Skip to main content
interlace
Plugin: lambda-security

Changelog

Release history and version updates for eslint-plugin-lambda-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

2.1.4

  • FixThe README logo now links to the plugin's own documentation.

2.1.3

  • Fixerror['stack'] exposes the same trace as error.stack
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.2

2.1.2

  • Fixdeep-link, CORS, IAM and state-mutation gates read a subscripted member
  • Fixclient['send'](cmd) is the same external call as client.send
  • Fixclient['post'](url) issues the same user-controlled request
  • Fixexports['handler'] is the same handler as exports.handler
  • Maintenanceevent-shape and handler reads keep the unnameable property visible
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

2.1.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

2.1.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • Feature✨ Feature — eventParamNames / contextParamNames, because a handler's parameters are positional
  • Featureno-unvalidated-event-body takes validationMethodNames
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

2.0.1

  • Fixpoint meta.docs.url at documentation that exists #683
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

2.0.0

  • Every rule now abstains in files without local Lambda evidence #481
  • Close two false-negative classes across every SDK-evidence gate #494
  • Fix a false negative: require shadowing is now lexical, not file-wide #483
  • DependenciesUpdated internal dependencies

1.3.4

  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • no-error-swallowing no longer reports a catch that handles its error. #463
  • Test infrastructure only — no rule, config, or API behavior changes. These #329
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • DependenciesUpdated internal dependencies

1.3.3

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

1.3.2

  • Document every rule option, and add description to the schemas that had none #383
  • Load rule modules on demand instead of at plugin load. #381
  • Declare what we support, load only what we use #381
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • Fix SDK peer declarations that npm silently ignored #335
  • DependenciesUpdated internal dependencies

1.3.1

  • Add the ecosystem and oxlint marks to the README logo row. Each plugin now #364

1.3.0

  • no-permissive-cors-response: remove the dead allowedOrigins option. #325
  • Fix SDK peer declarations that npm silently ignored #358
  • DependenciesUpdated internal dependencies

1.2.11

  • Re-publish every package so npm carries the optimised artifact #338
  • DependenciesUpdated internal dependencies

1.2.10

  • Close two detection gaps found while linting a real serverless example. #311
  • DependenciesUpdated internal dependencies

1.2.9

  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • DependenciesUpdated internal dependencies

1.2.8

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

1.2.7

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

1.2.6

  • CI-only: pin all coverage thresholds at 100% (integration target, merges last). #225

1.2.5

  • Fix runtime crashes when linting realistic AWS Lambda handlers under ESLint 9. #220
  • Align every security rule's meta.docs.cvss to the CVSS its finding actually #213

1.2.4

  • Fixfix: ILB-Wild FP reduction + doc examples + doc-test-alignment scanner fixes #144
  • Fix a hard crash (Error: Unknown class name: exit) that aborted the entire ESLint run on ESLint 9 whenever the recommended or strict config was enabled. #194
  • Fixfix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns #143
  • DependenciesUpdated internal dependencies
  • align codecov component IDs with full package names
  • fix changelog header format across all packages
  • Ofri Peretz

1.2.2

  • align codecov component names and update docs components
  • Ofri Peretz

1.0.0

  • no-hardcoded-credentials-sdk - Detect hardcoded AWS credentials in SDK v3 clients (CWE-798)
  • no-secrets-in-env - Detect secrets hardcoded in environment variables (CWE-798)
  • no-env-logging - Detect logging entire process.env object (CWE-532)
  • no-permissive-cors-response - Detect wildcard CORS in Lambda response headers (CWE-942)
  • no-permissive-cors-middy - Detect permissive CORS in @middy/http-cors middleware (CWE-942)
  • recommended - Balanced security defaults
  • strict - All 5 rules as errors
  • LLM-optimized error messages with CWE references
  • OWASP Serverless Top 10 alignment (SAS-2, SAS-3, SAS-4)
  • AWS SDK v3 client detection (S3, DynamoDB, Lambda, STS, etc.)
  • Middy middleware detection (@middy/http-cors)
  • Real AWS access key pattern matching (AKIA*, ASIA*)
  • TypeScript support with exported option types
  • Comprehensive test coverage (78 tests, 97.40% line coverage)
  • Auto-fix for CORS violations
  • Covers 3 CWEs: 532, 798, 942
  • Maps to OWASP Serverless Top 10: SAS-2, SAS-3, SAS-4

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-lambda-security

AWS Lambda and Middy security rules for serverless applications

Rules

All ESLint security rules provided by eslint-plugin-lambda-security