@shopify/shop-minis-react 0.4.6 → 0.4.7

package/eslint/config.cjs

@@ -39,7 +39,12 @@ module.exports = {
     // Shop Minis custom rules
     'shop-minis/no-env-without-fallback': 'error',
     'shop-minis/no-internal-imports': 'error',
-    'shop-minis/no-secrets': 'error',
+    'shop-minis/no-secrets': [
+      'error',
+      {
+        ignoreContent: ['^data:', '^gid://'],
+      },
+    ],
     'shop-minis/prefer-sdk-components': 'warn',
     'shop-minis/prefer-sdk-hooks': 'warn',
     'shop-minis/validate-manifest': 'error',

package/eslint/rules/no-secrets.cjs

@@ -1,7 +1,7 @@
 /* eslint-disable import/extensions */
 /**
  * ESLint rule wrapper for eslint-plugin-no-secrets with custom messages
- * @fileoverview Customized messages for detecting hardcoded secrets in Shop Minis
+ * and URL-aware delimiter handling
  */
 
 const noSecretsPlugin = require('eslint-plugin-no-secrets')
@@ -9,6 +9,21 @@ const noSecretsPlugin = require('eslint-plugin-no-secrets')
 // Get the original rule
 const originalRule = noSecretsPlugin.rules['no-secrets']
 
+/**
+ * Create a context-like object that overrides options while delegating
+ * all other property access to the original context
+ */
+function createContextWithOptions(context, newOptions) {
+  const wrapper = Object.create(context)
+  Object.defineProperty(wrapper, 'options', {
+    value: newOptions,
+    writable: false,
+    enumerable: true,
+    configurable: true,
+  })
+  return wrapper
+}
+
 module.exports = {
   meta: {
     ...originalRule.meta,
@@ -19,9 +34,36 @@ module.exports = {
         'Potential {{ name }} detected. Hardcoded credentials should never be committed. Please check the Shop Minis documentation learn how to handle these cases. You can disable this rule if it is not a credential.',
     },
   },
+
   create(context) {
-    // Create the original rule's visitor
-    const originalVisitor = originalRule.create(context)
-    return originalVisitor
+    const baseOptions = context.options[0] || {}
+
+    // Visitor for NON-URLs: no extra delimiters, skip URLs
+    const nonUrlContext = createContextWithOptions(context, [
+      {
+        ...baseOptions,
+        ignoreContent: [...(baseOptions.ignoreContent || []), '^https?://'],
+      },
+    ])
+    const nonUrlVisitor = originalRule.create(nonUrlContext)
+
+    // Visitor for URLs ONLY: with URL delimiters to reduce false positives
+    const urlContext = createContextWithOptions(context, [
+      {
+        ...baseOptions,
+        ignoreContent: [...(baseOptions.ignoreContent || []), '^(?!https?://)'],
+        additionalDelimiters: ['/', '\\?', '=', '&', '\\+'],
+      },
+    ])
+    const urlVisitor = originalRule.create(urlContext)
+
+    // Only process Literal nodes - skip TemplateElement to avoid false positives
+    // on template expressions like `${variable}` which get split incorrectly
+    return {
+      Literal(node) {
+        nonUrlVisitor.Literal?.(node)
+        urlVisitor.Literal?.(node)
+      },
+    }
   },
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shopify/shop-minis-react",
   "license": "SEE LICENSE IN LICENSE.txt",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "sideEffects": false,
   "type": "module",
   "engines": {