@lvce-editor/eslint-plugin-nvmrc 18.14.2 → 18.16.0

package/dist/index.js

@@ -46,6 +46,7 @@ const parser = {
 const defaultMinimumVersion = '20.0.0';
 const defaultMaximumVersion = '24.15.0';
 const defaultBadVersions = ['24.16.0'];
+const insecureVersionRanges = ['<22.23.4', '>=23 <24', '>=24 <24.22.1', '>=25 <26', '>=26 <26.12.1'];
 const versionPattern = String.raw`^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$`;
 const parseVersion = value => {
   const version = semver.parse(value.trim());
@@ -158,10 +159,47 @@ const create = context => {
     }
   };
 };
+const insecureVersionRule = {
+  create(context) {
+    const {
+      parserServices
+    } = context.sourceCode;
+    if (!parserServices?.isNvmrc) {
+      return {};
+    }
+    return {
+      Program(node) {
+        const value = context.sourceCode.text.trim();
+        const version = parseVersion(value);
+        if (!version || insecureVersionRanges.every(range => !semver.satisfies(version, range))) {
+          return;
+        }
+        context.report({
+          data: {
+            value: version.version
+          },
+          messageId: 'insecureVersion',
+          node
+        });
+      }
+    };
+  },
+  meta: {
+    docs: {
+      description: 'Disallow Node.js versions vulnerable to the Brotli decoder security issue'
+    },
+    messages: {
+      insecureVersion: '.nvmrc version {{value}} is affected by CVE-2026-111497; use a fixed Node.js release (22.23.4, 24.22.1, or 26.12.1) or newer'
+    },
+    schema: [],
+    type: 'problem'
+  }
+};
 
 const validVersion = {
   __proto__: null,
   create,
+  insecureVersionRule,
   meta
 };
 
@@ -172,6 +210,7 @@ const plugin = {
     version: '0.0.1'
   },
   rules: {
+    'insecure-version': insecureVersionRule,
     'valid-version': validVersion
   }
 };
@@ -184,6 +223,7 @@ const recommended = [{
     nvmrc: plugin
   },
   rules: {
+    'nvmrc/insecure-version': 'error',
     'nvmrc/valid-version': 'error'
   }
 }];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/eslint-plugin-nvmrc",
-  "version": "18.14.2",
+  "version": "18.16.0",
   "main": "dist/index.js",
   "repository": {
     "type": "git",