@fabriziosalmi/slopless 1.12.6 → 1.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.12.6",
+  "version": "1.13.1",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-001.yaml

@@ -24,6 +24,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - env
     - yaml

package/rules/VBC-005.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 fix:
   regex_replace:

package/rules/VBC-007.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
 message: >-

package/rules/VBC-008.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Using setTimeout as a sleep to paper over a race condition at line {line}. This is a flaky

package/rules/VBC-011.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Direct document.cookie write at line {line}. Manual cookie manipulation is error-prone and

package/rules/VBC-012.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Redundant Promise constructor wrapping at line {line}. This is an anti-pattern called "Promise

package/rules/VBC-015.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
   # The same decision as the paths below, for languages that keep their

package/rules/VBC-016.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Potential commented-out code detected at line {line}. If the code is no longer needed, delete

package/rules/VBC-017.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Trivially true test assertion at line {line}. This test always passes regardless of the

package/rules/VBC-018.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Production code with console usage '{match}' found at line {line}. Consider a professional

package/rules/VBC-019.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - sh
     - astro

package/rules/VBC-023.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Notification.requestPermission() detected at line {line}. Requesting browser notification

package/rules/VBC-027.yaml

@@ -13,6 +13,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - css
     - scss
     - astro

package/rules/VBC-030.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Confetti or particle animation library detected at line {line}. Overusing celebration effects

package/rules/VBC-034.yaml

@@ -15,6 +15,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - html
     - astro

package/rules/VBC-039.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - rb
     - php

package/rules/VBC-042.yaml

@@ -13,6 +13,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
 message: >-

package/rules/VBC-048.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
 message: >-

package/rules/VBC-049.yaml

@@ -13,6 +13,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - go
     - rs

package/rules/VBC-051.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   snake_case and camelCase mixed at line {line}. Pick one convention per file. Object keys

package/rules/VBC-052.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Single-letter variable name detected at line {line}. Use more descriptive names.

package/rules/VBC-053.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Redundant string interpolation detected at line {line}. Use the variable directly.

package/rules/VBC-054.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Unnecessary 'else' after 'return' at line {line}. Remove the else and flatten the code.

package/rules/VBC-056.yaml

@@ -13,6 +13,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - sh
     - go

package/rules/VBC-058.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Overly long variable name (>35 chars) detected at line {line}. This is getting too vibey.

package/rules/VBC-063.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
 message: Empty else block detected at line {line}. This clutters the code.

package/rules/VBC-068.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Chained or nested ternary at line {line}. Stacked conditionals are hard to read and hard

package/rules/VBC-070.yaml

@@ -22,6 +22,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Use of 'innerHTML' detected at line {line}. Use 'textContent' or a sanitizer to avoid XSS.

package/rules/VBC-079.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   debugger; statement found at line {line}. This should never reach production.

package/rules/VBC-080.yaml

@@ -14,6 +14,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Avoid using alert() at line {line}. Use a modern UI notification system.

package/rules/VBC-084.yaml

@@ -5,6 +5,12 @@ category: clean-code
 tags:
   - clean-code
 match:
+  # `.tsx` is left out on purpose, and the number is the reason. Across 525 .tsx
+  # and 716 .ts files from the same repositories, lines over 120 characters run
+  # 8.0 per .tsx file against 0.7 per .ts file. That is JSX — a className string
+  # and three props on one tag — not a difference in how the code was written,
+  # and turning it on there would file 4,274 warnings over everything else the
+  # rules have to say about those files.
   regex: ^.{120,}$
   scan: all
   file_types:

package/rules/VBC-090.yaml

@@ -13,6 +13,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - sh
     - c

package/rules/VBC-096.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Long regular expression literal at line {line} with no explanation. Add a comment stating

package/rules/VBC-103.yaml

@@ -14,6 +14,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - sh
     - go

package/rules/VBC-104.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: Mixing 'require' and 'import' in the same file at line {line}.
 tests:

package/rules/VBC-112.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - css
     - astro
 message: >-

package/rules/VBC-117.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - html
     - astro
 message: >-

package/rules/VBC-150.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - sh
     - c

package/rules/VBC-215.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Assignment to a window property at line {line}. Globals collide across scripts and outlive

package/rules/VBC-338.yaml

@@ -16,6 +16,7 @@ match:
     - txt
     - js
     - ts
+    - tsx
     - py
     - astro
 message: >-

package/rules/VBC-385.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Improper success message grammar at line {line}. Use 'Data saved successfully'.

package/rules/VBC-901.yaml

@@ -5,12 +5,20 @@ category: security
 tags:
   - security
 match:
+  # 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are the ranges RFC 5737
+  # reserves so that documentation has addresses to use. Reporting one is
+  # reporting an example for being an example.
+  #
+  # Nothing starting with 255 is a host: 240.0.0.0/4 is reserved, so a dotted
+  # quad there is a netmask or a broadcast address — `isInNet(host, "172.16.0.0",
+  # "255.240.0.0")` names a mask, not a machine.
   regex: >-
-    \b(?!127\.|0\.0\.0\.0\b)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
+    \b(?!127\.|0\.0\.0\.0\b|255\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
   scan: strings
   file_types:
     - js
     - ts
+    - tsx
     - py
     - go
     - java
@@ -50,3 +58,11 @@ tests:
     - const version = '1.2';
     - const local = '127.0.0.1';
     - const bind = '0.0.0.0';
+    # RFC 5737 reserves these so documentation has addresses to use.
+    - const doc = '203.0.113.0';
+    - const example = "192.0.2.10";
+    - const other = '198.51.100.7';
+    # A mask is not a machine. (The full call `isInNet(host, "172.16.0.0",
+    # "255.240.0.0")` still reports — on the 172.16.0.0, which is an address.)
+    - const netmask = "255.240.0.0";
+    - const mask = '255.255.255.0';

package/rules/VBC-902.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   document.write() is prohibited at line {line}. It is insecure and performance-heavy.

package/rules/VBC-903.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: Passing strings to timers is eval-like and insecure at line {line}.
 tests:

package/rules/VBC-904.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Magic string literal passed to function at line {line}. Use a named constant instead.

package/rules/VBC-905.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: Debug console method '{line}' left in code. Remove before committing.
 tests:

package/rules/VBC-906.yaml

@@ -13,6 +13,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - sh
     - css

package/rules/VBC-907.yaml

@@ -14,6 +14,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - sh
     - go

package/rules/VBC-910.yaml

@@ -9,6 +9,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   console.table() left in code at line {line}. Useful for debug, but clutters production logs.

package/rules/VBC-911.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
 message: >-

package/rules/VBC-917.yaml

@@ -18,6 +18,7 @@ match:
     - rs
     - js
     - ts
+    - tsx
     - astro
 opt_in: true
 message: >-

package/rules/VBC-938.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
 message: >-

package/rules/VBC-939.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   File upload handler at line {line} may lack type/size restrictions. Without validating MIME

package/rules/VBC-940.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - astro
 supersedes:

package/rules/VBC-942.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Route handler at line {line} may be missing authentication middleware. AI-generated route

package/rules/VBC-943.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Catch clause with ignored error variable at line {line}. Using '_' as the catch binding

package/rules/VBC-945.yaml

@@ -15,6 +15,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - py
     - go
     - java

package/rules/VBC-946.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Destructive async operation at line {line} with no verification of success. AI agents frequently

package/rules/VBC-947.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - tsx
     - astro
 message: >-
   Merging untrusted request body directly at line {line}. This pattern enables prototype pollution: