Skip to main content
interlace
Plugin: browser-security

Changelog

Release history and version updates for eslint-plugin-browser-security

Live from GitHub

This changelog is fetched directly from CHANGELOG.md on GitHub and cached for 2 hours.

Live changelogfrom eslint-plugin-browser-security/CHANGELOG.md, cached for 2 hours.Edit on GitHub

[1.2.3] - 2026-02-08

1.2.12

Patch Changes

  • #364 86baa02 Thanks @ofri-peretz! - Add the ecosystem and oxlint marks to the README logo row. Each plugin now leads with Interlace -> its ecosystem (node, nestjs, express, react, mongodb, postgresql, mysql, sqlite, prisma, drizzle, knex, typeorm, sequelize, lambda, vercel, jwt) -> oxlint -> ESLint; the generic quality plugins carry the row without an ecosystem mark. README-only change - no rule behaviour is affected. The patch bump is what carries the new README onto npm, which only refreshes a package README on publish.

1.2.11

Patch Changes

  • #359 b2e887b Thanks @ofri-peretz! - Document the options the rules actually accept

    Ten option names appeared in rule docs but not in the rules' schemas. Because every schema sets additionalProperties: false, copying one out of the docs did not fail quietly — it aborted the whole lint run:

    Key "rules": Key "vercel-ai-security/no-hardcoded-api-keys":
  Value {"keyPatterns":[...]} should NOT have additional properties.
  Unexpected property "keyPatterns". Expected properties: "apiKeyPatterns".

    Six of the seven affected tables were fictional end to end — not one documented option existed. Affected rules: no-hardcoded-api-keys, no-unsafe-output-handling, require-abort-signal, require-max-steps, require-max-tokens, require-tool-schema and browser-security/no-sensitive-localstorage.

    Three "Mitigation: configure X" notes pointed at knobs that are hardcoded and were never configurable; they now say so instead of promising a fix that cannot be applied.

    No rule behaviour changes — this is documentation catching up to the schemas.

  • Updated dependencies [e8e9ee6]:

    • @interlace/eslint-devkit@1.7.0

1.2.10

Patch Changes

  • #338 dc25c81 Thanks @ofri-peretz! - Re-publish every package so npm carries the optimised artifact

    No source changed. This is a no-op patch whose entire purpose is to ship the artifact the current build already produces.

    Manifests. scripts and devDependencies are now stripped from every published package.json. Neither can do anything in a consumer’s node_modules — npm never runs one and never installs the other — but they shipped in all 27 manifests, cluttered the npm page, and were read by SCA tools scanning installed manifests. No package declares a lifecycle hook, so nothing observable changes. Every published package is bumped so this applies uniformly rather than to a subset.

    Tarballs. 20 packages were last published before the build pipeline changed and still ship AGENTS.md, CHANGELOG.md, JSDoc in the emitted .js, and the full generated .d.ts tree:

    packagepublishedrebuiltsaving
    eslint-plugin-react-features547 kB320 kB−227 kB
    eslint-plugin-secure-coding653 kB477 kB−176 kB
    eslint-plugin-conventions241 kB116 kB−125 kB
    eslint-plugin-browser-security380 kB291 kB−89 kB
    eslint-plugin-maintainability178 kB116 kB−62 kB
    eslint-plugin-react-a11y232 kB173 kB−59 kB
    eslint-plugin-reliability148 kB90 kB−58 kB
    eslint-plugin-vercel-ai-security187 kB130 kB−57 kB
    eslint-plugin-operability90 kB43 kB−47 kB
    eslint-plugin-jwt140 kB95 kB−45 kB
    eslint-plugin-modularity98 kB58 kB−40 kB
    eslint-plugin-nestjs-security122 kB86 kB−36 kB
    eslint-plugin-sqlite-security54 kB20 kB−34 kB
    eslint-plugin-sequelize-security54 kB21 kB−34 kB
    eslint-plugin-prisma-security52 kB19 kB−33 kB
    eslint-plugin-mysql-security52 kB19 kB−33 kB
    eslint-plugin-typeorm-security52 kB19 kB−33 kB
    eslint-plugin-drizzle-security52 kB19 kB−33 kB
    eslint-plugin-knex-security51 kB19 kB−32 kB
    eslint-plugin-modernization45 kB38 kB−7 kB

    Those 20 go from 3428 kB to 2169 kB — −36.7%. The remaining 7 were released after the pipeline change and only gain the manifest strip.

    A new check in scripts/check-published-artifacts.ts fails the build if scripts or devDependencies ever reappear in a published manifest, so the strip cannot silently regress.

    The dependency ranges did not need updating: every plugin pins @interlace/eslint-devkit with a caret that 1.6.0 satisfies, verified by a clean install of an unchanged plugin resolving devkit 1.6.0 with zero dependencies and no typescript in the tree.

  • Updated dependencies [dc25c81]:

    • @interlace/eslint-devkit@1.6.1

1.2.9

Patch Changes

  • #294 659f6dc Thanks @ofri-peretz! - Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release.

    Descriptions now lead with the search phrase. Every one starts ESLint plugin for <the thing you'd search> instead of a brand-first or category-first framing, and names the concrete vulnerabilities the plugin actually detects. Three were corrected while doing so:

    • eslint-plugin-import-next claimed "100x faster no-cycle detection". No 100x measurement exists: CLAIMS.md records 3.1x end-to-end (8x in pure rule execution) on a 5,483-file React codebase, and the highest number in any benchmark result is 54.9x on the synthetic corpus. The description now states the real-codebase figure.
    • eslint-plugin-secure-coding claimed SQL injection, XSS and CSRF coverage — none of which are its rules. It now names what it does detect: LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
    • eslint-plugin-secure-coding ("89 rules") and eslint-plugin-react-a11y ("37 rules") hard-coded rule counts that had drifted from reality. Counts are generated into interlace-numbers.json; hand-typed copies are removed rather than corrected.

    Keywords now match the vocabulary of the plugins that rank. eslint-plugin-security, eslint-plugin-jsx-a11y, eslint-plugin-n and eslint-plugin-import all carry the eslint / eslintplugin / eslint-plugin trio — six of our packages were missing eslintplugin, and every one now carries all three plus static-analysis, linting and code-quality. Security plugins add sast, appsec and vulnerability; node-security and secure-coding also carry nodesecurity, the exact keyword eslint-plugin-security ranks on. Each plugin gained the CWE identifiers and attack names for what it detects (cwe-78 command injection, cwe-22 path traversal, cwe-89 SQL injection, cwe-79 XSS, cwe-347 JWT algorithm confusion, cwe-352 CSRF, cwe-943 NoSQL injection), and node-security gained the crypto vocabulary it had been missing entirely despite absorbing the crypto rule set (crypto, cryptography, weak-hash, md5, sha1, timing-attack).

    No rule behavior, exports, or configuration changes.

  • Updated dependencies [e1cdf83, 659f6dc]:

    • @interlace/eslint-devkit@1.4.3

1.2.8

Patch Changes

  • #269 7028fe2 Thanks @ofri-peretz! - docs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes.

  • Updated dependencies [7028fe2]:

    • @interlace/eslint-devkit@1.4.2

1.2.7

Patch Changes

  • #252 d67e395 Thanks @ofri-peretz! - Fix Codecov badge showing "unknown" — switch from flag to component URL format

1.2.6

Patch Changes

  • #225 34ff5a8 Thanks @ofri-peretz! - CI-only: pin all coverage thresholds at 100% (integration target, merges last).

1.2.5

Patch Changes

  • #213 391dbe6 Thanks @ofri-peretz! - Align every security rule's meta.docs.cvss to the CVSS its finding actually emits. The emitted machine-readable message sources its CVSS:x from CWE_MAPPING via formatLLMMessage → enrichFromCWE, but the static meta.docs.cvss documentation field had drifted on 45 rules across these 7 plugins — e.g. no-hardcoded-credentials documented 9.5 while emitting CVSS:9.8 (the value the published article and SARIF/LLM consumers already read).

    This corrects the documentation metadata only — no emitted finding changes. Locked by security-cvss-docs-consistency.lock.test.ts (cross-plugin: every security rule's meta.docs.cvss must equal the CVSS it emits), the no-hardcoded-credentials rule lock (real ESLint Linter emission), and a devkit enrichFromCWE contract test pinning CWE-798 → 9.8.

    Follow-up (not in scope): 50 security rules document a CVSS that never appears in any emitted message (their messages carry no CWE), and several rules emit the generic CWE score where a rule-specific score may be warranted — both change emitted output and are separate decisions.

1.2.4

Patch Changes

  • #141 38ab670 Thanks @ofri-peretz! - fix: remove false meta.fixable: 'code' declarations from 21 rules that had no fix() function

    Rules that declared fixable: 'code' in their ESLint meta without an actual fix() implementation would show the ⚡ auto-fix icon in editors and CI formatters but apply no change when --fix was run. This patch removes the misleading declaration from:

    • browser-security/no-clickjacking
    • import-next/first, named, no-barrel-import, no-import-module-exports, no-namespace
    • node-security/no-buffer-overread, no-unsafe-dynamic-require, no-zip-slip
    • react-features/react-no-inline-functions
    • reliability/no-jsdoc-terminator-in-example (uses suggest, not auto-fix; corrected to hasSuggestions: true only)
    • secure-coding/no-directive-injection, no-electron-security-issues, no-graphql-injection, no-improper-sanitization, no-improper-type-validation, no-ldap-injection, no-unchecked-loop-condition, no-unlimited-resource-allocation, no-weak-password-recovery, no-xpath-injection

  • Updated dependencies [736a5fe]:

    • @interlace/eslint-devkit@1.4.1

Bug Fixes

  • align codecov component IDs with full package names (2831b968)
  • resolve all benchmark FN/FP across security rules (45ffb791)

Documentation

  • fix changelog header format across all packages (c3a15082)

❤️ Thank You

  • Ofri Peretz

[1.2.2] - 2026-02-06

Bug Fixes

  • align codecov component names and update docs components (0a59a86c)

❤️ Thank You

  • Ofri Peretz

[1.2.1] - 2026-02-02

This was a version bump only for eslint-plugin-browser-security to align it with other projects, there were no code changes.

Changelog

All notable changes to eslint-plugin-browser-security will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Documentation

[1.0.0] - 2025-12-29

Added

XSS Prevention Rules (2)

  • no-innerhtml - Detect dangerous innerHTML/outerHTML assignments (CWE-79)
  • no-eval - Detect eval(), new Function(), and string-based callbacks (CWE-95)

postMessage Security Rules (3)

  • require-postmessage-origin-check - Require origin validation in message handlers (CWE-346)
  • no-postmessage-wildcard-origin - Prevent wildcard targetOrigin in postMessage (CWE-346)
  • no-postmessage-innerhtml - Prevent XSS via innerHTML in postMessage handlers (CWE-79)

Storage Security Rules (4)

  • no-sensitive-localstorage - Prevent storing sensitive data in localStorage (CWE-922)
  • no-sensitive-sessionstorage - Prevent storing sensitive data in sessionStorage (CWE-922)
  • no-sensitive-indexeddb - Prevent storing sensitive data in IndexedDB (CWE-922)
  • no-jwt-in-storage - Prevent storing JWT tokens in browser storage (CWE-922)
  • no-sensitive-cookie-js - Prevent storing sensitive data in cookies via JavaScript (CWE-1004)
  • no-cookie-auth-tokens - Prevent auth tokens in JS-accessible cookies (CWE-1004)
  • require-cookie-secure-attrs - Require Secure and SameSite cookie attributes (CWE-614)

WebSocket Security Rules (3)

  • require-websocket-wss - Require secure WebSocket connections (wss://) (CWE-319)
  • no-websocket-innerhtml - Prevent XSS via innerHTML in WebSocket handlers (CWE-79)
  • no-websocket-eval - Prevent RCE via eval() in WebSocket handlers (CWE-95)

File API & Workers Security Rules (4)

  • no-filereader-innerhtml - Prevent XSS via innerHTML with FileReader data (CWE-79)
  • require-blob-url-revocation - Require revoking Blob URLs to prevent memory leaks (CWE-401)
  • no-dynamic-service-worker-url - Prevent dynamic URLs in service worker registration (CWE-829)
  • no-worker-message-innerhtml - Prevent XSS via innerHTML in Worker message handlers (CWE-79)

CSP Security Rules (2)

  • no-unsafe-inline-csp - Disallow 'unsafe-inline' in CSP (CWE-79)
  • no-unsafe-eval-csp - Disallow 'unsafe-eval' in CSP (CWE-95)

Presets (7)

  • recommended - Balanced security defaults
  • strict - All 21 rules as errors
  • xss - XSS-focused rules only
  • storage - Storage security rules only
  • postmessage - postMessage security rules only
  • websocket - WebSocket security rules only
  • cookies - Cookie security rules only

Features

  • LLM-optimized error messages with CWE references
  • OWASP Top 10 2021 alignment
  • TypeScript support with exported option types
  • Comprehensive test coverage (297 tests, 97.73% line coverage)
  • Auto-fix suggestions where safe

Security

  • Covers 8 CWEs: 79, 95, 319, 346, 401, 614, 829, 922, 1004
  • Maps to OWASP Top 10 2021: A01, A02, A03

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

Overview

XSS, cookie, and DOM security rules for client-side JavaScript

Rules

All ESLint security rules provided by eslint-plugin-browser-security

On this page

No Headings