[1.4.3] - 2026-02-08

1.4.7

Patch Changes

• #252 d67e395 Thanks @ofri-peretz! - Fix Codecov badge showing "unknown" — switch from flag to component URL format

1.4.6

Patch Changes

• #225 34ff5a8 Thanks @ofri-peretz! - CI-only: pin all coverage thresholds at 100% (integration target, merges last).

1.4.5

Patch Changes

• #213 391dbe6 Thanks @ofri-peretz! - Align every security rule's meta.docs.cvss to the CVSS its finding actually emits. The emitted machine-readable message sources its CVSS:x from CWE_MAPPING via formatLLMMessage → enrichFromCWE, but the static meta.docs.cvss documentation field had drifted on 45 rules across these 7 plugins — e.g. no-hardcoded-credentials documented 9.5 while emitting CVSS:9.8 (the value the published article and SARIF/LLM consumers already read).

  This corrects the documentation metadata only — no emitted finding changes. Locked by security-cvss-docs-consistency.lock.test.ts (cross-plugin: every security rule's meta.docs.cvss must equal the CVSS it emits), the no-hardcoded-credentials rule lock (real ESLint Linter emission), and a devkit enrichFromCWE contract test pinning CWE-798 → 9.8.

  Follow-up (not in scope): 50 security rules document a CVSS that never appears in any emitted message (their messages carry no CWE), and several rules emit the generic CWE score where a rule-specific score may be warranted — both change emitted output and are separate decisions.

1.4.4

Patch Changes

• #143 213cde1 Thanks @ofri-peretz! - fix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns

  Rules that were recognized as null guards are now correctly identified as safe:

  1. Truthy if guard — if (obj) { obj.prop } — direct truthy check proves non-null. Also covers chains: if (response) protects response.data.items.
  2. Short-circuit AND — obj && obj.prop — right side of && only runs when left is truthy.
  3. Ternary consequent — obj ? obj.prop : fallback — truthy test guards the consequent.

  Also: bumped beforeAll timeout to 30 seconds in 7 compatibility test files (__compatibility__/*.spec.ts). Native-addon packages routinely exceed the previous 10-second default on a cold ESM load.

• Updated dependencies [736a5fe]:

  • @interlace/eslint-devkit@1.4.1

Bug Fixes

• align codecov component IDs with full package names (2831b968)
• resolve all benchmark FN/FP across security rules (45ffb791)

Documentation

• fix changelog header format across all packages (c3a15082)

❤️ Thank You

• Ofri Peretz

[1.4.2] - 2026-02-06

Bug Fixes

• align codecov component names and update docs components (0a59a86c)

❤️ Thank You

• Ofri Peretz

[1.4.1] - 2026-02-02

This was a version bump only for eslint-plugin-pg to align it with other projects, there were no code changes.

Changelog

All notable changes to eslint-plugin-pg will be documented in this file.

[0.0.1] - 2024-12-20

Added

• Initial release with 13 rules for PostgreSQL security and best practices

Security Rules (6)

• no-unsafe-query - Prevents SQL injection via string interpolation
• no-insecure-ssl - Prevents disabling SSL certificate validation
• no-hardcoded-credentials - Prevents hardcoded passwords in config
• no-unsafe-search-path - Prevents dynamic search_path hijacking
• no-unsafe-copy-from - Prevents COPY FROM file path exposure
• no-transaction-on-pool - Prevents transaction commands on pool

Resource Management Rules (3)

• no-missing-client-release - Ensures pool clients are released
• prevent-double-release - Prevents double client.release()
• no-floating-query - Ensures query promises are handled

Quality & Performance Rules (4)

• check-query-params - Validates parameter count matches placeholders
• no-select-all - Discourages SELECT *
• prefer-pool-query - Suggests pool.query() for simple queries
• no-batch-insert-loop - Prevents N+1 mutation queries

Presets

• recommended - Balanced security and quality settings
• strict - All rules as errors

Documentation

• Full documentation for all 13 rules
• AGENTS.md for AI assistant integration
• Benchmark folder for capability demonstration