@eslint-sh/eslint-plugin 0.6.0 → 0.8.0

package/docs/rules/README.md

@@ -12,6 +12,7 @@ See the [canonical quickstart](https://github.com/mike-north/eslint-sh/blob/main
 | ---- | ------- | ------- | ----------- | ------- |
 | [`sh/compat/no-append-all-redirect`](./compat/no-append-all-redirect.md) | `bash-3.2`, `posix-portable` | No | Yes | Disallow the `&>>` redirection when the target shell lacks it, suggesting `>> file 2>&1`. |
 | [`sh/compat/no-associative-arrays`](./compat/no-associative-arrays.md) | `bash-3.2`, `posix-portable` | No | No | Disallow `declare -A` / `typeset -A` when the target shell lacks associative arrays. |
+| [`sh/compat/no-brace-sequence-padding-step`](./compat/no-brace-sequence-padding-step.md) | `bash-3.2`, `posix-portable` | No | No | Disallow zero-padded (`{01..10}`) and stepped (`{1..10..2}`) brace sequences when the target shell lacks them, pointing at a counting loop. |
 | [`sh/compat/no-case-attributes`](./compat/no-case-attributes.md) | `bash-3.2`, `posix-portable` | No | No | Disallow `declare -l` / `declare -u` (and `typeset`, `local`) when the target shell lacks them, pointing at `tr`. |
 | [`sh/compat/no-case-fallthrough`](./compat/no-case-fallthrough.md) | `bash-3.2`, `posix-portable` | No | No | Disallow the `case` terminators `;&` and `;;&` when the target shell lacks them. |
 | [`sh/compat/no-case-modification`](./compat/no-case-modification.md) | `bash-3.2`, `posix-portable` | No | No | Disallow `${v^^}`, `${v,,}` and variants when the target shell lacks them, pointing at `tr`. |
@@ -26,7 +27,7 @@ See the [canonical quickstart](https://github.com/mike-north/eslint-sh/blob/main
 | [`sh/compat/no-mapfile`](./compat/no-mapfile.md) | `bash-3.2`, `posix-portable` | No | Yes | Disallow `mapfile` / `readarray` when the target shell lacks them, suggesting a read loop. |
 | [`sh/compat/no-nameref`](./compat/no-nameref.md) | `bash-3.2`, `posix-portable` | No | No | Disallow namerefs (`declare -n`, `local -n`) when the target shell lacks them. |
 | [`sh/compat/no-negative-array-index`](./compat/no-negative-array-index.md) | `bash-3.2`, `posix-portable` | No | Yes | Disallow negative array subscripts when the target shell lacks them, suggesting a length-based index. |
-| [`sh/compat/no-nounset-empty-array`](./compat/no-nounset-empty-array.md) | `bash-3.2`, `posix-portable` | No | Yes | Disallow whole-array expansions under `set -u` when the target shell aborts on an empty array, suggesting a guarded form. |
+| [`sh/compat/no-nounset-empty-array`](./compat/no-nounset-empty-array.md) | `posix-portable` | No | Yes | Disallow whole-array expansions under `set -u` when the target shell aborts on an empty array, suggesting a guarded form. |
 | [`sh/compat/no-parameter-transformation`](./compat/no-parameter-transformation.md) | `bash-3.2`, `posix-portable` | No | No | Disallow `${v@op}` transformations when the target shell lacks the operator. |
 | [`sh/compat/no-pipe-all`](./compat/no-pipe-all.md) | `bash-3.2`, `posix-portable` | No | Yes | Disallow the stderr-merging pipe (pipe-ampersand) when the target shell lacks it, suggesting an explicit `2>&1` before the pipe. |
 | [`sh/compat/no-printf-time-format`](./compat/no-printf-time-format.md) | `bash-3.2`, `posix-portable` | No | No | Disallow `printf`'s `%(fmt)T` date format when the target shell lacks it. |
@@ -58,10 +59,12 @@ offer editor suggestions, which you apply one at a time from your editor; the Au
 describes edits available through `eslint --fix`. `quote-expansions` suggests quoting instead of
 fixing because only the script's author knows whether the splitting was intended.
 
-The version-gated `compat/*` rules (`compat/no-append-all-redirect`, `compat/no-associative-arrays`, `compat/no-case-attributes`, `compat/no-case-fallthrough`, `compat/no-case-modification`, `compat/no-coproc`, `compat/no-declare-g`, `compat/no-epoch-variables`, `compat/no-fd-variable`, `compat/no-globstar`, `compat/no-lastpipe-semantics`, `compat/no-mapfile`, `compat/no-nameref`, `compat/no-negative-array-index`, `compat/no-nounset-empty-array`, `compat/no-parameter-transformation`, `compat/no-pipe-all`, `compat/no-printf-time-format`, `compat/no-test-v`, `compat/no-unicode-escape`, `compat/no-wait-n`) report
-shell features that your target shell lacks, as set by `languageOptions.shellVersion` and
-`dialect`. They report nothing when `shellVersion` is unset, so the `bash-3.2` preset sets it to `3.2`
-and the `posix-portable` preset sets `dialect: "posix"`; each enables all of them.
+The version-gated `compat/*` rules (`compat/no-append-all-redirect`, `compat/no-associative-arrays`, `compat/no-brace-sequence-padding-step`, `compat/no-case-attributes`, `compat/no-case-fallthrough`, `compat/no-case-modification`, `compat/no-coproc`, `compat/no-declare-g`, `compat/no-epoch-variables`, `compat/no-fd-variable`, `compat/no-globstar`, `compat/no-lastpipe-semantics`, `compat/no-mapfile`, `compat/no-nameref`, `compat/no-negative-array-index`, `compat/no-nounset-empty-array`, `compat/no-parameter-transformation`, `compat/no-pipe-all`, `compat/no-printf-time-format`, `compat/no-test-v`, `compat/no-unicode-escape`, `compat/no-wait-n`) report
+shell features that your target shell lacks, as set by `languageOptions.minBashVersion` and
+`dialect`. They report nothing when `minBashVersion` is unset, so the `bash-3.2` preset sets it to `3.2`
+and the `posix-portable` preset sets `dialect: "posix"`. `bash-3.2` enables all except
+`compat/no-nounset-empty-array`, which is opt-in for scripts using `set -u` on Bash below 4.4
+with arrays that can really be empty; `posix-portable` retains all of them.
 See [version compatibility](../compat.md). `compat/*` means target gates only; `shebang-matches-dialect`
 compares the file with your config whatever the target, so it lives outside that namespace. `posix-portable` also enables
 `shebang-matches-dialect`, `require-strict-mode` (as `set -eu`) and the POSIX-only gates
@@ -76,3 +79,33 @@ To run these rules beside shellcheck, see [shellcheck](../shellcheck.md).
 `require-network-wrapper` reports nothing until you set its `wrapper` option (see
 [wrapper rules](../wrapper-rules.md)). Each linked rule page documents its options, limitations,
 and relationship to shellcheck.
+
+## Regular-expression options
+
+Every regular-expression source in a rule option is compiled with JavaScript's `u` flag
+(Unicode). `sh/no-secret-flags` also uses `i`, preserving case-insensitive matching for
+both default and custom patterns. `sh/no-secret-env-reads` and `sh/prefer-local` match
+case-sensitively. The original name and pattern are used without lower-casing either.
+Thus `patterns: ['token']` catches `--TOKEN` in `no-secret-flags`, but does not catch
+`$GITHUB_TOKEN` in `no-secret-env-reads`. `allowPattern: '^g_'` exempts `g_cache`, but not
+`G_cache`, in `prefer-local`. Sources are strings, without `/` delimiters or flag suffixes;
+write `\\p{Lu}` in a JavaScript string to match an uppercase Unicode letter.
+
+The shared compiler validates syntax with these actual flags, then applies the
+[pattern-safety guard](./no-secret-flags.md#patterns-run-against-script-controlled-text).
+All regex syntax errors, including `(`, fail when the enabled rule first runs on a file.
+The error names the rule, option (including the array index) and pattern; ESLint reports
+"Occurred while linting <file>" and exits with status 2.
+
+Config resolution does not compile regex sources: `--print-config` will not catch any regex syntax errors.
+The schemas still check option types and array lengths, but deliberately omit the `regex`
+format. ESLint validates that format without flags, which would reject Unicode-valid sources
+such as `^[\u{41}-\u{5A}]+$` (an uppercase-letter range under `u`). Keeping compilation in the
+rule allows these sources and gives every syntax error the same first-rule-run timing.
+
+Migration: sources accepted without `u` may now fail, including identity escapes such as
+`\-` outside a character class, `\q` (also invalid inside `[\q]`), and incomplete quantifiers
+such as `a{,5}`. Use `-`, `q` or `a\\{,5\\}` respectively in JavaScript strings for those
+literal characters. An escaped hyphen **inside** a class (`[\-]`, written `'[\\-]'` in a
+JavaScript string) remains valid. Unicode property escapes (`\p{Lu}`) and code point escapes
+(`\u{1F510}`) now have their Unicode meaning in every regex option.

package/docs/rules/_template.md

@@ -15,7 +15,7 @@
   `{"options": {"maxNesting": 2}, "dialect": "bash"}`, then the usual closing. See any
   existing page, e.g. `max-script-complexity.md`, for the exact spelling.
 
-  Keys: `options` (the rule's options value), `dialect`, `shellVersion`, `convention`
+  Keys: `options` (the rule's options value), `dialect`, `minBashVersion`, `convention`
   (`"commentPragma"`) and `filename`. Under `### Incorrect` you may also state what the prose
   claims exactly: `findings` (a count), `messageIds` (in report order), `output` (the source
   after autofix) and `suggestionOutputs`. A typo in the annotation fails the test.
@@ -38,7 +38,7 @@
 
 <Why this policy matters for shell scripts, and exactly what the rule reports. Say which
 node types or constructs it inspects and which it deliberately ignores. If the rule depends on
-`languageOptions` (`dialect`, `shellVersion`), say how.>
+`languageOptions` (`dialect`, `minBashVersion`), say how.>
 
 ## Options
 

package/docs/rules/compat/no-append-all-redirect.md

@@ -21,15 +21,15 @@ Under `dialect: "posix"` the parser itself rejects `&>>`, so a POSIX file that u
 This is a version-compat rule. Whether it reports depends only on `languageOptions`, as
 described in [version compatibility](../../compat.md):
 
-- `shellVersion` unset: never reports. An unset version means the newest Bash.
-- `dialect: "bash"` (the default) or `"bats"`: reports when `shellVersion` is older than `4.0`.
+- `minBashVersion` unset: no Bash version constraint, so no report under `bash` or `bats`.
+- `dialect: "bash"` (the default) or `"bats"`: reports when `minBashVersion` is older than `4.0`.
 - `dialect: "mksh"` or `"zsh"`: never reports.
 
 ### Suggestion
 
 A suggestion rewrites the redirection:
 
-<!-- transform: {"kind": "suggestion", "dialect": "bash", "shellVersion": "3.2"} -->
+<!-- transform: {"kind": "suggestion", "dialect": "bash", "minBashVersion": "3.2"} -->
 ```sh
 build &>> build.log
 # becomes
@@ -38,12 +38,12 @@ build >> build.log 2>&1
 
 ## Options
 
-This rule has no options. Set the target through `languageOptions`:
+This rule has no options. Set the required support through `languageOptions`:
 
 ```js
 // eslint.config.js
 {
-  languageOptions: { dialect: 'bash', shellVersion: '3.2' },
+  languageOptions: { dialect: 'bash', minBashVersion: '3.2' },
   rules: {
     'sh/compat/no-append-all-redirect': 'error',
   },
@@ -54,29 +54,29 @@ This rule has no options. Set the target through `languageOptions`:
 
 ### Incorrect
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2", "findings": 1} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2", "findings": 1} -->
 ```sh
 build &>> build.log
 ```
 
 ### Correct
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2"} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2"} -->
 ```sh
 build >> build.log 2>&1
 build &> build.log
 echo "use &>> on Bash 4"
 ```
 
-With `shellVersion: "4.0"` or newer, or with no `shellVersion`, `&>>` is fine.
+With `minBashVersion: "4.0"` or newer, or with no `minBashVersion`, `&>>` is fine.
 
 ## When not to use it
 
-Turn the rule off when your scripts never run on Bash older than 4.0, or leave `shellVersion`
+Turn the rule off when your scripts never run on Bash older than 4.0, or leave `minBashVersion`
 unset, which makes the rule report nothing.
 
 ## Relationship to shellcheck
@@ -84,4 +84,4 @@ unset, which makes the rule report nothing.
 eslint-sh is a convention and contract linter: a policy layer, where shellcheck is the gotcha
 layer. Run shellcheck beside it.
 
-shellcheck 0.11.0 reports nothing for `cmd &>> log` under either `-s sh` or `-s bash`. (`cmd &> log` is different: it reports SC3020 under `-s sh`.) So shellcheck gives no finding for `&>>` in a POSIX sh script or in a Bash 3.2 target. This rule exists for both.
+shellcheck 0.11.0 reports nothing for `cmd &>> log` under either `-s sh` or `-s bash`. (`cmd &> log` is different: it reports SC3020 under `-s sh`.) So shellcheck gives no finding for `&>>` in a POSIX sh script or in a script that must support Bash 3.2. This rule exists for both.

package/docs/rules/compat/no-associative-arrays.md

@@ -1,6 +1,6 @@
 # `sh/compat/no-associative-arrays`
 
-Disallow associative arrays (`declare -A`, `typeset -A`) in scripts whose target shell lacks
+Disallow associative arrays (`declare -A`, `typeset -A`) in scripts that must support a shell lacking
 them: Bash older than 4.0, including the Bash 3.2 that macOS ships as `/bin/bash`, and POSIX sh.
 
 | Configs | Fixable     | Languages |
@@ -17,9 +17,9 @@ return the wrong values without an error.
 This is a version-compat rule. Whether it reports depends only on `languageOptions`, as
 described in [version compatibility](../../compat.md):
 
-- `shellVersion` unset: never reports. An unset version means the newest Bash.
-- `dialect: "bash"` (the default) or `"bats"`: reports when `shellVersion` is older than `4.0`.
-- `dialect: "posix"`: reports at any `shellVersion`, because POSIX sh has no arrays.
+- `minBashVersion` unset: no Bash version constraint, so no report under `bash` or `bats`.
+- `dialect: "bash"` (the default) or `"bats"`: reports when `minBashVersion` is older than `4.0`.
+- `dialect: "posix"`: reports regardless of Bash releases, because POSIX sh has no arrays.
 - `dialect: "mksh"` or `"zsh"`: never reports.
 
 The rule reads the options of every `declare` and `typeset` command, up to the first operand,
@@ -37,12 +37,12 @@ The rule deliberately ignores:
 
 ## Options
 
-This rule has no options. Set the target through `languageOptions`:
+This rule has no options. Set the required support through `languageOptions`:
 
 ```js
 // eslint.config.js
 {
-  languageOptions: { dialect: 'bash', shellVersion: '3.2' },
+  languageOptions: { dialect: 'bash', minBashVersion: '3.2' },
   rules: {
     'sh/compat/no-associative-arrays': 'error',
   },
@@ -53,9 +53,9 @@ This rule has no options. Set the target through `languageOptions`:
 
 ### Incorrect
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2", "findings": 4} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2", "findings": 4} -->
 ```sh
 declare -A ports            # associative arrays need Bash 4.0
 typeset -A ports            # the same declaration through typeset
@@ -65,9 +65,9 @@ builtin declare -A ports    # reached through the builtin wrapper
 
 ### Correct
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2"} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2"} -->
 ```sh
 # Keep the mapping as JSON and look keys up with jq.
 port=$(jq -r --arg k "$service" '.[$k]' ports.json)
@@ -75,16 +75,16 @@ port=$(jq -r --arg k "$service" '.[$k]' ports.json)
 declare -a hosts            # indexed arrays exist in Bash 3.2
 ```
 
-With `shellVersion: "4.0"` or newer, or with no `shellVersion`:
+With `minBashVersion: "4.0"` or newer, or with no `minBashVersion`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "4.0"} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "4.0"} -->
 ```sh
 declare -A ports
 ```
 
 ## When not to use it
 
-Turn the rule off when your scripts never run on Bash older than 4.0, or leave `shellVersion`
+Turn the rule off when your scripts never run on Bash older than 4.0, or leave `minBashVersion`
 unset, which makes the rule report nothing.
 
 ## Relationship to shellcheck
@@ -92,4 +92,4 @@ unset, which makes the rule report nothing.
 eslint-sh is a convention and contract linter: a policy layer, where shellcheck is the gotcha
 layer. Run shellcheck beside it.
 
-shellcheck 0.11.0 reports the command, not the option: under `-s sh`, `declare -A` draws SC3044 (`declare` is undefined in POSIX sh), and `local -A` draws SC3043. Under `-s bash` it reports nothing. It has no way to target a Bash version, so it reports nothing for `declare -A` in a script that must run on Bash 3.2. This rule exists for that target.
+shellcheck 0.11.0 reports the command, not the option: under `-s sh`, `declare -A` draws SC3044 (`declare` is undefined in POSIX sh), and `local -A` draws SC3043. Under `-s bash` it reports nothing. It has no way to check support for a minimum Bash version, so it reports nothing for `declare -A` in a script that must run on Bash 3.2. This rule checks that support requirement.

package/docs/rules/compat/no-brace-sequence-padding-step.md

@@ -0,0 +1,90 @@
+# `sh/compat/no-brace-sequence-padding-step`
+
+Disallow zero-padded (`{01..10}`) and stepped (`{1..10..2}`, `{a..e..2}`) brace sequences in scripts
+whose target shell lacks them: Bash older than 4.0, including the Bash 3.2 that macOS ships as
+`/bin/bash`, and POSIX sh.
+
+| Configs                      | Fixable     | Languages |
+| ---------------------------- | ----------- | --------- |
+| `bash-3.2`, `posix-portable` | not fixable | `sh/sh`   |
+
+## Rule details
+
+Both forms arrived in Bash 4.0, and neither fails on Bash 3.2, which is what makes them easy to miss. On Bash 3.2.57, `echo {01..03} {1..9..4}` prints `1 2 3 {1..9..4}` and exits 0: the padding is dropped and the stepped sequence stays as a literal word. The script carries on with different words. POSIX does not specify brace expansion, so what a POSIX target does with these words depends on the shell: dash prints `{01..03} {1..9..4}`, macOS's `/bin/sh` prints `1 2 3` for `{01..03}`, and Bash 5.3 under `--posix` prints `01 02 03`. A plain `{1..3}` is as shell-dependent, but this rule reports only the two forms Bash 4.0 added.
+
+The parser keeps a brace sequence as literal text inside a word, so the rule reads the literal text of the words the shell brace-expands. It reports a `{…}` that holds nothing but a sequence:
+
+- two integer endpoints (an optional sign and digits) or two single ASCII letters, with an optional third `..` field that is an integer step. A step makes the sequence stepped, for numbers and letters alike, and the step may be `0` or negative.
+- integer endpoints are padded when either has more than one digit and starts with `0` after an optional `-`: `{01..10}`, `{1..03}`, `{-01..1}`, `{00..10}`. A lone `0` (`{0..3}`) and `{-0..2}` are not padded, and neither is a `+01` endpoint, which Bash 5.3 expands without padding, as Bash 3.2 does.
+
+Everything else is left alone, because it is the same on every Bash or is not a sequence at all: `{1..3}`, `{a..c}`, a descending `{3..1}`, a comma list (`{01,02}`, `{01..03,x}`), mixed endpoints (`{a..5..2}`), multi-character endpoints, a variable endpoint (`{01..$n}`, which the shell never expands), and a malformed one (`{01..}`, `{1..9..x}`, spaces inside). Quoting and escaping are honoured: `"{01..10}"`, `'{01..10}'`, `$'{01..10}'`, `\{01..10}` and `{01..10\}` are plain text.
+
+Only code the parser sees is read: a sequence inside a quoted string that is run later (`eval '...'`, `trap '...'`) is not seen. A sequence is read where the shell brace-expands: command words and arguments, `for` and `select` lists, the elements of an array literal without an index (`a=({01..03})`), and the operands of `declare`, `local`, `export` and `readonly` (also the value in `declare d={01..03}`). It is not read where the shell does no brace expansion: a plain assignment (`a={01..03}`), a `case` subject or pattern, the operands of `[[ ]]`, here-strings and here-documents, parameter-expansion words (`${v:-{01..03}}`), and a keyed array element (`a=([5]={01..03})`). A redirection target (`: > out{01..01}`) is read only when the sequence provably yields one word. With several words the target is an "ambiguous redirect" error on Bash 5.3 (and for a padded sequence on 3.2 too), so the script is broken on every Bash that has the feature and there is nothing to port. With one word the shells disagree silently: `out{01..01}` writes `out1` on Bash 3.2.57 and `out01` on 5.3.9, and `out{1..3..5}` writes a file literally named `out{1..3..5}` on 3.2.57 and `out1` on 5.3.9. A sequence is always static text, so its length is always known; a target that also holds another brace group (`out{01..01}{a,b}`) is not read, because the product cannot be counted here, so a redirect target with more than one brace group is skipped. The same selection applies under `dialect: "posix"`, although the system `dash` creates a literal file such as `out{01..02}` for any of them without an error: a several-word target is still a sequence that no Bash accepts. A here-string or here-document word is never read. A descriptor duplication whose whole target is a one-word sequence is read only where the shells differ (checked on 3.2.57 and 5.3.9). A padded non-negative number names the same descriptor on both (`>&{01..01}`, `2>&{02..02}`, `<&{00..00}`, and `>&{-00..-00}`, which is 0), so it is not reported. A negative number in a descriptor position (`2>&{-01..-01}`, `<&{-01..-01}`, `3>&{-01..-01}`) is an "ambiguous redirect" error on both, so it is not reported either. A stepped sequence still differs (`>&{1..3..5}`, `3>&{1..3..5}` and `<&{0..0..2}` are an error or a literal word on 3.2.57 and descriptor 1 or 0 on 5.3.9), and a bare `>&` with a negative number writes a file named `-1` on 3.2.57 and `-01` on 5.3.9, as does `&>{-01..-01}`, so those are reported. The report is on the whole word, once per word, for the first sequence in it.
+
+Numbers are bounded the way Bash 5.3 bounds them, because a word outside the bounds stays literal on every Bash and nothing differs: each endpoint and the distance between them must fit a signed 64-bit integer, and so must the step's magnitude (a step of `-9223372036854775808` is not a step). Leading zeros do not count towards the value, so `{1..00000000000000000003}` is a sequence. `{1..3..999999999999999999999}`, `{1..99999999999999999999}` and `{-1..9223372036854775807..9223372036854775807}` are not reported. These bounds were measured on Bash 5.3.9 and 3.2.57 only; the 4.x releases' bounds were not measured.
+
+The portable alternative is to count in a loop and format with `printf`, for example `i=1; while [ "$i" -le 3 ]; do printf '%02d\n' "$i"; i=$((i + 1)); done` for a padded sequence, or `i=1; while [ "$i" -le 9 ]; do echo "$i"; i=$((i + 4)); done` for a stepped one. Both run on Bash 3.2 and on dash.
+
+This is a version-compat rule. Whether it reports depends only on `languageOptions`, as
+described in [version compatibility](../../compat.md):
+
+- `minBashVersion` unset: no Bash version constraint, so no report under `bash` or `bats`.
+- `dialect: "bash"` (the default) or `"bats"`: reports when `minBashVersion` is older than `4.0`.
+- `dialect: "posix"`: reports regardless of Bash releases, because POSIX does not specify brace expansion.
+- `dialect: "mksh"` or `"zsh"`: never reports.
+
+## Options
+
+This rule has no options. Set the required support through `languageOptions`:
+
+```js
+// eslint.config.js
+{
+  languageOptions: { dialect: 'bash', minBashVersion: '3.2' },
+  rules: {
+    'sh/compat/no-brace-sequence-padding-step': 'error',
+  },
+}
+```
+
+## Examples
+
+### Incorrect
+
+With `minBashVersion: "3.2"`:
+
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2", "findings": 3} -->
+
+```sh
+for n in {01..12}; do echo "report-$n"; done
+echo {1..9..4}
+cp backup{a..e..2}.tar /tmp
+```
+
+### Correct
+
+With `minBashVersion: "3.2"`:
+
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2"} -->
+
+```sh
+n=1
+while [ "$n" -le 12 ]; do printf 'report-%02d\n' "$n"; n=$((n + 1)); done
+echo {1..3} {a..c}
+echo '{01..12}'
+a={01..03}
+```
+
+With `minBashVersion: "4.0"` or newer, or with no `minBashVersion`, both forms are fine.
+
+## When not to use it
+
+Turn the rule off when your scripts never run on Bash older than 4.0, or leave `minBashVersion`
+unset, which makes the rule report nothing.
+
+## Relationship to shellcheck
+
+eslint-sh is a convention and contract linter: a policy layer, where shellcheck is the gotcha
+layer. Run shellcheck beside it.
+
+shellcheck 0.11.0 reports SC3009 (brace expansion is undefined in POSIX sh) under `-s sh` for every brace expansion, a plain `{1..3}` and `{a,b}` included. Under `-s bash` it reports nothing for these sequences. It does not know which Bash release a script must run on, so it cannot report the padded and stepped forms for a script that must support Bash 3.2. This rule checks that support requirement.

package/docs/rules/compat/no-case-attributes.md

@@ -1,7 +1,7 @@
 # `sh/compat/no-case-attributes`
 
 Disallow the case-converting attributes `declare -l` and `declare -u` (also through `typeset` and
-`local`) in scripts whose target shell lacks them: Bash older than 4.0, including the Bash 3.2
+`local`) in scripts that must support a shell lacking them: Bash older than 4.0, including the Bash 3.2
 that macOS ships as `/bin/bash`, and POSIX sh.
 
 | Configs                      | Fixable     | Languages |
@@ -19,19 +19,19 @@ The portable alternative is to convert the value when it is assigned, with `tr`:
 This is a version-compat rule. Whether it reports depends only on `languageOptions`, as
 described in [version compatibility](../../compat.md):
 
-- `shellVersion` unset: never reports. An unset version means the newest Bash.
-- `dialect: "bash"` (the default) or `"bats"`: reports when `shellVersion` is older than `4.0`.
-- `dialect: "posix"`: reports at any `shellVersion`, because POSIX sh has no `declare`.
+- `minBashVersion` unset: no Bash version constraint, so no report under `bash` or `bats`.
+- `dialect: "bash"` (the default) or `"bats"`: reports when `minBashVersion` is older than `4.0`.
+- `dialect: "posix"`: reports regardless of Bash releases, because POSIX sh has no `declare`.
 - `dialect: "mksh"` or `"zsh"`: never reports.
 
 ## Options
 
-This rule has no options. Set the target through `languageOptions`:
+This rule has no options. Set the required support through `languageOptions`:
 
 ```js
 // eslint.config.js
 {
-  languageOptions: { dialect: 'bash', shellVersion: '3.2' },
+  languageOptions: { dialect: 'bash', minBashVersion: '3.2' },
   rules: {
     'sh/compat/no-case-attributes': 'error',
   },
@@ -42,9 +42,9 @@ This rule has no options. Set the target through `languageOptions`:
 
 ### Incorrect
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2", "findings": 2} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2", "findings": 2} -->
 
 ```sh
 declare -l answer=$1
@@ -55,9 +55,9 @@ f() {
 
 ### Correct
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2"} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2"} -->
 
 ```sh
 answer=$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')
@@ -67,11 +67,11 @@ f() {
 }
 ```
 
-With `shellVersion: "4.0"` or newer, or with no `shellVersion`, the attributes are fine.
+With `minBashVersion: "4.0"` or newer, or with no `minBashVersion`, the attributes are fine.
 
 ## When not to use it
 
-Turn the rule off when your scripts never run on Bash older than 4.0, or leave `shellVersion`
+Turn the rule off when your scripts never run on Bash older than 4.0, or leave `minBashVersion`
 unset, which makes the rule report nothing.
 
 ## Relationship to shellcheck
@@ -79,4 +79,4 @@ unset, which makes the rule report nothing.
 eslint-sh is a convention and contract linter: a policy layer, where shellcheck is the gotcha
 layer. Run shellcheck beside it.
 
-Under `-s sh`, shellcheck 0.11.0 reports the command, not the option: `declare -l` and `declare -u` draw SC3044 (`declare` is undefined in POSIX sh), and `local -l` and `local -u` draw SC3043. Under `-s bash` it reports nothing for these options. It does not know which Bash release a script must run on, so it reports nothing for `declare -l` in a Bash 3.2 target. This rule exists for that target.
+Under `-s sh`, shellcheck 0.11.0 reports the command, not the option: `declare -l` and `declare -u` draw SC3044 (`declare` is undefined in POSIX sh), and `local -l` and `local -u` draw SC3043. Under `-s bash` it reports nothing for these options. It does not know which Bash release a script must run on, so it reports nothing for `declare -l` in a script that must support Bash 3.2. This rule checks that support requirement.

package/docs/rules/compat/no-case-fallthrough.md

@@ -1,7 +1,7 @@
 # `sh/compat/no-case-fallthrough`
 
 Disallow the `case` terminators `;&` (run the next branch without testing its pattern) and `;;&`
-(go on testing the next patterns) in scripts whose target shell lacks them: Bash older than 4.0,
+(go on testing the next patterns) in scripts that must support a shell lacking them: Bash older than 4.0,
 including the Bash 3.2 that macOS ships as `/bin/bash`, and POSIX sh.
 
 | Configs | Fixable | Languages |
@@ -21,18 +21,18 @@ Under `dialect: "posix"` the parser itself rejects both terminators, so a POSIX
 This is a version-compat rule. Whether it reports depends only on `languageOptions`, as
 described in [version compatibility](../../compat.md):
 
-- `shellVersion` unset: never reports. An unset version means the newest Bash.
-- `dialect: "bash"` (the default) or `"bats"`: reports when `shellVersion` is older than `4.0`.
+- `minBashVersion` unset: no Bash version constraint, so no report under `bash` or `bats`.
+- `dialect: "bash"` (the default) or `"bats"`: reports when `minBashVersion` is older than `4.0`.
 - `dialect: "mksh"` or `"zsh"`: never reports.
 
 ## Options
 
-This rule has no options. Set the target through `languageOptions`:
+This rule has no options. Set the required support through `languageOptions`:
 
 ```js
 // eslint.config.js
 {
-  languageOptions: { dialect: 'bash', shellVersion: '3.2' },
+  languageOptions: { dialect: 'bash', minBashVersion: '3.2' },
   rules: {
     'sh/compat/no-case-fallthrough': 'error',
   },
@@ -43,9 +43,9 @@ This rule has no options. Set the target through `languageOptions`:
 
 ### Incorrect
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2", "findings": 2} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2", "findings": 2} -->
 ```sh
 case $level in
   debug) verbose=1 ;&
@@ -59,9 +59,9 @@ esac
 
 ### Correct
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2"} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2"} -->
 ```sh
 case $level in
   debug) verbose=1; log=1 ;;
@@ -75,11 +75,11 @@ case $file in
 esac
 ```
 
-With `shellVersion: "4.0"` or newer, or with no `shellVersion`, both terminators are fine.
+With `minBashVersion: "4.0"` or newer, or with no `minBashVersion`, both terminators are fine.
 
 ## When not to use it
 
-Turn the rule off when your scripts never run on Bash older than 4.0, or leave `shellVersion`
+Turn the rule off when your scripts never run on Bash older than 4.0, or leave `minBashVersion`
 unset, which makes the rule report nothing.
 
 ## Relationship to shellcheck
@@ -87,4 +87,4 @@ unset, which makes the rule report nothing.
 eslint-sh is a convention and contract linter: a policy layer, where shellcheck is the gotcha
 layer. Run shellcheck beside it.
 
-Under `-s sh`, shellcheck 0.11.0 reports `;&` and `;;&` as an error, SC2127 ("To use cases with ;&, specify #!/usr/bin/env bash or ksh", or the `;;&` equivalent naming bash), not as one of its SC3xxx portability checks. It reports the same SC2127 under `-s dash`, reports `;;&` (but not `;&`) under `-s ksh`, and reports nothing under `-s bash`. It does not know which Bash release a script must run on, so it reports nothing for either operator in a Bash 3.2 target. This rule exists for that target.
+Under `-s sh`, shellcheck 0.11.0 reports `;&` and `;;&` as an error, SC2127 ("To use cases with ;&, specify #!/usr/bin/env bash or ksh", or the `;;&` equivalent naming bash), not as one of its SC3xxx portability checks. It reports the same SC2127 under `-s dash`, reports `;;&` (but not `;&`) under `-s ksh`, and reports nothing under `-s bash`. It does not know which Bash release a script must run on, so it reports nothing for either operator in a script that must support Bash 3.2. This rule checks that support requirement.

package/docs/rules/compat/no-case-modification.md

@@ -17,19 +17,19 @@ The report is on the whole expansion, with or without a trailing pattern (`${v^^
 This is a version-compat rule. Whether it reports depends only on `languageOptions`, as
 described in [version compatibility](../../compat.md):
 
-- `shellVersion` unset: never reports. An unset version means the newest Bash.
-- `dialect: "bash"` (the default) or `"bats"`: reports when `shellVersion` is older than `4.0`.
+- `minBashVersion` unset: no Bash version constraint, so no report under `bash` or `bats`.
+- `dialect: "bash"` (the default) or `"bats"`: reports when `minBashVersion` is older than `4.0`.
 - `dialect: "posix"`: reports nothing in practice for this syntax, because the POSIX parser rejects it with a parse error before any rule runs.
 - `dialect: "mksh"` or `"zsh"`: never reports.
 
 ## Options
 
-This rule has no options. Set the target through `languageOptions`:
+This rule has no options. Set the required support through `languageOptions`:
 
 ```js
 // eslint.config.js
 {
-  languageOptions: { dialect: 'bash', shellVersion: '3.2' },
+  languageOptions: { dialect: 'bash', minBashVersion: '3.2' },
   rules: {
     'sh/compat/no-case-modification': 'error',
   },
@@ -40,9 +40,9 @@ This rule has no options. Set the target through `languageOptions`:
 
 ### Incorrect
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2", "findings": 3} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2", "findings": 3} -->
 ```sh
 name=${input,,}      # lowercase every character
 title=${word^}       # uppercase the first character
@@ -51,24 +51,24 @@ flag=${arg^^[a-z]}   # with a pattern
 
 ### Correct
 
-With `shellVersion: "3.2"`:
+With `minBashVersion: "3.2"`:
 
-<!-- example: {"dialect": "bash", "shellVersion": "3.2"} -->
+<!-- example: {"dialect": "bash", "minBashVersion": "3.2"} -->
 ```sh
 name=$(printf '%s' "$input" | tr '[:upper:]' '[:lower:]')
 title=$(printf '%s' "${word%"${word#?}"}" | tr '[:lower:]' '[:upper:]')"${word#?}"
 ```
 
-With `shellVersion: "4.0"` or newer, or with no `shellVersion`, the original forms are fine.
+With `minBashVersion: "4.0"` or newer, or with no `minBashVersion`, the original forms are fine.
 
 ## When not to use it
 
 Turn the rule off when your scripts never run on Bash older than 4.0, or leave
-`shellVersion` unset, which makes the rule report nothing.
+`minBashVersion` unset, which makes the rule report nothing.
 
 ## Relationship to shellcheck
 
 eslint-sh is a convention and contract linter: a policy layer, where shellcheck is the gotcha
 layer. Run shellcheck beside it.
 
-shellcheck reports case-modifying expansions in scripts it treats as POSIX sh (SC3059), but it cannot target a Bash version, so it cannot report `${v,,}` in a script that must run on Bash 3.2. This rule exists for that target.
+shellcheck reports case-modifying expansions in scripts it treats as POSIX sh (SC3059), but it cannot check support for a minimum Bash version, so it cannot report `${v,,}` in a script that must run on Bash 3.2. This rule checks that support requirement.