@fabriziosalmi/slopless 1.11.0 → 1.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-001.yaml

@@ -21,6 +21,7 @@ match:
     - env
     - yaml
     - json
+    - astro
 message: >-
   Hardcoded credential at line {line}. Read it from the environment. Values that name what
   they are, such as CHANGEME or a fixture spelling out "secret", are not reported: they describe

package/rules/VBC-004.yaml

@@ -6,11 +6,14 @@ tags:
   - security
 match:
   regex: >-
-    (?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|OR\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`]))
+    (?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*(?=[^\n]*["'`]\s*\+)["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|OR\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`]))
   flags: i
   # A fragment that closes on a placeholder injects nothing: `q += " AND p = ?"`
   # beside `args = append(args, v)` is how a dynamic WHERE clause is built
   # safely, and it is the shape every Go and Python query builder uses.
+  # Appending a literal concatenates nothing: `q += " ORDER BY id DESC;"` adds
+  # a clause the code already decided. The branch now asks that a value actually
+  # arrive, which is the thing the rule is about.
   scan: all
   file_types:
     - js
@@ -23,6 +26,7 @@ match:
     - rb
     - java
     - cs
+    - astro
 message: >-
   SQL built by string concatenation at line {line}. An attacker controlling the interpolated
   value can rewrite the statement. Use parameterized queries or a query builder that binds
@@ -32,6 +36,8 @@ tests:
     - db.query("SELECT * FROM users WHERE id = " + id);
     - sql += " AND status = " + status;
   quiet:
+    - 'q += " ORDER BY acquired DESC;"'
+    - 'q += " LIMIT 10;"'
     - db.query("SELECT * FROM users WHERE id = $1", [id]);
     - 'q += ` AND project = ?`'
     - sql += " AND id = $1"

package/rules/VBC-005.yaml

@@ -5,10 +5,14 @@ category: core
 tags:
   - best-practice
 match:
-  regex: (?<!\bdeclare\s{1,4})\bvar\b
+  # `var(--x)` is CSS asking for a custom property, not a JavaScript
+  # declaration. An inline <style> block in an .astro or .html file is full
+  # of them, and `var (x)` is not valid JavaScript, so the exclusion is free.
+  regex: (?<!\bdeclare\s{1,4})\bvar\b(?!\s*\()
   file_types:
     - js
     - ts
+    - astro
 fix:
   regex_replace:
     pattern: \bvar\b
@@ -18,6 +22,9 @@ tests:
   fire:
     - var total = 0;
   quiet:
+    # CSS asking for a custom property, which an inline <style> block is full of.
+    - '  font-family: var(--font-serif);'
+    - '  width: calc(100% - var(--gap));'
     - const total = 0;
     - let total = 0;
     - file: global.d.ts

package/rules/VBC-007.yaml

@@ -12,6 +12,7 @@ match:
     - js
     - ts
     - py
+    - astro
 message: >-
   Monetary value declared as a floating point literal at line {line}. Binary floats cannot
   represent decimal cents exactly. Store money as integer minor units or use a decimal type.

package/rules/VBC-008.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Using setTimeout as a sleep to paper over a race condition at line {line}. This is a flaky
   band-aid that slows the app down. Fix the underlying async coordination with proper event

package/rules/VBC-009.yaml

@@ -12,6 +12,7 @@ match:
     - ts
     - tsx
     - jsx
+    - astro
 message: >-
   jQuery dependency detected at line {line}. In 2026, native DOM APIs (querySelector, fetch,
   classList, addEventListener) are sufficient and far lighter. Dropping jQuery reduces bundle

package/rules/VBC-010.yaml

@@ -13,6 +13,7 @@ match:
     - ts
     - tsx
     - jsx
+    - astro
 message: >-
   Clickable <div> with onclick handler at line {line}. Use <button> or <a> for interactive
   elements. Non-semantic clickable divs are invisible to keyboard navigation and screen readers,

package/rules/VBC-011.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Direct document.cookie write at line {line}. Manual cookie manipulation is error-prone and
   easy to misconfigure. Use a cookie library that enforces proper security flags (HttpOnly,

package/rules/VBC-012.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Redundant Promise constructor wrapping at line {line}. This is an anti-pattern called "Promise
   constructor anti-pattern". Use Promise.resolve() directly or return the value/promise without

package/rules/VBC-015.yaml

@@ -11,6 +11,7 @@ match:
     - js
     - ts
     - py
+    - astro
   # The same decision as the paths below, for languages that keep their
   # tests in the file they test.
   exclude_test_code: true

package/rules/VBC-016.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Potential commented-out code detected at line {line}. If the code is no longer needed, delete
   it. Use Git for history.

package/rules/VBC-017-B.yaml

@@ -16,6 +16,7 @@ match:
     - jsx
     - ts
     - tsx
+    - astro
 message: >-
   Focused test at line {line}. Committed, it runs this test and silently skips every other
   one in the file, and the suite still reports green.

package/rules/VBC-017.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Trivially true test assertion at line {line}. This test always passes regardless of the
   code under test and provides zero confidence. Write a real assertion that can actually fail

package/rules/VBC-018.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Production code with console usage '{match}' found at line {line}. Consider a professional
   logging library.

package/rules/VBC-019.yaml

@@ -13,6 +13,7 @@ match:
     - ts
     - py
     - sh
+    - astro
   # The same decision as the paths below, for languages that keep their
   # tests in the file they test.
   exclude_test_code: true

package/rules/VBC-023.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Notification.requestPermission() detected at line {line}. Requesting browser notification
   permissions immediately on page load is hostile UX that causes most users to click "Block"

package/rules/VBC-024.yaml

@@ -14,6 +14,7 @@ match:
     - ts
     - tsx
     - jsx
+    - astro
 message: >-
   Autoplay video without the muted attribute at line {line}. Autoplaying audio is one of the
   most hostile UX patterns: it embarrasses users in quiet environments, eats mobile data,

package/rules/VBC-027.yaml

@@ -15,6 +15,7 @@ match:
     - ts
     - css
     - scss
+    - astro
 message: >-
   Parallax scrolling effect detected at line {line}. Parallax effects can trigger vestibular
   disorders (nausea, dizziness) in sensitive users, carry significant GPU cost, and break

package/rules/VBC-030.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Confetti or particle animation library detected at line {line}. Overusing celebration effects
   devalues them and creates visual noise. Reserve confetti for genuinely significant milestones

package/rules/VBC-033.yaml

@@ -15,6 +15,7 @@ match:
     - ts
     - tsx
     - jsx
+    - astro
 message: >-
   Placeholder image service URL detected at line {line}. External placeholder services break
   when the service is down, look unfinished, and represent content that was never completed.

package/rules/VBC-034.yaml

@@ -17,6 +17,7 @@ match:
     - ts
     - py
     - html
+    - astro
   # The same decision as the paths below, for languages that keep their
   # tests in the file they test.
   exclude_test_code: true

package/rules/VBC-035.yaml

@@ -11,6 +11,7 @@ match:
     - html
     - tsx
     - jsx
+    - astro
 message: >-
   Icon-only button without aria-label at line {line}. A button containing only an SVG icon
   has no accessible name, making it completely opaque to screen readers. Add aria-label="Descriptive

package/rules/VBC-039.yaml

@@ -12,6 +12,7 @@ match:
     - py
     - rb
     - php
+    - astro
 message: >-
   Use of 'eval()' detected at line {line}. This is a massive security risk.
 tests:

package/rules/VBC-042.yaml

@@ -14,6 +14,7 @@ match:
     - js
     - ts
     - py
+    - astro
 message: >-
   Too many consecutive comment lines at line {line}. Code should be self-documenting.
 tests:

package/rules/VBC-048.yaml

@@ -11,6 +11,7 @@ match:
     - js
     - ts
     - py
+    - astro
 message: >-
   Meaningless variable name '{match}' detected at line {line}. Use descriptive names that
   convey intent.

package/rules/VBC-049.yaml

@@ -16,6 +16,7 @@ match:
     - py
     - go
     - rs
+    - astro
   # The same decision as the paths below, for languages that keep their
   # tests in the file they test.
   exclude_test_code: true

package/rules/VBC-051.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   snake_case and camelCase mixed at line {line}. Pick one convention per file. Object keys
   are not reported: a wire format often dictates those names.

package/rules/VBC-052.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Single-letter variable name detected at line {line}. Use more descriptive names.
 tests:

package/rules/VBC-053.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Redundant string interpolation detected at line {line}. Use the variable directly.
 tests:

package/rules/VBC-054.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Unnecessary 'else' after 'return' at line {line}. Remove the else and flatten the code.
 tests:

package/rules/VBC-056.yaml

@@ -24,6 +24,7 @@ match:
     - kt
     - swift
     - rb
+    - astro
 supersedes:
   - VBC-907
   - VBC-150

package/rules/VBC-057.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - ts
     - tsx
+    - astro
 message: >-
   Avoid using 'any' type at line {line}. Use a more specific type or 'unknown'.
 tests:

package/rules/VBC-058.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Overly long variable name (>35 chars) detected at line {line}. This is getting too vibey.
 tests:

package/rules/VBC-063.yaml

@@ -10,6 +10,7 @@ match:
     - js
     - ts
     - py
+    - astro
 message: Empty else block detected at line {line}. This clutters the code.
 tests:
   fire:

package/rules/VBC-068.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Chained or nested ternary at line {line}. Stacked conditionals are hard to read and hard
   to debug; use an if/else block or a lookup table.

package/rules/VBC-070.yaml

@@ -22,6 +22,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Use of 'innerHTML' detected at line {line}. Use 'textContent' or a sanitizer to avoid XSS.
 tests:

package/rules/VBC-079.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   debugger; statement found at line {line}. This should never reach production.
 tests:

package/rules/VBC-080.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Avoid using alert() at line {line}. Use a modern UI notification system.
 tests:

package/rules/VBC-084.yaml

@@ -12,6 +12,7 @@ match:
     - ts
     - py
     - go
+    - astro
 message: >-
   Line is too long ({count} characters). Consider wrapping it. Max recommended: 120.
 tests:

package/rules/VBC-086.yaml

@@ -13,6 +13,7 @@ match:
     - js
     - ts
     - tsx
+    - astro
 message: target='_blank' without rel='noopener' detected at line {line}.
 tests:
   fire:

package/rules/VBC-090.yaml

@@ -25,6 +25,7 @@ match:
     - kt
     - swift
     - rb
+    - astro
 message: >-
   Passive-aggressive or helpless comment '{match}' detected at line {line}. Replace with a
   technical explanation of the actual constraint or a link to the relevant issue tracker ticket.

package/rules/VBC-096.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Long regular expression literal at line {line} with no explanation. Add a comment stating
   what it matches, or build it from named parts.

package/rules/VBC-097.yaml

@@ -13,6 +13,7 @@ match:
     - js
     - ts
     - tsx
+    - astro
 message: Multiple <br> tags used for layout. Use CSS margin or padding instead.
 tests:
   fire:

package/rules/VBC-101.yaml

@@ -12,6 +12,7 @@ match:
     - js
     - ts
     - tsx
+    - astro
 message: Image missing 'alt' attribute at line {line}.
 tests:
   fire:

package/rules/VBC-103.yaml

@@ -25,6 +25,7 @@ match:
     - kt
     - swift
     - rb
+    - astro
 message: >-
   Block of decoration at line {line}: three or more comment lines that are shape and nothing
   else. A rule around a section heading is punctuation and is not reported; a banner is furniture

package/rules/VBC-104.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: Mixing 'require' and 'import' in the same file at line {line}.
 tests:
   fire:

package/rules/VBC-112.yaml

@@ -10,6 +10,7 @@ match:
     - js
     - ts
     - css
+    - astro
 message: >-
   Potential scroll hijacking or forced smooth scrolling detected at line {line}.
 tests:

package/rules/VBC-113.yaml

@@ -9,6 +9,7 @@ match:
   flags: i
   file_types:
     - html
+    - astro
 message: Disabling pinch-to-zoom is an accessibility violation.
 tests:
   fire:

package/rules/VBC-117.yaml

@@ -12,6 +12,7 @@ match:
     - js
     - ts
     - html
+    - astro
 message: >-
   Blocking paste in input fields harms both UX and security (password managers).
 tests:

package/rules/VBC-123.yaml

@@ -14,6 +14,7 @@ match:
     - js
     - ts
     - tsx
+    - astro
 message: >-
   Using placeholder as the only label at line {line} is bad for accessibility.
 tests:

package/rules/VBC-131.yaml

@@ -12,6 +12,7 @@ match:
     - js
     - ts
     - tsx
+    - astro
 message: Autoplay video backgrounds can be distracting and impact performance.
 tests:
   fire:

package/rules/VBC-150.yaml

@@ -22,6 +22,7 @@ match:
     - kt
     - swift
     - rb
+    - astro
 message: >-
   Tracked debt marker still in the code at line {line}. It is attributed, so close the ticket
   or delete the marker before shipping.

package/rules/VBC-215.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Assignment to a window property at line {line}. Globals collide across scripts and outlive
   the code that set them. Export the value, or attach it under one namespaced object if a

package/rules/VBC-334.yaml

@@ -30,6 +30,7 @@ match:
     - jsx
     - py
     - sh
+    - astro
 message: >-
   Potential AI-generated fluff or overused cliché '{match}' detected at line {line}. Keep
   documentation concise and human-centric.

package/rules/VBC-338.yaml

@@ -17,6 +17,7 @@ match:
     - js
     - ts
     - py
+    - astro
 message: >-
   Non-inclusive terminology at line {line}. Prefer main, primary/replica, allowlist/blocklist,
   and a plain "check". Domain uses such as an audio master bus or a mastering chain are not

package/rules/VBC-385.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Improper success message grammar at line {line}. Use 'Data saved successfully'.
 tests:

package/rules/VBC-901.yaml

@@ -16,6 +16,7 @@ match:
     - java
     - json
     - env
+    - astro
   # The same decision as the paths below, for languages that keep their
   # tests in the file they test.
   exclude_test_code: true

package/rules/VBC-902.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   document.write() is prohibited at line {line}. It is insecure and performance-heavy.
 tests:

package/rules/VBC-903.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: Passing strings to timers is eval-like and insecure at line {line}.
 tests:
   fire:

package/rules/VBC-904.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Magic string literal passed to function at line {line}. Use a named constant instead.
 tests:

package/rules/VBC-905.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: Debug console method '{line}' left in code. Remove before committing.
 tests:
   fire:

package/rules/VBC-906.yaml

@@ -25,6 +25,7 @@ match:
     - kt
     - swift
     - rb
+    - astro
 supersedes:
   - VBC-907
   - VBC-150

package/rules/VBC-907.yaml

@@ -25,6 +25,7 @@ match:
     - kt
     - swift
     - rb
+    - astro
 message: >-
   Unattributed debt marker at line {line}. Nobody owns it, so nobody will fix it. Use TODO(owner):
   or reference an issue such as TODO: #123.

package/rules/VBC-908.yaml

@@ -12,6 +12,7 @@ match:
     - js
     - ts
     - tsx
+    - astro
 message: >-
   Overly long inline style attribute at line {line}. Move styles to a CSS file or component.
 tests:

package/rules/VBC-910.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   console.table() left in code at line {line}. Useful for debug, but clutters production logs.
 tests: