Skip to main content
interlace
Plugin: browser-security

Changelog

Release history and version updates for eslint-plugin-browser-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

2.1.5

  • FixThe README logo now links to the plugin's own documentation.

2.1.4

  • Fixthree rules read a subscripted member the same as its dotted twin
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.2

2.1.3

  • Fixno-http-urls still reads a quasi with an uncookable escape
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.1

2.1.2

  • Fixheader and host-check detection now read a string-subscript method
  • Fixthe innerHTML sink family and the transport gate read a subscripted member
  • Fixseven more browser rules read a string-subscript member
  • Fixcache, IndexedDB and XHR receivers resolve a subscripted member
  • Fixno-insecure-redirects now reports the string-subscript spelling
  • Fixanalytics and Express route detection now read a string-subscript method
  • Fixapp['use'](cors({ origin: '*' })) installs the same middleware
  • Fixr['route']('/x').post(h) is the same unprotected route chain
  • Fixtransmission, CSP and MIME gates resolve a subscripted method
  • Fixthe CORS checks read subscripted calls and quoted option keys
  • Maintenancethe innerHTML sinks and URL guards no longer cast an unnameable property
  • Maintenanceno-incomplete-url-sanitization checks the resolved name explicitly
  • Fixsanitiser, logger, postMessage and query gates read a subscripted member
  • Fixdeep-link, CORS, IAM and state-mutation gates read a subscripted member
  • FixMIME, helmet, TLS and stream gates read a subscripted member
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

2.1.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

2.1.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • Feature✨ Feature — no-sensitive-indexeddb gains sensitiveTerms
  • Feature✨ Feature — no-incomplete-url-sanitization gains urlNameWords
  • Fix🐛 Fix — no-innerhtml missed three receiver shapes
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

2.0.7

  • Fixlock and document the W3C XML namespace exemption in no-http-urls and detect-mixed-content.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.4

2.0.6

  • Fixtwo more false positives, found by rescanning after the last batch shipped.
  • Fixno-improper-sanitization reported through a satisfies wrapper.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.3

2.0.5

  • Fixno-http-urls no longer reports test material or bare scheme strings. #671
  • FixTest-file detection now recognises compound directory names. #671
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.1

2.0.4

  • Fixno-http-urls no longer reports test material or bare scheme strings. #666

2.0.3

  • A flag is not a credential. #651

2.0.2

  • Four false positives found by scanning nineteen open-source repositories. #635
  • DependenciesUpdated internal dependencies

2.0.1

  • no-insecure-redirects no longer reports a page reloading itself. #589

2.0.0

  • Remove schema options that were never read #574
  • Rules now say only what they proved #574
  • Rules decide by evidence, and every vocabulary is now an option #574
  • DependenciesUpdated internal dependencies

1.4.1

  • no-xpath-injection now needs evidence rather than names, and every rule carries a CVSS. #563
  • DependenciesUpdated internal dependencies

1.4.0

  • 100% drop-in parity with eslint-plugin-security, and twelve false-positive fixes. #560

1.3.2

  • Fix a command-injection false negative, repair every rule's documentation link, and close the #555
  • DependenciesUpdated internal dependencies

1.3.1

  • no-credentials-in-query-params no longer reports templates that merely contain #546
  • no-innerhtml no longer treats every .write() call as a DOM XSS sink. #546
  • no-http-urls and detect-mixed-content no longer report XML namespace URIs #546
  • Remove two vestigial package-level lockfiles that carried vulnerable transitive dependencies. #537
  • DependenciesUpdated internal dependencies

1.3.0

  • Stop the source-specific sink rules double-reporting with the generic ones, and #409
  • no-clickjacking no longer reports frame-busting as frame manipulation. #427
  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • meta.hasSuggestions now matches what each rule actually emits. #309
  • no-unencrypted-transmission no longer flags protocol strings that are being #416
  • DependenciesUpdated internal dependencies

1.2.14

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

1.2.13

  • Document every rule option, and add description to the schemas that had none #383
  • Load rule modules on demand instead of at plugin load. #381
  • Declare what we support, load only what we use #381
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • DependenciesUpdated internal dependencies

1.2.12

  • Add the ecosystem and oxlint marks to the README logo row. Each plugin now #364

1.2.11

  • Document the options the rules actually accept #359
  • DependenciesUpdated internal dependencies

1.2.10

  • Re-publish every package so npm carries the optimised artifact #338
  • DependenciesUpdated internal dependencies

1.2.9

  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • DependenciesUpdated internal dependencies

1.2.8

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

1.2.7

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

1.2.6

  • CI-only: pin all coverage thresholds at 100% (integration target, merges last). #225

1.2.5

  • Align every security rule's meta.docs.cvss to the CVSS its finding actually #213

1.2.4

  • Fixfix: remove false meta.fixable: 'code' declarations from 21 rules that had no fix() function #141
  • DependenciesUpdated internal dependencies
  • align codecov component IDs with full package names
  • resolve all benchmark FN/FP across security rules
  • fix changelog header format across all packages
  • Ofri Peretz

1.2.2

  • align codecov component names and update docs components
  • Ofri Peretz

1.0.0

  • no-innerhtml - Detect dangerous innerHTML/outerHTML assignments (CWE-79)
  • no-eval - Detect eval(), new Function(), and string-based callbacks (CWE-95)
  • require-postmessage-origin-check - Require origin validation in message handlers (CWE-346)
  • no-postmessage-wildcard-origin - Prevent wildcard targetOrigin in postMessage (CWE-346)
  • no-postmessage-innerhtml - Prevent XSS via innerHTML in postMessage handlers (CWE-79)
  • no-sensitive-localstorage - Prevent storing sensitive data in localStorage (CWE-922)
  • no-sensitive-sessionstorage - Prevent storing sensitive data in sessionStorage (CWE-922)
  • no-sensitive-indexeddb - Prevent storing sensitive data in IndexedDB (CWE-922)
  • no-jwt-in-storage - Prevent storing JWT tokens in browser storage (CWE-922)
  • no-sensitive-cookie-js - Prevent storing sensitive data in cookies via JavaScript (CWE-1004)
  • no-cookie-auth-tokens - Prevent auth tokens in JS-accessible cookies (CWE-1004)
  • require-cookie-secure-attrs - Require Secure and SameSite cookie attributes (CWE-614)
  • require-websocket-wss - Require secure WebSocket connections (wss://) (CWE-319)
  • no-websocket-innerhtml - Prevent XSS via innerHTML in WebSocket handlers (CWE-79)
  • no-websocket-eval - Prevent RCE via eval() in WebSocket handlers (CWE-95)
  • no-filereader-innerhtml - Prevent XSS via innerHTML with FileReader data (CWE-79)
  • require-blob-url-revocation - Require revoking Blob URLs to prevent memory leaks (CWE-401)
  • no-dynamic-service-worker-url - Prevent dynamic URLs in service worker registration (CWE-829)
  • no-worker-message-innerhtml - Prevent XSS via innerHTML in Worker message handlers (CWE-79)
  • no-unsafe-inline-csp - Disallow 'unsafe-inline' in CSP (CWE-79)
  • no-unsafe-eval-csp - Disallow 'unsafe-eval' in CSP (CWE-95)
  • recommended - Balanced security defaults
  • strict - All 21 rules as errors
  • xss - XSS-focused rules only
  • storage - Storage security rules only
  • postmessage - postMessage security rules only
  • websocket - WebSocket security rules only
  • cookies - Cookie security rules only
  • LLM-optimized error messages with CWE references
  • OWASP Top 10 2021 alignment
  • TypeScript support with exported option types
  • Comprehensive test coverage (297 tests, 97.73% line coverage)
  • Auto-fix suggestions where safe
  • Covers 8 CWEs: 79, 95, 319, 346, 401, 614, 829, 922, 1004
  • Maps to OWASP Top 10 2021: A01, A02, A03

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-browser-security

XSS, cookie, and DOM security rules for client-side JavaScript

Rules

All ESLint security rules provided by eslint-plugin-browser-security