@blumintinc/eslint-plugin-blumint 1.20.51 → 1.20.53

package/lib/index.js

@@ -223,7 +223,7 @@ function noFrontendImportsFromFunctionsPatterns(pattern) {
 module.exports = {
     meta: {
         name: '@blumintinc/eslint-plugin-blumint',
-        version: '1.20.51',
+        version: '1.20.53',
     },
     parseOptions: {
         ecmaVersion: 2020,

package/lib/rules/enforce-m3-sentence-case.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enforceM3SentenceCase = void 0;
 const utils_1 = require("@typescript-eslint/utils");
+const compilePatternOption_1 = require("../utils/compilePatternOption");
 const createRule_1 = require("../utils/createRule");
 /**
  * Default props that carry user-facing label text, per the issue spec.
@@ -452,7 +453,11 @@ exports.enforceM3SentenceCase = (0, createRule_1.createRule)({
             ...DEFAULT_IGNORED_WORDS,
             ...(options.ignoredWords ?? []),
         ]);
-        const ignorePatternRegexes = (options.ignorePatterns ?? []).map((p) => new RegExp(p));
+        // Rejecting a malformed `ignorePatterns` entry rather than dropping it keeps
+        // the consumer's exception list honest: a silently discarded pattern would
+        // make text they deliberately excluded start getting reported with no
+        // indication why.
+        const ignorePatternRegexes = (0, compilePatternOption_1.compilePatternOption)('enforce-m3-sentence-case', 'ignorePatterns', options.ignorePatterns ?? []);
         const allowListSet = new Set(options.allowList ?? []);
         const checkJsxText = options.checkJsxText !== false;
         /**

package/lib/rules/no-handler-suffix.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.noHandlerSuffix = void 0;
 const utils_1 = require("@typescript-eslint/utils");
 const minimatch_1 = require("minimatch");
+const compilePatternOption_1 = require("../utils/compilePatternOption");
 const createRule_1 = require("../utils/createRule");
 const DEFAULT_OPTIONS = {
     ignoreClassMethods: false,
@@ -26,6 +27,12 @@ function isUnsafeAllowPattern(pattern) {
     const nestedQuantifierPattern = /\((?:[^()\\]|\\.)*[+*{][^)]*\)\s*[+*{]/;
     return nestedQuantifierPattern.test(pattern);
 }
+// A pattern that compiles can still hang the linter, so allowlist sources are
+// refused for catastrophic-backtracking risk as well as for syntax.
+const UNSAFE_ALLOW_PATTERN_REJECTION = {
+    isRejected: isUnsafeAllowPattern,
+    describe: (optionName) => `unsafe ${optionName} (avoid nested quantifiers that risk catastrophic backtracking)`,
+};
 function getStaticKeyName(key) {
     if (key.type === utils_1.AST_NODE_TYPES.Identifier) {
         return key.name;
@@ -131,34 +138,7 @@ exports.noHandlerSuffix = (0, createRule_1.createRule)({
         const resolvedOptions = { ...DEFAULT_OPTIONS, ...(options ?? {}) };
         const allowNames = new Set(resolvedOptions.allowNames);
         const interfaceAllowlist = new Set(resolvedOptions.interfaceAllowlist);
-        const invalidAllowPatterns = [];
-        const unsafeAllowPatterns = [];
-        const allowPatterns = (resolvedOptions.allowPatterns ?? []).flatMap((pattern) => {
-            try {
-                if (isUnsafeAllowPattern(pattern)) {
-                    unsafeAllowPatterns.push(pattern);
-                    return [];
-                }
-                return [new RegExp(pattern)];
-            }
-            catch (error) {
-                const reason = error && typeof error === 'object' && 'message' in error
-                    ? ` (${String(error.message)})`
-                    : '';
-                invalidAllowPatterns.push(`${pattern}${reason}`);
-                return [];
-            }
-        });
-        if (invalidAllowPatterns.length > 0 || unsafeAllowPatterns.length > 0) {
-            const errorParts = [];
-            if (invalidAllowPatterns.length > 0) {
-                errorParts.push(`invalid allowPatterns: ${invalidAllowPatterns.join(', ')}`);
-            }
-            if (unsafeAllowPatterns.length > 0) {
-                errorParts.push(`unsafe allowPatterns (avoid nested quantifiers that risk catastrophic backtracking): ${unsafeAllowPatterns.join(', ')}`);
-            }
-            throw new Error(`no-handler-suffix: ${errorParts.join('; ')}`);
-        }
+        const allowPatterns = (0, compilePatternOption_1.compilePatternOption)('no-handler-suffix', 'allowPatterns', resolvedOptions.allowPatterns ?? [], undefined, UNSAFE_ALLOW_PATTERN_REJECTION);
         if (isInAllowedFile(filename, resolvedOptions.allowFilePatterns ?? [])) {
             return {};
         }

package/lib/rules/no-render-function-components.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noRenderFunctionComponents = void 0;
 const utils_1 = require("@typescript-eslint/utils");
+const compilePatternOption_1 = require("../utils/compilePatternOption");
 const createRule_1 = require("../utils/createRule");
 const ASTHelpers_1 = require("../utils/ASTHelpers");
 /**
@@ -95,7 +96,10 @@ exports.noRenderFunctionComponents = (0, createRule_1.createRule)({
             ...DEFAULT_RENDER_PROP_NAMES,
             ...userRenderPropNames,
         ]);
-        const allowNamePatterns = (options?.allowNames ?? []).map((pattern) => new RegExp(pattern));
+        // Rejecting a malformed `allowNames` entry rather than dropping it keeps the
+        // consumer's allowlist honest: a silently discarded pattern would report the
+        // functions they deliberately exempted with no indication why.
+        const allowNamePatterns = (0, compilePatternOption_1.compilePatternOption)('no-render-function-components', 'allowNames', options?.allowNames ?? []);
         const candidates = [];
         function isAllowed(name) {
             return allowNamePatterns.some((pattern) => pattern.test(name));

package/lib/rules/no-separate-loading-state.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noSeparateLoadingState = void 0;
 const utils_1 = require("@typescript-eslint/utils");
+const compilePatternOption_1 = require("../utils/compilePatternOption");
 const createRule_1 = require("../utils/createRule");
 const LOADING_PATTERNS = [
     /^is.*Loading$/i,
@@ -34,7 +35,18 @@ exports.noSeparateLoadingState = (0, createRule_1.createRule)({
     },
     defaultOptions: [{}],
     create(context, [options]) {
-        const effectivePatterns = options?.patterns?.map((p) => new RegExp(p, 'i')) ?? LOADING_PATTERNS;
+        // Rejecting a malformed `patterns` entry rather than falling back to
+        // `LOADING_PATTERNS` keeps the consumer's detection list honest: a silent
+        // fallback would look configured while leaving the names they meant to flag
+        // unreported.
+        //
+        // The `undefined` check is load-bearing: an absent `patterns` falls back to
+        // the built-ins, while an explicit empty list stays empty, so the option can
+        // disable name matching entirely.
+        const configuredPatterns = options?.patterns === undefined
+            ? undefined
+            : (0, compilePatternOption_1.compilePatternOption)('no-separate-loading-state', 'patterns', options.patterns, 'i');
+        const effectivePatterns = configuredPatterns ?? LOADING_PATTERNS;
         const setterTrackers = [];
         function isLoadingPattern(name) {
             return effectivePatterns.some((pattern) => pattern.test(name));

package/lib/rules/parallelize-async-operations.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parallelizeAsyncOperations = void 0;
 const utils_1 = require("@typescript-eslint/utils");
 const createRule_1 = require("../utils/createRule");
+const ASTHelpers_1 = require("../utils/ASTHelpers");
 // Anchored at the end of the path so multi-part suffixes such as
 // `EventRegistry.integration.test.ts` are recognized while production modules
 // that merely contain the word (`testHelpers.ts`, `latest.ts`, `contest/Thing.ts`)
@@ -334,6 +335,145 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
             }
             return callee.object.name;
         }
+        /**
+         * Matches the `Promise` combinators that take an array of promises and
+         * return a single promise standing in for the whole group. Awaiting one of
+         * them does not consume the member promises: they stay reachable through
+         * whatever names fed the combinator, so a later await mentioning one of
+         * those names is reading a promise the aggregate already owns. Anchored so
+         * only the combinator itself matches, never a user helper whose name merely
+         * contains the word.
+         */
+        const PROMISE_AGGREGATOR_PATTERN = /^(all|allSettled|any|race)$/;
+        /**
+         * Node types that open a new function body. Traversals that ask "does
+         * evaluating this expression suspend the enclosing async function?" must
+         * stop here, because an `await` beyond this boundary belongs to the inner
+         * function and runs only when that function is called.
+         */
+        const FUNCTION_BOUNDARY_TYPES = new Set([
+            utils_1.AST_NODE_TYPES.FunctionDeclaration,
+            utils_1.AST_NODE_TYPES.FunctionExpression,
+            utils_1.AST_NODE_TYPES.ArrowFunctionExpression,
+        ]);
+        /**
+         * Reports whether evaluating this expression suspends the enclosing async
+         * function -- i.e. whether it contains an `await` of its own.
+         *
+         * The traversal deliberately stops at every function boundary: the awaits in
+         * `Promise.all(items.map(async (item) => await store(item)))` belong to the
+         * callback, so the outer expression evaluates straight through to a promise
+         * without ever suspending, and hoisting it is safe.
+         */
+        function containsSuspendingAwait(node) {
+            if (isAwaitExpression(node)) {
+                return true;
+            }
+            if (FUNCTION_BOUNDARY_TYPES.has(node.type)) {
+                return false;
+            }
+            for (const key in node) {
+                if (key === 'parent' || key === 'range' || key === 'loc')
+                    continue;
+                const child = node[key];
+                if (!child || typeof child !== 'object')
+                    continue;
+                if (Array.isArray(child)) {
+                    for (const item of child) {
+                        if (item &&
+                            typeof item === 'object' &&
+                            'type' in item &&
+                            containsSuspendingAwait(item)) {
+                            return true;
+                        }
+                    }
+                }
+                else if ('type' in child && containsSuspendingAwait(child)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+        /**
+         * Follows an identifier back to the array literal a `const` binds to it.
+         *
+         * Only `const` qualifies. A `let`/`var` array can be reassigned between the
+         * declaration and the await, so its literal elements are not a sound
+         * description of what the aggregate actually received, and treating them as
+         * such would suppress reports on genuinely independent operations.
+         */
+        function resolveConstArrayLiteral(identifier) {
+            const variable = ASTHelpers_1.ASTHelpers.findVariableInScope(ASTHelpers_1.ASTHelpers.getScope(context, identifier), identifier.name);
+            if (!variable) {
+                return null;
+            }
+            for (const definition of variable.defs) {
+                const declarator = definition.node;
+                if (declarator.type === utils_1.AST_NODE_TYPES.VariableDeclarator &&
+                    declarator.parent?.type === utils_1.AST_NODE_TYPES.VariableDeclaration &&
+                    declarator.parent.kind === 'const' &&
+                    declarator.init?.type === utils_1.AST_NODE_TYPES.ArrayExpression) {
+                    return declarator.init;
+                }
+            }
+            return null;
+        }
+        /**
+         * Expands an awaited promise aggregate (`await Promise.all(ops)`) to the
+         * names through which its member promises remain reachable afterwards: the
+         * array's own binding plus every element that is a bare identifier, or a
+         * spread of one.
+         *
+         * This is the aliasing channel the plain identifier-set comparison cannot
+         * see. In `await Promise.all(ops); await release({ results: [await
+         * dropped] })` the two awaits share no identifier at all -- one holds
+         * `Promise`/`all`/`ops`, the other `release`/`dropped` -- yet `dropped` is
+         * `ops[0]`, so the release genuinely cannot start before the drop settles.
+         * Elements that are freshly-constructed promises (`assign()`) are omitted
+         * because nothing binds them to a name, so no later await can reference
+         * them. (#1541)
+         */
+        function getAggregatedPromiseNames(awaitExpr) {
+            const names = new Set();
+            const argument = awaitExpr.argument.type === utils_1.AST_NODE_TYPES.ChainExpression
+                ? awaitExpr.argument.expression
+                : awaitExpr.argument;
+            if (argument.type !== utils_1.AST_NODE_TYPES.CallExpression) {
+                return names;
+            }
+            const callee = argument.callee;
+            if (callee.type !== utils_1.AST_NODE_TYPES.MemberExpression ||
+                callee.computed ||
+                callee.object.type !== utils_1.AST_NODE_TYPES.Identifier ||
+                callee.object.name !== 'Promise' ||
+                callee.property.type !== utils_1.AST_NODE_TYPES.Identifier ||
+                !PROMISE_AGGREGATOR_PATTERN.test(callee.property.name)) {
+                return names;
+            }
+            const [aggregated] = argument.arguments;
+            if (!aggregated) {
+                return names;
+            }
+            let elements = [];
+            if (aggregated.type === utils_1.AST_NODE_TYPES.ArrayExpression) {
+                elements = aggregated.elements;
+            }
+            else if (aggregated.type === utils_1.AST_NODE_TYPES.Identifier) {
+                names.add(aggregated.name);
+                elements = resolveConstArrayLiteral(aggregated)?.elements ?? [];
+            }
+            for (const element of elements) {
+                if (!element)
+                    continue;
+                const value = element.type === utils_1.AST_NODE_TYPES.SpreadElement
+                    ? element.argument
+                    : element;
+                if (value.type === utils_1.AST_NODE_TYPES.Identifier) {
+                    names.add(value.name);
+                }
+            }
+            return names;
+        }
         /**
          * Checks if there are dependencies between await expressions
          */
@@ -486,6 +626,51 @@ exports.parallelizeAsyncOperations = (0, createRule_1.createRule)({
                     }
                 }
             }
+            // 8. Aggregate-element aliasing barrier. `await Promise.all(ops)` does not
+            // consume the promises in `ops`; they stay reachable by name, so a later
+            // await that mentions one of them -- `await release({ results: [await
+            // dropped] })`, where `dropped` is `ops[0]` -- reads a value the aggregate
+            // is still producing. The two awaits share no identifier at all
+            // (`Promise`/`all`/`ops` versus `release`/`dropped`), so the direct set
+            // comparison above classifies them independent; expanding the aggregate to
+            // its element names restores the link. Promise.all-ing that pair would
+            // start the consumer concurrently with the very operation whose result it
+            // reads. (#1541)
+            for (let i = 1; i < awaitNodes.length; i++) {
+                const currentIds = allIdentifiers[i];
+                if (currentIds.size === 0)
+                    continue;
+                for (let j = 0; j < i; j++) {
+                    const priorExpr = getAwaitExpression(awaitNodes[j]);
+                    if (!priorExpr)
+                        continue;
+                    for (const aggregatedName of getAggregatedPromiseNames(priorExpr)) {
+                        if (currentIds.has(aggregatedName)) {
+                            return true;
+                        }
+                    }
+                }
+            }
+            // 9. Nested-await hoist barrier. The rewrite splices each awaited
+            // expression into a `Promise.all([...])` ARRAY LITERAL, and array elements
+            // evaluate left to right. An element that contains an `await` of its own
+            // suspends the enclosing function mid-literal -- after the earlier
+            // elements' promises have been constructed, but before `Promise.all` has
+            // been called to attach handlers to them. If one of those already-running
+            // promises rejects during the suspension, the function throws at the inner
+            // await and the rejected promise is orphaned into an `unhandledRejection`,
+            // which the Cloud Functions runtime answers by killing the instance, so
+            // the caller receives an opaque crash instead of the real error. A leading
+            // nested await is unsound in a quieter way: it suspends before the later
+            // elements are evaluated, so their operations never start early and the
+            // rewrite buys no parallelism while still reshaping the code. Keep any run
+            // containing such an expression sequential. (#1541)
+            for (const node of awaitNodes) {
+                const awaitExpr = getAwaitExpression(node);
+                if (awaitExpr && containsSuspendingAwait(awaitExpr.argument)) {
+                    return true;
+                }
+            }
             return false;
         }
         /**

package/lib/utils/compilePatternOption.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Pattern options are declared as bare `string[]` because JSON Schema cannot
+ * express "is a compilable regex". Schema validation therefore hands any string
+ * straight to `new RegExp`, and an exception raised while building a rule aborts
+ * the entire lint run — every file, every other rule — with an opaque
+ * `Error while loading rule …` naming neither the option nor the offending
+ * value.
+ *
+ * Rejecting the configuration is the right response: silently dropping a
+ * pattern would leave the consumer's allowlist inert, so the code they
+ * deliberately excluded would be reported anyway with no indication why. This
+ * helper makes the rejection actionable and uniform — every failure is
+ * collected and rethrown as a single error naming the rule, the option and each
+ * bad pattern alongside the underlying regex error.
+ */
+export type PatternRejection = {
+    /**
+     * Refuses a pattern that compiles but is still unacceptable — a source with
+     * nested quantifiers, say, which risks catastrophic backtracking. Checked
+     * before compilation, so a refused pattern is never also reported as invalid.
+     */
+    isRejected: (pattern: string) => boolean;
+    /**
+     * Builds the clause head for refused patterns, e.g.
+     * `unsafe allowPatterns (avoid nested quantifiers…)`. Receives the option name
+     * so callers need not repeat it.
+     */
+    describe: (optionName: string) => string;
+};
+/**
+ * Compiles a user-supplied list of regex sources, throwing one actionable
+ * configuration error listing every pattern that failed.
+ *
+ * @param ruleName Rule id used to prefix the thrown message.
+ * @param optionName Option the patterns came from, named in the thrown message.
+ * @param patterns Regex source strings supplied by the consumer.
+ * @param flags Flags applied to every compiled pattern (`'i'`, say).
+ * @param rejection Optional extra admissibility check applied before compiling.
+ */
+export declare function compilePatternOption(ruleName: string, optionName: string, patterns: readonly string[], flags?: string, rejection?: PatternRejection): RegExp[];

package/lib/utils/compilePatternOption.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * Pattern options are declared as bare `string[]` because JSON Schema cannot
+ * express "is a compilable regex". Schema validation therefore hands any string
+ * straight to `new RegExp`, and an exception raised while building a rule aborts
+ * the entire lint run — every file, every other rule — with an opaque
+ * `Error while loading rule …` naming neither the option nor the offending
+ * value.
+ *
+ * Rejecting the configuration is the right response: silently dropping a
+ * pattern would leave the consumer's allowlist inert, so the code they
+ * deliberately excluded would be reported anyway with no indication why. This
+ * helper makes the rejection actionable and uniform — every failure is
+ * collected and rethrown as a single error naming the rule, the option and each
+ * bad pattern alongside the underlying regex error.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compilePatternOption = void 0;
+function describeError(error) {
+    return error && typeof error === 'object' && 'message' in error
+        ? ` (${String(error.message)})`
+        : '';
+}
+/**
+ * Compiles a user-supplied list of regex sources, throwing one actionable
+ * configuration error listing every pattern that failed.
+ *
+ * @param ruleName Rule id used to prefix the thrown message.
+ * @param optionName Option the patterns came from, named in the thrown message.
+ * @param patterns Regex source strings supplied by the consumer.
+ * @param flags Flags applied to every compiled pattern (`'i'`, say).
+ * @param rejection Optional extra admissibility check applied before compiling.
+ */
+function compilePatternOption(ruleName, optionName, patterns, flags, rejection) {
+    const invalid = [];
+    const rejected = [];
+    const compiled = patterns.flatMap((pattern) => {
+        try {
+            if (rejection?.isRejected(pattern)) {
+                rejected.push(pattern);
+                return [];
+            }
+            return [new RegExp(pattern, flags)];
+        }
+        catch (error) {
+            invalid.push(`${pattern}${describeError(error)}`);
+            return [];
+        }
+    });
+    if (invalid.length === 0 && rejected.length === 0) {
+        return compiled;
+    }
+    const clauses = [];
+    if (invalid.length > 0) {
+        clauses.push(`invalid ${optionName}: ${invalid.join(', ')}`);
+    }
+    if (rejected.length > 0 && rejection) {
+        clauses.push(`${rejection.describe(optionName)}: ${rejected.join(', ')}`);
+    }
+    throw new Error(`${ruleName}: ${clauses.join('; ')}`);
+}
+exports.compilePatternOption = compilePatternOption;
+//# sourceMappingURL=compilePatternOption.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blumintinc/eslint-plugin-blumint",
-  "version": "1.20.51",
+  "version": "1.20.53",
   "description": "Custom eslint rules for use within BluMint",
   "author": {
     "name": "Brodie McGuire",
@@ -73,6 +73,7 @@
     "@types/eslint": "8.37.0",
     "@types/jest": "29.5.14",
     "@types/node": "22.20.0",
+    "@types/semver": "7.5.8",
     "@typescript-eslint/eslint-plugin": "5.34.0",
     "@typescript-eslint/parser": "5.48.0",
     "chai": "4.5.0",
@@ -103,13 +104,14 @@
     "remark-lint": "9.1.1",
     "remark-preset-lint-recommended": "6.1.2",
     "semantic-release": "25.0.2",
+    "semver": "7.7.1",
     "ts-jest": "29.2.6",
     "ts-node": "10.9.1",
     "tsx": "4.19.4",
     "typescript": "5.0.3"
   },
   "peerDependencies": {
-    "eslint": ">=7"
+    "eslint": ">=7 <9"
   },
   "engines": {
     "node": ">=22.0.0"

package/release-manifest.json

@@ -1,4 +1,48 @@
 [
+  {
+    "version": "1.20.53",
+    "date": "2026-08-01T00:55:57.763Z",
+    "rules": [
+      {
+        "name": "parallelize-async-operations",
+        "changeType": "fix",
+        "issues": [
+          1541
+        ],
+        "summary": "stop hoisting dependent and await-containing operations (closes #1541)"
+      }
+    ]
+  },
+  {
+    "version": "1.20.52",
+    "date": "2026-07-31T19:23:46.059Z",
+    "rules": [
+      {
+        "name": "enforce-m3-sentence-case",
+        "changeType": "fix",
+        "issues": [
+          1534
+        ],
+        "summary": "validate ignorePatterns regexes with an actionable error (closes #1534)"
+      },
+      {
+        "name": "no-render-function-components",
+        "changeType": "fix",
+        "issues": [
+          1536
+        ],
+        "summary": "validate allowNames regexes with an actionable error (closes #1536)"
+      },
+      {
+        "name": "no-separate-loading-state",
+        "changeType": "fix",
+        "issues": [
+          1535
+        ],
+        "summary": "validate patterns regexes with an actionable error (closes #1535)"
+      }
+    ]
+  },
   {
     "version": "1.20.51",
     "date": "2026-07-31T15:20:05.562Z",