@sarj/eslint-plugin 16.39.1 → 16.40.0

package/dist/index.d.cts

@@ -228,6 +228,7 @@ declare const RULES: {
     readonly "no-restated-jsdoc": DocumentedRule<readonly [], "restatesSignature" | "deleteBlock">;
     readonly "no-secret-in-log": DocumentedRule<readonly [LoggingOptions?], "noSecretInLog" | "noRawBodyInLog">;
     readonly "no-server-env-in-client-component": DocumentedRule<readonly [], "noServerEnvInClientComponent">;
+    readonly "no-server-file-uploads": DocumentedRule<readonly [], "serverFile">;
     readonly "no-select-star": DocumentedRule<readonly [], "noSelectStar">;
     readonly "no-sentinel-return-on-catch": DocumentedRule<readonly [LoggingOptions?], "noSentinelReturn">;
     readonly "no-silent-promise-catch": DocumentedRule<readonly [], "silentCatch">;
@@ -358,12 +359,12 @@ declare const RULE_POLICY: {
     }]];
     readonly "no-restricted-imports": readonly ["shared", "both", readonly ["error", {
         readonly paths: {
-            name: "axios" | "request" | "node-fetch" | "cross-fetch" | "isomorphic-fetch" | "moment" | "dayjs" | "lodash" | "lodash-es" | "underscore" | "classnames" | "joi" | "yup" | "superstruct" | "io-ts" | "runtypes" | "jsonwebtoken" | "express" | "koa" | "jest" | "mocha" | "sinon" | "commander" | "yargs" | "bluebird" | "rimraf" | "fs-extra" | "abort-controller" | "querystring" | "dotenv" | "chalk" | "faker" | "node-sass" | "tslint";
-            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint.";
+            name: "axios" | "request" | "node-fetch" | "cross-fetch" | "isomorphic-fetch" | "moment" | "dayjs" | "lodash" | "lodash-es" | "underscore" | "classnames" | "joi" | "yup" | "superstruct" | "io-ts" | "runtypes" | "jsonwebtoken" | "express" | "koa" | "jest" | "mocha" | "sinon" | "commander" | "yargs" | "bluebird" | "rimraf" | "fs-extra" | "abort-controller" | "querystring" | "dotenv" | "chalk" | "faker" | "node-sass" | "tslint" | "multer" | "formidable" | "busboy" | "@fastify/multipart" | "express-fileupload" | "multiparty";
+            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint." | "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
         }[];
         readonly patterns: {
             group: string[];
-            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint.";
+            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint." | "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
         }[];
     }]];
     readonly "@sarj/no-restricted-library-load": readonly ["error", "both", () => readonly [{
@@ -537,6 +538,36 @@ declare const RULE_POLICY: {
             readonly module: "tslint";
             readonly note: "TSLint is deprecated; use ESLint with typescript-eslint.";
             readonly replacement: "eslint";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "multer";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "formidable";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "busboy";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "@fastify/multipart";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "express-fileupload";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "multiparty";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
         }];
     }]];
     readonly "@sarj/no-redundant-local-alias": readonly ["warn", "both", "strict-order", 5];
@@ -600,6 +631,7 @@ declare const RULE_POLICY: {
     readonly "@sarj/no-restated-jsdoc": readonly ["warn", "both"];
     readonly "@sarj/no-secret-in-log": readonly ["error", "both"];
     readonly "@sarj/no-server-env-in-client-component": readonly ["error", "both"];
+    readonly "@sarj/no-server-file-uploads": readonly ["warn", "both"];
     readonly "@sarj/no-select-star": readonly ["error", "both"];
     readonly "@sarj/no-sentinel-return-on-catch": readonly ["error", "both"];
     readonly "@sarj/no-silent-promise-catch": readonly ["error", "both"];

package/dist/index.d.ts

@@ -228,6 +228,7 @@ declare const RULES: {
     readonly "no-restated-jsdoc": DocumentedRule<readonly [], "restatesSignature" | "deleteBlock">;
     readonly "no-secret-in-log": DocumentedRule<readonly [LoggingOptions?], "noSecretInLog" | "noRawBodyInLog">;
     readonly "no-server-env-in-client-component": DocumentedRule<readonly [], "noServerEnvInClientComponent">;
+    readonly "no-server-file-uploads": DocumentedRule<readonly [], "serverFile">;
     readonly "no-select-star": DocumentedRule<readonly [], "noSelectStar">;
     readonly "no-sentinel-return-on-catch": DocumentedRule<readonly [LoggingOptions?], "noSentinelReturn">;
     readonly "no-silent-promise-catch": DocumentedRule<readonly [], "silentCatch">;
@@ -358,12 +359,12 @@ declare const RULE_POLICY: {
     }]];
     readonly "no-restricted-imports": readonly ["shared", "both", readonly ["error", {
         readonly paths: {
-            name: "axios" | "request" | "node-fetch" | "cross-fetch" | "isomorphic-fetch" | "moment" | "dayjs" | "lodash" | "lodash-es" | "underscore" | "classnames" | "joi" | "yup" | "superstruct" | "io-ts" | "runtypes" | "jsonwebtoken" | "express" | "koa" | "jest" | "mocha" | "sinon" | "commander" | "yargs" | "bluebird" | "rimraf" | "fs-extra" | "abort-controller" | "querystring" | "dotenv" | "chalk" | "faker" | "node-sass" | "tslint";
-            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint.";
+            name: "axios" | "request" | "node-fetch" | "cross-fetch" | "isomorphic-fetch" | "moment" | "dayjs" | "lodash" | "lodash-es" | "underscore" | "classnames" | "joi" | "yup" | "superstruct" | "io-ts" | "runtypes" | "jsonwebtoken" | "express" | "koa" | "jest" | "mocha" | "sinon" | "commander" | "yargs" | "bluebird" | "rimraf" | "fs-extra" | "abort-controller" | "querystring" | "dotenv" | "chalk" | "faker" | "node-sass" | "tslint" | "multer" | "formidable" | "busboy" | "@fastify/multipart" | "express-fileupload" | "multiparty";
+            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint." | "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
         }[];
         readonly patterns: {
             group: string[];
-            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint.";
+            message: "Use the platform-native fetch API; review errors, timeouts, retries, and response parsing during migration." | "Standards standardizes date utilities on date-fns; migration is not API-compatible." | "Standards standardizes collection utilities on Remeda and native APIs." | "Use clsx for conditional class-name composition." | "Standards standardizes runtime validation on Zod; schemas are not drop-in compatible." | "Use jose; review key formats and async signing and verification APIs." | "Standards standardizes servers on Hono; Node deployments also need @hono/node-server." | "Standards standardizes tests on Vitest; review globals, timers, mocks, and environment setup." | "Use Vitest spies, mocks, and fake timers instead of Sinon." | "Standards standardizes command-line interfaces on citty." | "Use native Promise, adding p-limit or p-map only for the extensions actually needed." | "Prefer node:fs/promises; verify recursive removal, copy, path, and error semantics." | "Node 22 provides global AbortController." | "Use URLSearchParams and explicitly review repeated keys, escaping, arrays, and object coercion." | "Standards standardizes environment loading on @dotenvx/dotenvx." | "Use picocolors for terminal colors." | "The original faker package is abandoned; use @faker-js/faker." | "node-sass is end-of-life; use Dart Sass." | "TSLint is deprecated; use ESLint with typescript-eslint." | "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
         }[];
     }]];
     readonly "@sarj/no-restricted-library-load": readonly ["error", "both", () => readonly [{
@@ -537,6 +538,36 @@ declare const RULE_POLICY: {
             readonly module: "tslint";
             readonly note: "TSLint is deprecated; use ESLint with typescript-eslint.";
             readonly replacement: "eslint";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "multer";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "formidable";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "busboy";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "@fastify/multipart";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "express-fileupload";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
+        }, {
+            readonly id: "LIB120";
+            readonly module: "multiparty";
+            readonly note: "Keep upload bytes off application servers; issue a short-lived signed URL and accept object metadata.";
+            readonly replacement: "direct object-storage uploads with signed URLs";
         }];
     }]];
     readonly "@sarj/no-redundant-local-alias": readonly ["warn", "both", "strict-order", 5];
@@ -600,6 +631,7 @@ declare const RULE_POLICY: {
     readonly "@sarj/no-restated-jsdoc": readonly ["warn", "both"];
     readonly "@sarj/no-secret-in-log": readonly ["error", "both"];
     readonly "@sarj/no-server-env-in-client-component": readonly ["error", "both"];
+    readonly "@sarj/no-server-file-uploads": readonly ["warn", "both"];
     readonly "@sarj/no-select-star": readonly ["error", "both"];
     readonly "@sarj/no-sentinel-return-on-catch": readonly ["error", "both"];
     readonly "@sarj/no-silent-promise-catch": readonly ["error", "both"];