Skip to main content
interlace
Plugin: express-security

Changelog

Release history and version updates for eslint-plugin-express-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

3.2.4

  • FixThe README logo now links to the plugin's own documentation.

3.2.3

  • Fixres['send'](err['stack']) leaks the same trace
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.2

3.2.2

  • FixMIME, helmet, TLS and stream gates read a subscripted member
  • Fixremaining Express gates resolve a subscripted method
  • Fixprocess['cwd']() is the same application root as process.cwd()
  • Fixapp['post']('/auth/token', h) registers the same unlimited route
  • Fixrender, route and request-source gates read a subscripted member
  • Fixstatic, trust-proxy and CSRF route gates read a subscripted member
  • Fixthe shared Express evidence utils read a subscripted member
  • Fixreq['query'] is the same request bag as req.query
  • Maintenanceroute-method and host-getter reads resolve once instead of casting twice
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

3.2.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

3.2.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • FeatureExpress rules agree on what an app receiver is called, and let you say
  • Feature🐛 Fix — no-user-controlled-render-locals reads a request by shape, not by name
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

3.1.3

  • Fixpoint meta.docs.url at documentation that exists #683
  • Docseight published rules finally have documentation #683
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

3.1.2

  • FixTest-file detection now recognises compound directory names. #671
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.1

3.1.1

  • no-xpath-injection now needs evidence rather than names, and every rule carries a CVSS. #563
  • DependenciesUpdated internal dependencies

3.1.0

  • require-rate-limiting moves from warn to error in recommended. #549

3.0.0

  • All eight rules now require an Express app in the file, and one rule stops reporting a non-issue. #548
  • DependenciesUpdated internal dependencies

2.0.1

  • no-user-controlled-redirect no longer flags the documented safe redirect #460
  • no-user-controlled-redirect: a guard inside a nested function no longer counts as a guard. #529

2.0.0

  • Every rule now abstains in files without local Express evidence #482
  • Three deprecated rules are no longer part of the recommended preset: #468
  • Stop reporting on evidence that lives in another file, or on no LDAP evidence at all #475
  • Close two false-negative classes across every SDK-evidence gate #494
  • DependenciesUpdated internal dependencies

1.5.6

  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • Test infrastructure only — no rule, config, or API behavior changes. These #329
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • DependenciesUpdated internal dependencies

1.5.5

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

1.5.4

  • Document every rule option, and add description to the schemas that had none #383
  • Load rule modules on demand instead of at plugin load. #381
  • Declare what we support, load only what we use #381
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • Fix SDK peer declarations that npm silently ignored #335
  • DependenciesUpdated internal dependencies

1.5.3

  • Add the ecosystem and oxlint marks to the README logo row. Each plugin now #364

1.5.2

  • Fix SDK peer declarations that npm silently ignored #358
  • DependenciesUpdated internal dependencies

1.5.1

  • Re-publish every package so npm carries the optimised artifact #338
  • DependenciesUpdated internal dependencies

1.5.0

  • Eight new rules closing the two fixable gaps found by the F#24/F#26 coverage #313
  • DependenciesUpdated internal dependencies

1.4.0

  • `express-security/no-exposed-debug-endpoints` — only route registrations count. The rule had a second listener that reported _any_ bare string literal equal to a debug path (/admin, /health, /debug, …) anywhere in a file. A redirect-URL constant tripped it while authoring benchmark corpus fixtures — const ADMIN_PATH = '/admin', res.redirect('/admin') and if (req.path === '/health') were all CWE-489 "Exposed Debug Endpoint" findings, none of which registers an endpoint. That listener is gone: a literal is reported only as the path argument of an express route registration. #292
  • Seven new rules closing benchmark-corpus coverage gaps (A-lite research wave): #293
  • `express-security/no-missing-security-headers` — `.set()` on a non-response receiver is not a header call. The rule matched setHeader / header / set on the method name alone, so url.searchParams.set('page', '2') and app.set('view engine', 'ejs') were reported as CVSS 7.5 missing-security-header findings — a false positive on two of the most common calls in an Express codebase. The receiver must now be an HTTP response (res / resp / response / reply, including ctx.res.set(…) and this.response.header(…)). The same predicate gates header _collection_, so a Content-Security-Policy string passed to an unrelated .set() no longer satisfies the requirement for a real response in the same scope. #298
  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • DependenciesUpdated internal dependencies

1.3.4

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

1.3.3

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

1.3.2

  • CI-only: pin all coverage thresholds at 100% (integration target, merges last). #225

1.3.1

  • Align every security rule's meta.docs.cvss to the CVSS its finding actually #213

1.3.0

  • Featurefeat: add no-user-controlled-redirect rule — structural CWE-601 open redirect detection #169
  • Fixfix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns #143
  • DependenciesUpdated internal dependencies

1.2.3

  • align codecov component IDs with full package names
  • fix changelog header format across all packages
  • Ofri Peretz

1.2.2

  • align codecov component names and update docs components
  • Ofri Peretz

1.0.0

  • require-helmet - Require helmet middleware for security headers (CWE-693)
  • no-permissive-cors - Detect wildcard CORS origins (CWE-942)
  • no-cors-credentials-wildcard - Block credentials: true with wildcard origin (CWE-942)
  • require-express-body-parser-limits - Require body parser size limits (CWE-770)
  • require-csrf-protection - Require CSRF middleware for state-changing routes (CWE-352)
  • no-insecure-cookie-options - Detect missing Secure/HttpOnly cookie attributes (CWE-614)
  • require-rate-limiting - Require rate limiting middleware (CWE-770)
  • no-express-unsafe-regex-route - Detect ReDoS-vulnerable regex patterns (CWE-1333)
  • no-graphql-introspection-production - Disable GraphQL introspection in production (CWE-200)
  • recommended - Balanced security defaults
  • strict - All 9 rules as errors
  • api - HTTP/API security rules only
  • graphql - GraphQL-specific rules only
  • LLM-optimized error messages with CWE references
  • OWASP Top 10 2021 alignment (A01, A03, A05, A07)
  • Middleware-aware detection (helmet, cors, csurf, express-rate-limit)
  • TypeScript support with exported option types
  • Comprehensive test coverage (132 tests, 93.15% line coverage)
  • Covers 6 CWEs: 200, 352, 614, 693, 770, 942, 1333
  • Maps to OWASP Top 10 2021: A01, A03, A05, A07

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-express-security

Express.js security hardening - cookies, CORS, CSRF, rate limiting, and Helmet

Rules

All ESLint security rules provided by eslint-plugin-express-security