetupCallback and isUseEffectCleanupCallback reimplemented on bounded parent lookups. (#2039)
react-web-api/no-leaked-event-listener: cleanups returned through conditional expressions (ex: return cond ? () => window.removeEventListener(...) : null) are now recognized and no longer reported. (#2038)
react-web-api/no-leaked-fetch: effect setups wrapped in type expressions (ex: useEffect((() => { fetch(...) }) as any, [])) are now recognized. (#2038)
react-debug/function-component: computed string-literal displayName keys (ex: App["displayName"] = "...") are now recognized. (#2038)
📝 Documentation
Revised the rule implementation pattern guides and refined the core ideas and layer dependency model in the fact-based rule implementation docs. (#2034, #2035)
🏗️ Internal
@eslint-react/core: accuracy and consistency fixes in detection helpers. (#2038)
react-x: the custom tsl config now enforces the fact-based layer dependency order. (#2036)
Bumped react and react-dom to 19.3.1, and next to 16.4.1.
@eslint-react/core: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. (#2033)
@eslint-react/core: component and hook collectors now use sequential integer keys instead of random randomBytes hex keys, removing node:crypto from the lint hot path. (#2032) Thanks to @kurtextrem!
Bumped effect to 4.0.4, ts-pattern to 5.9.2, fumadocs-core and fumadocs-ui to 16.17.3, lucide-react to 1.57.0, oxlint to 1.88.0, typedoc-plugin-markdown to 4.14.0, and undici to 8.12.1.
react-x/set-state-in-effect: a setState on the right side of a short-circuit operator (&&, ||, ??) is now exempt when the left operand is ref-derived (ex: ref.current && setData(1)), matching the existing ref-gated conditional exemption; a left-side setState still runs unconditionally and stays reported. (#2031)
react-x/set-state-in-effect: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex: useEffect(setup, [helper])) is no longer mistaken for the setup and its setState calls stay unattributed. (#2031)
react-x/set-state-in-effect: arrow function parameters are no longer collected as callback-body setter references (ex: the setState in useMemo((setState) => ..., [])); only actual callback bodies are collected (ex: useMemo(() => setState, [])). (#2031)
The name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex: export const useAnchor = () => useRef(null)) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. (#2029) Closes #2026.
Affected rules:
react-naming-convention/context-name
react-naming-convention/id-name
react-naming-convention/ref-name
The name lookup no longer crosses containers or derived values (ex: const refs = [useRef(null)], const n = useRef(0) + 1), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex: { [key]: useRef(null) }) no longer fall back to the outer variable. (#2030)
An enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex: const refs = { myRef: useRef(0) }); computed keys with string literals (ex: refs["value"] = useRef(null)) are now checked, and unresolvable computed keys are no longer reported. (#2028)
Affected rules:
react-naming-convention/context-name
react-naming-convention/id-name
react-naming-convention/ref-name
react-naming-convention/ref-name: immediate dereferences of the useRef result through TypeScript type wrappers (ex: (useRef(null) as { current: null }).current, useRef(null)!.current) are no longer reported, extending the #1375 fix. (#2028)
react-x/no-unused-props: improved prop usage detection. Props parameters with default values (ex: function Component(props: Props = defaultProps)) are now unwrapped and analyzed, props aliased to a local variable (ex: const alias = props) are tracked through the alias, and template literals without substitutions (ex: props[`foo`]) are recognized as static prop keys. (#2021)
🐞 Fixes
react-x/no-unused-props: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. (#2021)
react-x/set-state-in-effect: ref-derived values that reach the setState argument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. (#2027)
react-x/set-state-in-effect: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. (#2027)
react-x/set-state-in-effect: a .current read rooted at a function parameter is now recognized as a ref read (ex: setReferenceElement(anchor?.current) where anchor is a RefObject prop); previously only parameters named ref or ending in Ref were recognized. (#2027)
react-x/no-unused-class-component-members: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields, private/protected members, and members of non-exported classes are still reported. (#2024)
🏗️ Internal
Ordered message ids by first usage and unified default/suggestion message id naming across react-dom, react-jsx, react-web-api, and react-x rules. (#2022)
react-dom/no-unsafe-target-blank: added an allowReferrer option (default: false). When enabled, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#2019) Closes #2012.
🏗️ Internal
@eslint-react/ast: added hasParent and hasEnclosingTryBlock shortcuts to Traverse. (#2016)
@eslint-react/ast: renamed the types module to tree and narrowed the Extract.unwrap result type. (#2017)
@eslint-react/core: removed the unused REACT_BUILTIN_HOOK_NAMES constant.
Bumped tsdown to 0.23.1, @effect/platform-node to 4.0.3, pnpm to 12.11.2, @types/node to 26.6.5, setup-uv to v10.3.0, and fumadocs and lucide-react in the website.
react-x/set-state-in-effect: optional chaining in a setState argument (ex: setData(ref.current?.value), setWidth(el?.offsetWidth ?? 0) where el is ref-derived) no longer defeats the ref-value exemption; the ChainExpression wrapper is now unwrapped during ref-source detection. (#2011)
📝 Documentation
Aligned rule documentation with the current react.dev reference docs. (#2013)
react-x/rules-of-hooks: removed the incorrect FIX feature declaration; the rule does not provide an auto-fix and is no longer advertised as fixable. (#2009)
🏗️ Internal
Added edge-case test specs from the v5.24.7 change review covering react-x/immutability, react-x/set-state-in-render, react-web-api/no-leaked-event-listener, and the leaked-observer rules.
Bumped next to 16.4.0, vite to 8.3.3, and related dependencies.
react-x/immutability: no longer reports rebinding a plain local alias of props/state as a mutation; destructured props rebinding and member writes through aliases are still reported. (#1995)
react-x/set-state-in-render: setState calls after nested component or hook declarations are now attributed to the outer component again. (#2004)
react-x/set-state-in-render: anonymous callbacks passed directly to memo()/forwardRef() are now treated as component render functions. (#1998)
react-web-api/no-leaked-fetch: signal alias chains are now resolved recursively, so fetches with aliased signals correctly pair with their cleanup abort call. (#1997)
react-web-api/no-leaked-event-listener: bare global addEventListener(...) calls now pair with matching removeEventListener(...) cleanup calls. (#1996)
react-web-api/no-leaked-event-listener: a signal destructured from new AbortController() is now recognized. (#2001)
disconnect() / unobserve(...) now only count as cleanup in the cleanup phase; useRef-held observer instances are tracked; unobserve(...) inside the observer callback no longer pairs with observe(...). (#2002, #2003)
Affected rules:
react-web-api/no-leaked-resize-observer
react-web-api/no-leaked-intersection-observer
🏗️ Internal
Bumped typescript-eslint to 8.71.1 and postcss to 8.5.29.
react-x/no-unused-props: computed member access and destructuring with an identifier key (ex: props[key], const { [key]: value } = props) no longer count as usage of a prop named after the key; the rule now bails out on such dynamic keys instead of reporting actually-used props as unused. (#1994)
react-x/set-state-in-effect: object-pattern destructuring of the useState tuple is now resolved by numeric key: a name bound at key 0 (ex: const { 0: value } = useState()) is no longer mistaken for the setter, while key 1 (ex: const { 1: setData } = useState()) is still recognized. (#1994)
react-x/set-state-in-render: same useState object-pattern destructuring fix as set-state-in-effect. (#1994)
Self-linted rule implementations with eslint-plugin-eslint-plugin, removing redundant empty defaultOptions declarations and enforcing meta.defaultOptions for rules with options. (#1993) Thanks to @rakleed and @Rel1cx!
Bumped effect to 4.0.1, pnpm to 12.9.1, fumadocs-core and fumadocs-ui to 16.16.1, lucide-react to 1.52.0, tsl-dx to 0.14.0, and tinybench to 6.2.0. Thanks to @Rel1cx!
@eslint-react/core, @eslint-react/var, the react-dom plugin, and the react-x plugin: replaced in operator checks with the hasProperty helper from @local/eff.
react-x/set-state-in-effect: more value shapes are recognized as ref-derived setState arguments: interpolations in template literals (ex: setData(`${ref.current}`)), tagged templates (both the quasi and a ref-derived tag), object and array literals (ex: setData({ value: ref.current })), and spreads (ex: setData({ ...ref.current })) — previously these fell through to the default case and were reported. (#1988)
📝 Documentation
Added eslint-config-xo-react to the website's community presets.
🏗️ Internal
@local/eff: added predicate combinators and type guards synced with effect, and migrated call sites across the workspace to them. (#1989)
Reworked to the fact-based implementation pattern — fact collection (collect.ts), provenance resolution (origins.ts), and violation inference (effects.ts) are now separate modules, with lib.ts replaced by a pure-AST helpers.ts; set-state-in-effect again classifies a hook name configured as both additionalStateHooks and additionalEffectHooks as a state hook first. (#1983, #1985, #1986)
Affected rules:
react-x/set-state-in-effect
react-x/set-state-in-render
react-x/use-memo
react-x/use-state: aligned the nested-expression collectors' visitor keys to callee-first order, matching eslint-visitor-keys; no behavior change. (#1988)
Migrated package unit tests to the shared @local/testkit helpers. (#1987)
Renamed message ids to kebab-case across all plugins. (#1984)
Bumped fumadocs-core and fumadocs-ui to 16.15.18, fumadocs-mdx to 15.4.6, lucide-react to 1.50.0, and @types/node to 26.6.4.
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^2.31.0→^2.31.1^4.7.2→^4.8.1^5.8.9→^5.28.8^5.8.9→^5.28.8^8.0.2→^8.0.3^8.60.0→^8.72.0^8.60.0→^8.72.0>=6.1.5→>=6.1.7^10.4.1→^10.13.0^4.16.2→^4.17.1^3.2.0→^3.4.2^8.0.0→^8.1.0^5.5.6→^5.5.7^3.4.0→^3.9.0>=3.4.2→>=3.4.4^17.6.0→^17.13.0^3.1.4→^3.1.524→24.22.1^0.52.0→^0.74.0^1.0.0→^1.89.0>=4.0.4→>=4.0.7](https://renovatebot.com/diffs/npm/picomatch@>=4.0.0 <4.0.4/4.0.4/4.0.7)11.5.0+sha512.dbfcc4f81cf48597afd4bc391ffdf12c11f1a9fb83a395bfa6b0a2d9cc2fd8ffebafdb1ccbd529632153f793904c2615b7f09fe1a345473fd1c35845172a8eb1→11.28.8^3.0.0→^3.9.10^3.8.3→^3.9.10^19.14.1→^19.17.2^8.60.0→^8.72.0^2.0.0→^2.1.0>=2.8.3→>=2.9.1](https://renovatebot.com/diffs/npm/yaml@>=2.0.0 <2.8.3/2.8.3/2.9.1)Release Notes
changesets/changesets (@changesets/cli)
v2.31.1Compare Source
Patch Changes
15cf592Thanks @ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successfulnpm info --jsonoutput in an array. The unwrapped output madechangeset publishtreat every package as unpublished and fail attempting to republish existing versions.eslint-community/eslint-plugin-eslint-comments (@eslint-community/eslint-plugin-eslint-comments)
v4.8.1Compare Source
Bug Fixes
no-use,require-description: key directive-comment cache onadditionalDirectives(#329) (de11b0e)v4.8.0Compare Source
Features
no-use,require-description:additionalDirectivesoption (#267) (d9a7e4d)Rel1cx/eslint-react (@eslint-react/eslint-plugin)
v5.28.8Compare Source
🐞 Fixes
react-x/purity: builtin member resolution no longer follows computed or unknown middle segments (ex:window[fetch],window.myLibrary.fetch), preventing false reports of non-builtin calls. (#2074)🏗️ Internal
@eslint-react/eslint: added dual-purposegetTextfor direct or callback-style source text extraction, replacing repeatedcontext.sourceCode.getTextwrappers across packages. (#2073)Full Changelog: Rel1cx/eslint-react@v5.28.7...v5.28.8
v5.28.7Compare Source
🐞 Fixes
react-x/purity: now reportsDatecalls during render, includingDate(),Date(arg), andwindow.Date(); unlikenew Date(arg),Date(arg)ignores its arguments and always returns the current time. (#2071) Thanks to @aki05162525!🏗️ Internal
effectand@effect/platform-nodeto4.0.6,@tanstack/react-routerto1.170.46,@tanstack/react-startto1.169.4, andeslint-plugin-de-morganto2.3.0.New Contributors
Full Changelog: Rel1cx/eslint-react@v5.28.6...v5.28.7
v5.28.6Compare Source
🐞 Fixes
react-x/set-state-in-effect: the ref-derived parameter exemption now also applies to helpers wrapped inuseCallback(ex:measure(ref.current)wheremeasure = useCallback((el) => { setWidth(el.offsetWidth); }, [])). (#2065) Thanks to @amhunt!react-x/set-state-in-effect: a helper call behind a ref-derived guard (if, ternary, short-circuit, or early return) now exempts thesetStatecalls it reaches, as asetStatewritten in its place would be (ex:if (!anchorRef.current) return; commitPosition(0, true);); call sites are judged individually. (#2065) Thanks to @amhunt!New Contributors
Full Changelog: Rel1cx/eslint-react@v5.28.5...v5.28.6
v5.28.5Compare Source
✨ New
react-dom/no-unsafe-target-blank: the suggested fix now addsrel="noreferrer"instead ofrel="noreferrer noopener", sincenoreferreralready impliesnoopenerper the HTML spec; values combining both tokens remain valid. (#2068)🏗️ Internal
viteto8.3.5andlucide-reactto1.61.0.Full Changelog: Rel1cx/eslint-react@v5.28.4...v5.28.5
v5.28.4Compare Source
🐞 Fixes
Reverted the component-scope-bounded identifier resolution introduced in v5.28.3, including the per-component single-report attribution; class declarations in a component body remain recognized as per-render constructions. (#2062)
Affected rules:
react-x/no-unstable-context-valuereact-x/no-unstable-default-props📝 Documentation
🏗️ Internal
@eslint-react/var: removed theboundaryoption fromresolveandresolveObjectType, and theClassDeclarationresolution inresolveObjectType, following the revert. (#2062)Jsx-prefixed@eslint-react/coreexports to all-capsJSX(ex:JsxConfig→JSXConfig,isJsxLike→isJSXLike). (#2061)fumadocs-mdxto15.4.9.Full Changelog: Rel1cx/eslint-react@v5.28.3...v5.28.4
v5.28.3Compare Source
✨ New
Identifier resolution is now bounded by the enclosing component scope, so render-scoped values referenced from nested callbacks (ex:
items.map((item) => <Context.Provider value={foo}>)) are now detected, values declared outside the component (ex: module-level constants) are treated as stable, and nested components report each value only once, attributed to the innermost component. (#2060)Affected rules:
react-x/no-unstable-context-valuereact-x/no-unstable-default-propsClass declarations (ex:
class Foo {}in a component body) are now recognized as per-render constructions, so using one as a context value or default prop is now reported. (#2060)Affected rules:
react-x/no-unstable-context-valuereact-x/no-unstable-default-props🏗️ Internal
@eslint-react/var:resolveandresolveObjectTypenow accept aboundaryoption that bounds scope-chain traversal to an enclosing component or hook;resolveObjectTypealso resolvesClassDeclarationnodes. (#2060)typescript-eslintto8.72.0,fumadocs-coreandfumadocs-uito16.17.7,fumadocs-mdxto15.4.8,lucide-reactto1.60.0, andtypedoc-plugin-markdownto4.14.1.Full Changelog: Rel1cx/eslint-react@v5.28.2...v5.28.3
v5.28.2Compare Source
🐞 Fixes
:sequence in the YAML frontmatter description of thereact-x/use-memodoc; the rule scaffold script now emits a YAML-safe quoted description so scaffolded rules cannot reintroduce the issue.📝 Documentation
react-debug/jsxrule doc messages with the actual JSON report format.10.0.0in the READMEs and getting-started guides.isAPI/isAPICalldocs and updated the custom rule samples to useis.APICall. (#2059)🏗️ Internal
react-ximmutability rule modules (collect,effects,helpers,origins). (#2056)postcssoverride to8.5.31.Full Changelog: Rel1cx/eslint-react@v5.28.1...v5.28.2
v5.28.1Compare Source
🐞 Fixes
react-dom/no-unknown-property: fixed a false positive where the React camelCase SVG proprenderingIntentwas reported as an unknown property, including on code produced by this rule's own autofix forrendering-intent. (#2055)react-jsx/no-useless-fragment: the auto-fixer no longer unwraps fragments outside JSX whose children are all whitespace (ex:const x = <> </>;orreturn <>\n</>withallowExpressions: false); the previous fix produced syntactically invalid JavaScript such asconst x = ;. These fragments are still reported, just without a fix. (#2055)📝 Documentation
🏗️ Internal
eslintto10.13.0,pnpmto12.14.0,tsl-dxto0.15.0,@effect/language-serviceto0.87.5, andlucide-reactto1.59.0.Full Changelog: Rel1cx/eslint-react@v5.28.0...v5.28.1
v5.28.0Compare Source
✨ New
@eslint-react/eslint-plugin: the general-purpose presets now enable JSX syntax support vialanguageOptions.parserOptions.ecmaFeatures.jsx: true, so you no longer need to configure it yourself. (#2049)Affected presets:
recommendedrecommended-typescriptrecommended-type-checkedstrictstrict-typescriptstrict-type-checked🏗️ Internal
fumadocs-coreandfumadocs-uito16.17.5, andlucide-reactto1.58.0.Full Changelog: Rel1cx/eslint-react@v5.27.4...v5.28.0
v5.27.4Compare Source
🐞 Fixes
@eslint-react/jsx:resolveAttributeValuenow handles a parser-toleratedJSXFragmentin attribute value position (ex:<a href=<></> />), reporting it as kind"element"instead of falling through toundefined; as a result,react-dom/no-missing-iframe-sandboxnow reports<iframe sandbox=<></> />instead of silently skipping it. (#2048)Full Changelog: Rel1cx/eslint-react@v5.27.3...v5.27.4
v5.27.3Compare Source
🐞 Fixes
react-jsx/no-key-after-spread: the fast-path text check now matcheskeyassignments with whitespace around=(ex:<div {...props} key = {id} />or a newline before=), so such elements are no longer silently skipped. (#2043) Thanks to @amir-rahmanii!react-jsx/no-children-prop: achildrenprop alongside nested children content (ex:<div children="x">y</div>,createElement("div", { children: "x" }, "y")) is no longer reported by this rule — that conflict case belongs toreact-jsx/no-children-prop-with-children— removing the unsafe merge suggestion and the duplicate diagnostics. (#2044) Thanks to @amir-rahmanii!react-jsx/no-children-prop-with-children: empty expression containers (ex:{},{/* comment */}) are no longer treated as meaningful children, so<div children="x">{/* comment */}</div>is no longer reported. (#2045) Thanks to @amir-rahmanii!📝 Documentation
react-naming-convention/ref-name: corrected theadditionalRefHooksexample to use the/pattern/flagsRegExp string form; a bare(a|b)string is treated as exact equality and never matches. (#2042) Thanks to @amir-rahmanii!🏗️ Internal
@eslint-react/jsx:hasChildrennow treats empty expression containers as non-meaningful, aligned withgetChildren. (#2045)react-x: refactored the internals ofset-state-in-effect,set-state-in-render, andstatic-componentsfor readability; no behavior change. (#2041)vitestto5.0.5,nextto16.4.2,fumadocs-coreandfumadocs-uito16.17.4, andundicito8.12.2.Full Changelog: Rel1cx/eslint-react@v5.27.2...v5.27.3
v5.27.2Compare Source
🏗️ Internal
@tsconfig/node20and@types/nodedependencies to the workspace packages. (#2040)effectand@effect/platform-nodeto4.0.5,import-integrity-lintto1.3.1, andsort-package-jsonto4.1.0. (#2040)Full Changelog: Rel1cx/eslint-react@v5.27.1...v5.27.2
v5.27.1Compare Source
🐞 Fixes
Lifecycle methods defined as class properties (ex:
componentDidMount = () => { this.setState(...) }, including type-expression-wrapped values) are now reported just like the method shorthand form. (#2039)Affected rules:
react-x/no-set-state-in-component-did-mountreact-x/no-set-state-in-component-did-updatereact-x/no-set-state-in-component-will-updateEffect cleanups are now recognized when the
useEffectcall is nested in an outerreturn(ex:return useEffect(() => () => { ... })), so resources released there are no longer reported as leaked. (#2039)Affected rules:
react-web-api/no-leaked-event-listenerreact-web-api/no-leaked-fetchreact-web-api/no-leaked-intersection-observerreact-web-api/no-leaked-intervalreact-web-api/no-leaked-resize-observerreact-web-api/no-leaked-timeout🏗️ Internal
@eslint-react/ast: added theCheck.isFunctionOrClassandCheck.isTypeOrChainExpressionhelpers; parent lookups acrossast,core, and the rules are now bounded at enclosing function/class boundaries. (#2039)@eslint-react/core:isUseEffectSetupCallbackandisUseEffectCleanupCallbackreimplemented on bounded parent lookups. (#2039)Full Changelog: Rel1cx/eslint-react@v5.27.0...v5.27.1
v5.27.0🐞 Fixes
react-web-api/no-leaked-event-listener: cleanups returned through conditional expressions (ex:return cond ? () => window.removeEventListener(...) : null) are now recognized and no longer reported. (#2038)react-web-api/no-leaked-fetch: effect setups wrapped in type expressions (ex:useEffect((() => { fetch(...) }) as any, [])) are now recognized. (#2038)react-debug/function-component: computed string-literaldisplayNamekeys (ex:App["displayName"] = "...") are now recognized. (#2038)📝 Documentation
🏗️ Internal
@eslint-react/core: accuracy and consistency fixes in detection helpers. (#2038)react-x: the customtslconfig now enforces the fact-based layer dependency order. (#2036)reactandreact-domto19.3.1, andnextto16.4.1.Full Changelog: Rel1cx/eslint-react@v5.26.7...v5.27.0
v5.26.7Compare Source
🏗️ Internal
@eslint-react/core: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. (#2033)Full Changelog: Rel1cx/eslint-react@v5.26.6...v5.26.7
v5.26.6Compare Source
🏗️ Internal
@eslint-react/core: component and hook collectors now use sequential integer keys instead of randomrandomByteshex keys, removingnode:cryptofrom the lint hot path. (#2032) Thanks to @kurtextrem!effectto4.0.4,ts-patternto5.9.2,fumadocs-coreandfumadocs-uito16.17.3,lucide-reactto1.57.0,oxlintto1.88.0,typedoc-plugin-markdownto4.14.0, andundicito8.12.1.New Contributors
Full Changelog: Rel1cx/eslint-react@v5.26.5...v5.26.6
v5.26.5Compare Source
🐞 Fixes
react-x/set-state-in-effect: asetStateon the right side of a short-circuit operator (&&,||,??) is now exempt when the left operand is ref-derived (ex:ref.current && setData(1)), matching the existing ref-gated conditional exemption; a left-sidesetStatestill runs unconditionally and stays reported. (#2031)react-x/set-state-in-effect: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex:useEffect(setup, [helper])) is no longer mistaken for the setup and itssetStatecalls stay unattributed. (#2031)react-x/set-state-in-effect: arrow function parameters are no longer collected as callback-body setter references (ex: thesetStateinuseMemo((setState) => ..., [])); only actual callback bodies are collected (ex:useMemo(() => setState, [])). (#2031)Full Changelog: Rel1cx/eslint-react@v5.26.4...v5.26.5
v5.26.4Compare Source
🐞 Fixes
The name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex:
export const useAnchor = () => useRef(null)) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. (#2029) Closes #2026.Affected rules:
react-naming-convention/context-namereact-naming-convention/id-namereact-naming-convention/ref-nameThe name lookup no longer crosses containers or derived values (ex:
const refs = [useRef(null)],const n = useRef(0) + 1), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex:{ [key]: useRef(null) }) no longer fall back to the outer variable. (#2030)Affected rules:
react-naming-convention/context-namereact-naming-convention/id-namereact-naming-convention/ref-nameFull Changelog: Rel1cx/eslint-react@v5.26.3...v5.26.4
v5.26.3Compare Source
🐞 Fixes
An enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex:
const refs = { myRef: useRef(0) }); computed keys with string literals (ex:refs["value"] = useRef(null)) are now checked, and unresolvable computed keys are no longer reported. (#2028)Affected rules:
react-naming-convention/context-namereact-naming-convention/id-namereact-naming-convention/ref-namereact-naming-convention/ref-name: immediate dereferences of theuseRefresult through TypeScript type wrappers (ex:(useRef(null) as { current: null }).current,useRef(null)!.current) are no longer reported, extending the #1375 fix. (#2028)Full Changelog: Rel1cx/eslint-react@v5.26.2...v5.26.3
v5.26.2Compare Source
✨ New
react-x/no-unused-props: improved prop usage detection. Props parameters with default values (ex:function Component(props: Props = defaultProps)) are now unwrapped and analyzed, props aliased to a local variable (ex:const alias = props) are tracked through the alias, and template literals without substitutions (ex:props[`foo`]) are recognized as static prop keys. (#2021)🐞 Fixes
react-x/no-unused-props: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. (#2021)react-x/set-state-in-effect: ref-derived values that reach thesetStateargument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. (#2027)react-x/set-state-in-effect: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. (#2027)react-x/set-state-in-effect: a.currentread rooted at a function parameter is now recognized as a ref read (ex:setReferenceElement(anchor?.current)whereanchoris aRefObjectprop); previously only parameters namedrefor ending inRefwere recognized. (#2027)react-x/no-unused-class-component-members: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields,private/protectedmembers, and members of non-exported classes are still reported. (#2024)🏗️ Internal
react-dom,react-jsx,react-web-api, andreact-xrules. (#2022)Full Changelog: Rel1cx/eslint-react@v5.26.1...v5.26.2
v5.26.1Compare Source
🏗️ Internal
Renamed the internal suggestion message id from
"replace"to"suggest".Affected rules:
react-x/no-context-providerreact-x/no-forward-refreact-x/no-use-contextreact-x/immutability: moved context-dependent helpers fromhelpers.tsintoorigins.tsandeffects.tsto match the fact-based implementation pattern.react-x/globals: movedresolveToFunctionfromhelpers.tstoorigins.ts.Bumped
effectto4.0.3,tsl-dxto0.14.1,@tsconfig/node20to20.1.10, and@types/nodeto20.19.43.📝 Documentation
react-xrules.Full Changelog: Rel1cx/eslint-react@v5.26.0...v5.26.1
v5.26.0Compare Source
✨ New
>=22.0.0to>=20.19.0. (#2020)Full Changelog: Rel1cx/eslint-react@v5.25.0...v5.26.0
v5.25.0Compare Source
✨ New
react-dom/no-unsafe-target-blank: added anallowReferreroption (default:false). When enabled,rel="noopener"alone is accepted and the suggested fix addsrel="noopener"instead ofrel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#2019) Closes #2012.🏗️ Internal
@eslint-react/ast: addedhasParentandhasEnclosingTryBlockshortcuts toTraverse. (#2016)@eslint-react/ast: renamed thetypesmodule totreeand narrowed theExtract.unwrapresult type. (#2017)@eslint-react/core: removed the unusedREACT_BUILTIN_HOOK_NAMESconstant.tsdownto0.23.1,@effect/platform-nodeto4.0.3,pnpmto12.11.2,@types/nodeto26.6.5,setup-uvtov10.3.0, andfumadocsandlucide-reactin the website.Full Changelog: Rel1cx/eslint-react@v5.24.10...v5.25.0
v5.24.10Compare Source
📝 Documentation
no-react-introspectionrule in thereact-x/no-children-countandreact-x/no-children-maprule documentation.🏗️ Internal
Disabled test isolation in the vitest config.
Reordered
react-web-api/no-leaked-event-listenertest specs from typical cases to edge cases. (#2015)Unified
KNOWN_-prefixed constant names. (#2014)Affected rules:
react-x/no-array-index-keyreact-x/no-missing-keyBumped
effectto4.0.2,@effect/platform-nodeto4.0.2,nxto23.3.0,viteto8.3.4,lucide-reactto1.53.0, andpnpmto12.10.1.Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10
v5.24.9Compare Source
🐞 Fixes
react-x/set-state-in-effect: optional chaining in asetStateargument (ex:setData(ref.current?.value),setWidth(el?.offsetWidth ?? 0)whereelis ref-derived) no longer defeats the ref-value exemption; theChainExpressionwrapper is now unwrapped during ref-source detection. (#2011)📝 Documentation
Full Changelog: Rel1cx/eslint-react@v5.24.8...v5.24.9
v5.24.8Compare Source
🐞 Fixes
react-x/rules-of-hooks: removed the incorrectFIXfeature declaration; the rule does not provide an auto-fix and is no longer advertised as fixable. (#2009)🏗️ Internal
react-x/immutability,react-x/set-state-in-render,react-web-api/no-leaked-event-listener, and the leaked-observer rules.nextto16.4.0,viteto8.3.3, and related dependencies.Full Changelog: Rel1cx/eslint-react@v5.24.7...v5.24.8
v5.24.7Compare Source
🐞 Fixes
react-x/immutability: no longer reports rebinding a plain local alias of props/state as a mutation; destructured props rebinding and member writes through aliases are still reported. (#1995)react-x/set-state-in-render:setStatecalls after nested component or hook declarations are now attributed to the outer component again. (#2004)react-x/set-state-in-render: anonymous callbacks passed directly tomemo()/forwardRef()are now treated as component render functions. (#1998)react-web-api/no-leaked-fetch: signal alias chains are now resolved recursively, so fetches with aliased signals correctly pair with their cleanupabortcall. (#1997)react-web-api/no-leaked-event-listener: bare globaladdEventListener(...)calls now pair with matchingremoveEventListener(...)cleanup calls. (#1996)react-web-api/no-leaked-event-listener: asignaldestructured fromnew AbortController()is now recognized. (#2001)disconnect()/unobserve(...)now only count as cleanup in the cleanup phase;useRef-held observer instances are tracked;unobserve(...)inside the observer callback no longer pairs withobserve(...). (#2002, #2003)Affected rules:
react-web-api/no-leaked-resize-observerreact-web-api/no-leaked-intersection-observer🏗️ Internal
typescript-eslintto8.71.1andpostcssto8.5.29.Full Changelog: Rel1cx/eslint-react@v5.24.6...v5.24.7
v5.24.6Compare Source
🐞 Fixes
react-x/no-unused-props: computed member access and destructuring with an identifier key (ex:props[key],const { [key]: value } = props) no longer count as usage of a prop named after the key; the rule now bails out on such dynamic keys instead of reporting actually-used props as unused. (#1994)react-x/set-state-in-effect: object-pattern destructuring of theuseStatetuple is now resolved by numeric key: a name bound at key 0 (ex:const { 0: value } = useState()) is no longer mistaken for the setter, while key 1 (ex:const { 1: setData } = useState()) is still recognized. (#1994)react-x/set-state-in-render: sameuseStateobject-pattern destructuring fix asset-state-in-effect. (#1994)Full Changelog: Rel1cx/eslint-react@v5.24.5...v5.24.6
v5.24.5Compare Source
🏗️ Internal
Self-linted rule implementations with
eslint-plugin-eslint-plugin, removing redundant emptydefaultOptionsdeclarations and enforcingmeta.defaultOptionsfor rules with options. (#1993) Thanks to @rakleed and @Rel1cx!Minor code cleanups. Thanks to @Rel1cx!
Affected rules:
react-web-api/no-leaked-intersection-observerreact-x/no-create-refreact-x/no-nested-lazy-component-declarationsreact-x/use-stateBumped
effectto4.0.1,pnpmto12.9.1,fumadocs-coreandfumadocs-uito16.16.1,lucide-reactto1.52.0,tsl-dxto0.14.0, andtinybenchto6.2.0. Thanks to @Rel1cx!Full Changelog: Rel1cx/eslint-react@v5.24.4...v5.24.5
v5.24.4Compare Source
🏗️ Internal
Full Changelog: Rel1cx/eslint-react@v5.24.3...v5.24.4
v5.24.3Compare Source
🏗️ Internal
@local/eff: minor code optimizations.@eslint-react/shared: minor code optimizations.Full Changelog: Rel1cx/eslint-react@v5.24.2...v5.24.3
v5.24.2Compare Source
🏗️ Internal
@eslint-react/core,@eslint-react/var, thereact-domplugin, and thereact-xplugin: replacedinoperator checks with thehasPropertyhelper from@local/eff.@eslint-react/shared: documentedgetNormalizedSettings.Full Changelog: Rel1cx/eslint-react@v5.24.1...v5.24.2
v5.24.1Compare Source
📝 Documentation
no-react-introspectionrule in thereact-x/no-children-countandreact-x/no-children-maprule documentation.🏗️ Internal
Disabled test isolation in the vitest config.
Reordered
react-web-api/no-leaked-event-listenertest specs from typical cases to edge cases. (#2015)Unified
KNOWN_-prefixed constant names. (#2014)Affected rules:
react-x/no-array-index-keyreact-x/no-missing-keyBumped
effectto4.0.2,@effect/platform-nodeto4.0.2,nxto23.3.0,viteto8.3.4,lucide-reactto1.53.0, andpnpmto12.10.1.Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10
v5.24.0Compare Source
🐞 Fixes
react-x/set-state-in-effect: more value shapes are recognized as ref-derivedsetStatearguments: interpolations in template literals (ex:setData(`${ref.current}`)), tagged templates (both the quasi and a ref-derived tag), object and array literals (ex:setData({ value: ref.current })), and spreads (ex:setData({ ...ref.current })) — previously these fell through to the default case and were reported. (#1988)📝 Documentation
🏗️ Internal
@local/eff: added predicate combinators and type guards synced with effect, and migrated call sites across the workspace to them. (#1989)Reworked to the fact-based implementation pattern — fact collection (
collect.ts), provenance resolution (origins.ts), and violation inference (effects.ts) are now separate modules, withlib.tsreplaced by a pure-ASThelpers.ts;set-state-in-effectagain classifies a hook name configured as bothadditionalStateHooksandadditionalEffectHooksas a state hook first. (#1983, #1985, #1986)Affected rules:
react-x/set-state-in-effectreact-x/set-state-in-renderreact-x/use-memoreact-x/use-state: aligned the nested-expression collectors' visitor keys to callee-first order, matchingeslint-visitor-keys; no behavior change. (#1988)Migrated package unit tests to the shared
@local/testkithelpers. (#1987)Renamed message ids to kebab-case across all plugins. (#1984)
Bumped
fumadocs-coreandfumadocs-uito16.15.18,fumadocs-mdxto15.4.6,lucide-reactto1.50.0, and@types/nodeto26.6.4.Full Changelog: Rel1cx/eslint-react@v5.23.5...v5.24.0
[
v5.23.5](https://redirect.github.com/Rel1cx/eslint-react/blob/HEAD/CHANGELOG.md#v5235-202Configuration
📅 Schedule: (in timezone Europe/Zurich)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.