Skip to main content
interlace
Plugin: secure-coding

Changelog

Release history and version updates for eslint-plugin-secure-coding

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

5.4.5

  • Fixno-improper-type-validation no longer loses a null guard to a type-only cast. as, satisfies, <T>x and x! erase at compile time, so (payload as object) !== null && typeof payload === 'object' is the same program as the un-cast form the rule already accepts — and is the docs' own ✅ Correct example. Comparing guard operands by node type made the verdict turn on the spelling of a no-op.

5.4.4

  • Performancedetect-object-injection resolves the holder through the scope index

5.4.3

  • Fixdetect-object-injection no longer exempts a holder property that has been replaced. The exemption read the object literal the holder was _created_ with, so flags.bools = {} after const flags = { bools: Object.create(null) } left an attacker-controlled key landing in a prototype-bearing object with the rule silent — a false negative in the rule whose whole subject is prototype pollution. A write _through_ the property is still exempt; only a replacement of the property, or a rebinding of the holder, withdraws it.

5.4.2

  • Fixdetect-non-literal-regexp resolves a spread of a constant array
  • Fixdetect-object-injection honours Object.create(null) reached through a property

5.4.1

  • Fixno-improper-type-validation credits instanceof as a null guard
  • Securitydetect-object-injection missed the copy loop in its callback spelling

5.4.0

  • Fixdetect-object-injection sees a copy loop keyed by Object.keys
  • Fixdetect-object-injection accepts an as const lookup table
  • Fixdetect-object-injection no longer flags Object.assign(Object.create(null), source)

5.3.5

  • Fixno-insecure-comparison stops reading two public values as secrets
  • Fixno-unchecked-loop-condition exempts for (;;) with a break, as it does while (true)

5.3.4

  • Fixno-hardcoded-credentials no longer reports CSS as a credential

5.3.3

  • FixThe README logo now links to the plugin's own documentation.

5.3.2

  • Fixfive rules read a subscripted member the same as its dotted twin
  • Fixvalue['constructor'].name is the same brittle type check
  • Fixthis['password'] and req['body'] read the same as their dotted twins
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.2

5.3.1

  • Fixno-hardcoded-credentials stops reporting error codes and build-tool paths
  • Fixtemplate text reads assert instead of concatenating null
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.1

5.3.0

  • Fixsix rules now see o['k'] as the same access as o.k
  • Fixsanitiser, logger, postMessage and query gates read a subscripted member
  • Fixno-hardcoded-credentials stops reporting error codes and module paths
  • Fixsixteen rules read a member spelled with a string subscript
  • Fixng['$compile'](tpl) compiles the same directive template
  • Fixtemplate compilation and token generation read a subscripted method
  • Fixconsole['log'](user.email) logs the same PII as console.log
  • Fixlog levels, deserialisers and fs reads resolve a subscripted method
  • Fixparts['join'](' ') concatenates the same SQL statement
  • FixLDAP, privilege and loop gates resolve a subscripted member
  • Fixthree blind spots that lived in a selector, a regex and a substring list
  • FixLDAP escapes and role checks read a subscripted method
  • FixObject['keys'] and graphql['execute'] name the same operations
  • FixuserService['elevate'](user, level) is the same privilege operation
  • Fixclient['search'](baseDN, filter) runs the same LDAP query
  • Fixdb['query'](sql) is the same SQL sink as db.query(sql)
  • FixXPath, password-length, fail-open and regex gates read a subscripted member
  • FixMath['random']() is recognised as the same weak token source
  • Maintenanceinjection and privilege checks resolve a property once, not twice
  • FixipcRenderer['send'](...) and app['get'](...) name the same call
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

5.2.2

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

5.2.1

  • FixStop pointing readers at retired package names. secure-coding's "extend your coverage" block linked eslint-plugin-jwt and sequelize-security's prose named eslint-plugin-pg — both deprecated on npm since #414, and following either installs the frozen pre-rename build rather than the maintained one.

5.2.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • Feature✨ Feature — no-insecure-comparison gains reportLooseEquality
  • Feature✨ Feature — no-hardcoded-session-tokens gains sessionWords
  • Featuredetect-weak-password-validation takes passwordWords
  • Feature✨ Feature — no-unsafe-regex-construction gains requestRootNames
  • Feature🐛 Fix — no-sql-injection reads a request by SHAPE, not by the name req
  • Feature✨ Feature — the names these rules look for are yours to state
  • Fix🐛 Fix — no-unsafe-regex-construction reported on dynamic flags alone
  • Fixno-mutable-exports resolves bindings instead of grepping the file text
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

5.1.4

  • Fixfive false positives found by scanning real repositories.
  • Fixno-xxe-injection reported parseFromString(text, 'text/html').
  • Fixno-unsafe-deserialization reported yaml.load() on repositories pinned to js-yaml v4.
  • Fixtwo more false positives, found by rescanning after the last batch shipped.
  • Fixno-improper-sanitization reported through a satisfies wrapper.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.3

5.1.3

  • FixThree false positives found by reviewing findings on real repositories. #678
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

5.1.2

  • Fixno-xpath-injection no longer reports React Router wildcard paths. #671
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.1

5.1.1

  • Five false positives that would have shipped a false claim. #635
  • Four false positives found by scanning nineteen open-source repositories. #635
  • DependenciesUpdated internal dependencies

5.1.0

  • no-redos-vulnerable-regex can now ask the oracle for the degree of #589
  • no-sensitive-data-exposure no longer reports when the surrounding prose names #589

5.0.0

  • Remove schema options that were never read #574
  • Rules now say only what they proved #574
  • Rules decide by evidence, and every vocabulary is now an option #574
  • DependenciesUpdated internal dependencies

4.3.0

  • no-xpath-injection now needs evidence rather than names, and every rule carries a CVSS. #563
  • DependenciesUpdated internal dependencies

4.2.0

  • 100% drop-in parity with eslint-plugin-security, and twelve false-positive fixes. #560

4.1.0

  • Fix a command-injection false negative, repair every rule's documentation link, and close the #555
  • DependenciesUpdated internal dependencies

4.0.0

  • no-unsafe-deserialization no longer reports JSON.parse as CWE-502. #546
  • no-unlimited-resource-allocation now judges what is allocated instead of #546
  • Remove two vestigial package-level lockfiles that carried vulnerable transitive dependencies. #537
  • DependenciesUpdated internal dependencies

3.7.1

  • no-improper-sanitization no longer reports .length interpolated into markup. #534

3.7.0

  • no-directive-injection: stop reporting correct DOMPurify calls, start #531
  • no-hardcoded-credentials: allowInTests now defaults to true. #531
  • no-redos-vulnerable-regex: an invalid regex is no longer reported as a ReDoS #531
  • no-redos-vulnerable-regex no longer overrules its own NFA analysis with #531
  • no-sensitive-data-exposure now reads property accesses and template literals #531

3.6.1

  • no-xpath-injection: require the string to reach an XPath evaluator #490
  • DependenciesUpdated internal dependencies

3.6.0

  • Drop no-unchecked-loop-condition from recommended — and from every preset derived from it #458
  • Stop reporting on evidence that lives in another file, or on no LDAP evidence at all #475
  • no-sensitive-data-exposure no longer reports prose that mentions a credential, #468
  • no-weak-password-recovery no longer calls a token predictable without #468
  • no-unlimited-resource-allocation no longer reports passport-jwt as a ZIP bomb. #468
  • DependenciesUpdated internal dependencies

3.5.0

  • Drop detect-object-injection from the recommended preset #372
  • detect-object-injection: decide numeric keys by provability, not by variable name. #323
  • detect-object-injection: resolve index expressions through scope, and drop the index-name allowlist. #323
  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • no-improper-sanitization no longer reports developer-authored output or code #457
  • Stop no-improper-sanitization reporting static developer-authored HTML #441
  • no-unchecked-loop-condition no longer infers user input from identifier names. #459
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • meta.hasSuggestions now matches what each rule actually emits. #309
  • Two more false-positive classes from the whole-ruleset sweep. #417
  • no-xpath-injection no longer treats every path join as XPath construction. #422
  • DependenciesUpdated internal dependencies

3.4.4

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

3.4.3

  • Document every rule option, and add description to the schemas that had none #383
  • Load rule modules on demand instead of at plugin load. #381
  • Declare what we support, load only what we use #381
  • Fix the dangerousChars Options row, which rendered as truncated code #390
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • DependenciesUpdated internal dependencies

3.4.2

  • Stop no-insecure-comparison mangling == null under --fix #365
  • Add the ecosystem and oxlint marks to the README logo row. Each plugin now #364

1.0.0

  • Initial release with 48 security-focused ESLint rules
  • LLM-optimized error messages with CWE references and OWASP mapping
  • Three preset configurations: recommended, strict, owasp-top-10
  • Full ESLint 9 flat config support
  • TypeScript support
  • no-sql-injection - SQL injection prevention
  • database-injection - Comprehensive SQL/NoSQL/ORM injection
  • detect-eval-with-expression - Dynamic eval() detection
  • detect-child-process - Command injection detection
  • no-unsafe-dynamic-require - Dynamic require() prevention
  • no-graphql-injection - GraphQL injection prevention
  • no-xxe-injection - XXE injection prevention
  • no-xpath-injection - XPath injection prevention
  • no-ldap-injection - LDAP injection prevention
  • no-directive-injection - Template injection prevention
  • no-format-string-injection - Format string injection prevention
  • detect-non-literal-fs-filename - Path traversal detection
  • no-zip-slip - Zip slip vulnerability prevention
  • no-toctou-vulnerability - TOCTOU race condition detection
  • detect-non-literal-regexp - ReDoS detection in RegExp
  • no-redos-vulnerable-regex - ReDoS pattern detection
  • no-unsafe-regex-construction - Unsafe regex prevention
  • detect-object-injection - Prototype pollution detection
  • no-unsafe-deserialization - Unsafe deserialization prevention
  • no-hardcoded-credentials - Hardcoded secrets detection
  • no-weak-crypto - Weak algorithm detection
  • no-insufficient-random - Weak randomness detection
  • no-timing-attack - Timing attack prevention
  • no-insecure-comparison - Insecure comparison detection
  • no-insecure-jwt - JWT security issues detection
  • no-unvalidated-user-input - Input validation enforcement
  • no-unsanitized-html - XSS via innerHTML prevention
  • no-unescaped-url-parameter - URL parameter XSS prevention
  • no-improper-sanitization - Output encoding enforcement
  • no-improper-type-validation - Type confusion prevention
  • no-missing-authentication - Auth check enforcement
  • no-privilege-escalation - Privilege escalation detection
  • no-weak-password-recovery - Secure password reset enforcement
  • no-insecure-cookie-settings - Cookie security enforcement
  • no-missing-csrf-protection - CSRF protection enforcement
  • no-document-cookie - Direct cookie access detection
  • no-missing-cors-check - CORS validation enforcement
  • no-missing-security-headers - Security header enforcement
  • no-insecure-redirects - Open redirect prevention
  • no-unencrypted-transmission - HTTPS enforcement
  • no-clickjacking - Clickjacking prevention
  • no-exposed-sensitive-data - Data exposure prevention
  • no-sensitive-data-exposure - Log sanitization enforcement
  • no-buffer-overread - Buffer safety enforcement
  • no-unlimited-resource-allocation - Resource limit enforcement
  • no-unchecked-loop-condition - Infinite loop prevention
  • no-electron-security-issues - Electron security enforcement
  • no-insufficient-postmessage-validation - postMessage validation

3.4.1

  • Re-publish every package so npm carries the optimised artifact #338
  • DependenciesUpdated internal dependencies

3.4.0

  • Cut false positives in five security rules, measured against a 1,470-file corpus (webpack lib/, lodash, eslint-plugin-import src/, and two NestJS boilerplates). #288
  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • Cut two false positives confirmed against the benchmark corpus SAFE fixtures. #296
  • DependenciesUpdated internal dependencies

3.3.4

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

3.3.3

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

3.3.2

  • CI-only: pin all coverage thresholds at 100% (integration target, merges last). #225

3.3.1

  • Align every security rule's meta.docs.cvss to the CVSS its finding actually #213

3.3.0

  • Add recommended-strict preset + quick-start in README #170
  • Fixfix(detect-object-injection): suppress ~3,470 Edge false positives via four new safe-pattern guards #137
  • Fixfix: ILB-Wild FP reduction + doc examples + doc-test-alignment scanner fixes #144
  • Fixfix: remove false meta.fixable: 'code' declarations from 21 rules that had no fix() function #141
  • feat+fix: ILB-Wild FP reduction + two new quality rules #148
  • DependenciesUpdated internal dependencies

3.2.0

  • New ./oxlint sub-export for use with oxlint's JS plugin API. Wire it via { "jsPlugins": ["eslint-plugin-secure-coding/oxlint"] } in .oxlintrc.json. Exposes the same rule set as the main entry; rules degrade gracefully when type information is unavailable (oxlint's JS plugin context does not provide parserServices). The default ESLint entry (./) is unchanged.

3.0.2

  • detect-object-injection: Replaced getText() + regex with AST-based validation (~4x faster)
  • detect-non-literal-fs-filename: Replaced getText() + regex with AST-based validation
  • no-timing-attack: Set-based O(1) lookups for sensitive variables and auth patterns
  • no-buffer-overread: Set-based O(1) lookups for buffer methods and user-controlled keywords
  • no-missing-csrf-protection: Set-based O(1) lookups for protected HTTP methods
  • detect-child-process: Set-based O(1) lookups for dangerous child_process methods

3.0.1

  • detect-object-injection: Reduced false positives by detecting validation patterns:
  • detect-non-literal-fs-filename: Allow safe path patterns:
  • no-timing-attack: Skip false positives in timing-safe contexts:
  • no-unsanitized-html: Track sanitized variables:
  • no-unlimited-resource-allocation: Allow safe static paths:

3.0.0

  • OWASP Mobile Top 10 Coverage: Added 40 new rules targeting mobile security risks (M1-M10).
  • New Presets:
  • Documentation:
  • Recommended Config: Now includes critical mobile security rules for hybrid web/mobile apps.
  • Rule Improvements: Refined AST detection for no-clickjacking and no-unvalidated-deeplinks to reduce false positives.

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-secure-coding

General secure coding practices and OWASP compliance for JavaScript/TypeScript

Rules

All ESLint security rules provided by eslint-plugin-secure-coding