[1.4.3] - 2026-02-08

1.4.12

Patch Changes

• #364 86baa02 Thanks @ofri-peretz! - Add the ecosystem and oxlint marks to the README logo row. Each plugin now leads with Interlace -> its ecosystem (node, nestjs, express, react, mongodb, postgresql, mysql, sqlite, prisma, drizzle, knex, typeorm, sequelize, lambda, vercel, jwt) -> oxlint -> ESLint; the generic quality plugins carry the row without an ecosystem mark. README-only change - no rule behaviour is affected. The patch bump is what carries the new README onto npm, which only refreshes a package README on publish.

1.4.11

Patch Changes

• #338 dc25c81 Thanks @ofri-peretz! - Re-publish every package so npm carries the optimised artifact

  No source changed. This is a no-op patch whose entire purpose is to ship the artifact the current build already produces.

  Manifests. scripts and devDependencies are now stripped from every published package.json. Neither can do anything in a consumer’s node_modules — npm never runs one and never installs the other — but they shipped in all 27 manifests, cluttered the npm page, and were read by SCA tools scanning installed manifests. No package declares a lifecycle hook, so nothing observable changes. Every published package is bumped so this applies uniformly rather than to a subset.

  Tarballs. 20 packages were last published before the build pipeline changed and still ship AGENTS.md, CHANGELOG.md, JSDoc in the emitted .js, and the full generated .d.ts tree:

  package	published	rebuilt	saving
  eslint-plugin-react-features	547 kB	320 kB	−227 kB
  eslint-plugin-secure-coding	653 kB	477 kB	−176 kB
  eslint-plugin-conventions	241 kB	116 kB	−125 kB
  eslint-plugin-browser-security	380 kB	291 kB	−89 kB
  eslint-plugin-maintainability	178 kB	116 kB	−62 kB
  eslint-plugin-react-a11y	232 kB	173 kB	−59 kB
  eslint-plugin-reliability	148 kB	90 kB	−58 kB
  eslint-plugin-vercel-ai-security	187 kB	130 kB	−57 kB
  eslint-plugin-operability	90 kB	43 kB	−47 kB
  eslint-plugin-jwt	140 kB	95 kB	−45 kB
  eslint-plugin-modularity	98 kB	58 kB	−40 kB
  eslint-plugin-nestjs-security	122 kB	86 kB	−36 kB
  eslint-plugin-sqlite-security	54 kB	20 kB	−34 kB
  eslint-plugin-sequelize-security	54 kB	21 kB	−34 kB
  eslint-plugin-prisma-security	52 kB	19 kB	−33 kB
  eslint-plugin-mysql-security	52 kB	19 kB	−33 kB
  eslint-plugin-typeorm-security	52 kB	19 kB	−33 kB
  eslint-plugin-drizzle-security	52 kB	19 kB	−33 kB
  eslint-plugin-knex-security	51 kB	19 kB	−32 kB
  eslint-plugin-modernization	45 kB	38 kB	−7 kB

  Those 20 go from 3428 kB to 2169 kB — −36.7%. The remaining 7 were released after the pipeline change and only gain the manifest strip.

  A new check in scripts/check-published-artifacts.ts fails the build if scripts or devDependencies ever reappear in a published manifest, so the strip cannot silently regress.

  The dependency ranges did not need updating: every plugin pins @interlace/eslint-devkit with a caret that 1.6.0 satisfies, verified by a clean install of an unchanged plugin resolving devkit 1.6.0 with zero dependencies and no typescript in the tree.

• Updated dependencies [dc25c81]:

  • @interlace/eslint-devkit@1.6.1

1.4.10

Patch Changes

• #322 6a2d27d Thanks @ofri-peretz! - Extract the raw-SQL-injection detector (CWE-89) into @interlace/eslint-devkit as createSqlInjectionRule, so every driver plugin can instantiate it with its own sinks and remediation copy.

  Background: scanning OWASP Juice Shop with the recommended presets of secure-coding, node-security, express-security and mongodb-security produced zero findings on its two flagship SQL injections (routes/search.ts, routes/login.ts — both sequelize.query() template literals). The detection was never the problem: pg/no-unsafe-query matches any .query() member call and flags both correctly. The problem is distribution — nobody on Sequelize installs the Postgres plugin.

  The factory takes the sink list, a SQL-keyword precision gate, and the remediation copy, which is everything that actually differs between drivers. pg/no-unsafe-query is now an instantiation of it: same rule id, message ids, sink and behaviour, and all 28 pre-existing rule tests pass untouched.

  Also raises the timeout on the no-deprecated-plugin-references guard in devkit. Both layers shell out to a repo-wide grep, which cannot finish inside vitest's 5s default once the suite has enough test files running in parallel — it failed as a timeout, not a violation.

  Driver-scoped plugins that instantiate the factory ship separately.

• Updated dependencies [a5fad9f, 0231140, 4cc62d6]:

  • @interlace/eslint-devkit@1.6.0

1.4.9

Patch Changes

• #294 659f6dc Thanks @ofri-peretz! - Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release.

  Descriptions now lead with the search phrase. Every one starts ESLint plugin for <the thing you'd search> instead of a brand-first or category-first framing, and names the concrete vulnerabilities the plugin actually detects. Three were corrected while doing so:

  • eslint-plugin-import-next claimed "100x faster no-cycle detection". No 100x measurement exists: CLAIMS.md records 3.1x end-to-end (8x in pure rule execution) on a 5,483-file React codebase, and the highest number in any benchmark result is 54.9x on the synthetic corpus. The description now states the real-codebase figure.
  • eslint-plugin-secure-coding claimed SQL injection, XSS and CSRF coverage — none of which are its rules. It now names what it does detect: LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
  • eslint-plugin-secure-coding ("89 rules") and eslint-plugin-react-a11y ("37 rules") hard-coded rule counts that had drifted from reality. Counts are generated into interlace-numbers.json; hand-typed copies are removed rather than corrected.

  Keywords now match the vocabulary of the plugins that rank. eslint-plugin-security, eslint-plugin-jsx-a11y, eslint-plugin-n and eslint-plugin-import all carry the eslint / eslintplugin / eslint-plugin trio — six of our packages were missing eslintplugin, and every one now carries all three plus static-analysis, linting and code-quality. Security plugins add sast, appsec and vulnerability; node-security and secure-coding also carry nodesecurity, the exact keyword eslint-plugin-security ranks on. Each plugin gained the CWE identifiers and attack names for what it detects (cwe-78 command injection, cwe-22 path traversal, cwe-89 SQL injection, cwe-79 XSS, cwe-347 JWT algorithm confusion, cwe-352 CSRF, cwe-943 NoSQL injection), and node-security gained the crypto vocabulary it had been missing entirely despite absorbing the crypto rule set (crypto, cryptography, weak-hash, md5, sha1, timing-attack).

  No rule behavior, exports, or configuration changes.

• Updated dependencies [e1cdf83, 659f6dc]:

  • @interlace/eslint-devkit@1.4.3

1.4.8

Patch Changes

• #269 7028fe2 Thanks @ofri-peretz! - docs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes.

• Updated dependencies [7028fe2]:

  • @interlace/eslint-devkit@1.4.2

1.4.7

Patch Changes

• #252 d67e395 Thanks @ofri-peretz! - Fix Codecov badge showing "unknown" — switch from flag to component URL format

1.4.6

Patch Changes

• #225 34ff5a8 Thanks @ofri-peretz! - CI-only: pin all coverage thresholds at 100% (integration target, merges last).

1.4.5

Patch Changes

• #213 391dbe6 Thanks @ofri-peretz! - Align every security rule's meta.docs.cvss to the CVSS its finding actually emits. The emitted machine-readable message sources its CVSS:x from CWE_MAPPING via formatLLMMessage → enrichFromCWE, but the static meta.docs.cvss documentation field had drifted on 45 rules across these 7 plugins — e.g. no-hardcoded-credentials documented 9.5 while emitting CVSS:9.8 (the value the published article and SARIF/LLM consumers already read).

  This corrects the documentation metadata only — no emitted finding changes. Locked by security-cvss-docs-consistency.lock.test.ts (cross-plugin: every security rule's meta.docs.cvss must equal the CVSS it emits), the no-hardcoded-credentials rule lock (real ESLint Linter emission), and a devkit enrichFromCWE contract test pinning CWE-798 → 9.8.

  Follow-up (not in scope): 50 security rules document a CVSS that never appears in any emitted message (their messages carry no CWE), and several rules emit the generic CWE score where a rule-specific score may be warranted — both change emitted output and are separate decisions.

1.4.4

Patch Changes

• #143 213cde1 Thanks @ofri-peretz! - fix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns

  Rules that were recognized as null guards are now correctly identified as safe:

  1. Truthy if guard — if (obj) { obj.prop } — direct truthy check proves non-null. Also covers chains: if (response) protects response.data.items.
  2. Short-circuit AND — obj && obj.prop — right side of && only runs when left is truthy.
  3. Ternary consequent — obj ? obj.prop : fallback — truthy test guards the consequent.

  Also: bumped beforeAll timeout to 30 seconds in 7 compatibility test files (__compatibility__/*.spec.ts). Native-addon packages routinely exceed the previous 10-second default on a cold ESM load.

• Updated dependencies [736a5fe]:

  • @interlace/eslint-devkit@1.4.1

Bug Fixes

• align codecov component IDs with full package names (2831b968)
• resolve all benchmark FN/FP across security rules (45ffb791)

Documentation

• fix changelog header format across all packages (c3a15082)

❤️ Thank You

• Ofri Peretz

[1.4.2] - 2026-02-06

Bug Fixes

• align codecov component names and update docs components (0a59a86c)

❤️ Thank You

• Ofri Peretz

[1.4.1] - 2026-02-02

This was a version bump only for eslint-plugin-pg to align it with other projects, there were no code changes.

Changelog

All notable changes to eslint-plugin-pg will be documented in this file.

[0.0.1] - 2024-12-20

Added

• Initial release with 13 rules for PostgreSQL security and best practices

Security Rules (6)

• no-unsafe-query - Prevents SQL injection via string interpolation
• no-insecure-ssl - Prevents disabling SSL certificate validation
• no-hardcoded-credentials - Prevents hardcoded passwords in config
• no-unsafe-search-path - Prevents dynamic search_path hijacking
• no-unsafe-copy-from - Prevents COPY FROM file path exposure
• no-transaction-on-pool - Prevents transaction commands on pool

Resource Management Rules (3)

• no-missing-client-release - Ensures pool clients are released
• prevent-double-release - Prevents double client.release()
• no-floating-query - Ensures query promises are handled

Quality & Performance Rules (4)

• check-query-params - Validates parameter count matches placeholders
• no-select-all - Discourages SELECT *
• prefer-pool-query - Suggests pool.query() for simple queries
• no-batch-insert-loop - Prevents N+1 mutation queries

Presets

• recommended - Balanced security and quality settings
• strict - All rules as errors

Documentation

• Full documentation for all 13 rules
• AGENTS.md for AI assistant integration
• Benchmark folder for capability demonstration