es-check 9.5.2 → 9.5.4

package/lib/browserslist.js

@@ -56,7 +56,7 @@ function getESVersionFromBrowserslist(options = {}) {
 
   try {
     const browsers = browserslist(browserslistQuery ?? null, {
-      path: browserslistPath,
+      config: browserslistPath,
       env: browserslistEnv,
     });
 
@@ -88,20 +88,23 @@ function getESVersionFromBrowserslist(options = {}) {
       return 5;
     }
 
-    if (browserslistPath && browserslistPath.includes("mixed")) {
+    const knownBrowsers = browsers.filter((browser) => {
+      const [browserName] = browser.split(" ");
+      return BROWSER_TO_ES_VERSION[browserName];
+    });
+
+    if (knownBrowsers.length === 0) {
       return 5;
     }
 
-    const esVersions = browsers.map((browser) => {
+    const esVersions = knownBrowsers.map((browser) => {
       const [browserName, version] = browser.split(" ");
       return getESVersionForBrowser(browserName, version);
     });
 
-    const maxESVersion = esVersions.reduce((max, version) => {
-      return version > max ? version : max;
-    }, 5);
+    const minESVersion = Math.min(...esVersions);
 
-    return maxESVersion;
+    return minESVersion;
   } catch {
     return 5;
   }

package/lib/check-runner/index.js

@@ -24,7 +24,7 @@ function determineLogLevel(logger) {
   };
 }
 
-async function processConfig(config, context) {
+function processConfig(config, context) {
   const { logger, isDebug, isWarn, isNodeAPI, allErrors } = context;
 
   const ignoreFilePath = config.ignoreFile || config["ignore-file"];
@@ -80,7 +80,11 @@ async function processConfig(config, context) {
   }
 
   const { ecmaVersion } = versionResult;
-  const acornOpts = { ecmaVersion: parseInt(ecmaVersion, 10), silent: true };
+  const useLatestForParsing = config.checkFeatures;
+  const parserEcmaVersion = useLatestForParsing
+    ? 2025
+    : parseInt(ecmaVersion, 10);
+  const acornOpts = { ecmaVersion: parserEcmaVersion, silent: true };
 
   if (isDebug) {
     logger.debug(`ES-Check: Going to check files using version ${ecmaVersion}`);
@@ -134,23 +138,13 @@ async function processConfig(config, context) {
     ecmaVersion,
   });
 
-  const results = await processBatchedFiles(
-    filteredFiles,
-    processFile,
-    batchSize,
-  );
+  const results = processBatchedFiles(filteredFiles, processFile, batchSize);
   const errors = results.filter((result) => result !== null);
 
-  return await processConfigResult(
-    errors,
-    logger,
-    isNodeAPI,
-    allErrors,
-    ecmaVersion,
-  );
+  return processConfigResult(errors, logger, isNodeAPI, allErrors, ecmaVersion);
 }
 
-async function runChecks(configs, loggerOrOptions) {
+function runChecks(configs, loggerOrOptions) {
   const { isNodeAPI, logger } = determineInvocationType(loggerOrOptions);
 
   const logLevels = determineLogLevel(logger);
@@ -162,7 +156,7 @@ async function runChecks(configs, loggerOrOptions) {
 
   const results = [];
   for (const config of configs) {
-    const result = await processConfig(config, context);
+    const result = processConfig(config, context);
     results.push(result);
 
     const shouldBreak = result.hasErrors && !result.shouldContinue;

package/lib/check-runner/utils.js

@@ -6,7 +6,7 @@ const {
   polyfillDetector: polyfillDetectorModule,
   parseIgnoreList,
   processBatchedFiles,
-  readFileAsync,
+  readFile,
   parseCode,
 } = require("../helpers");
 const {
@@ -108,12 +108,14 @@ function findFiles(patterns, options) {
     return { files: [], hasError: true };
   }
 
+  let hasPatternWithNoFiles = false;
   const allMatchedFiles = patterns.flatMap((pattern) => {
     const globbedFiles = glob.sync(pattern, globOpts);
     const noFilesFound = globbedFiles.length === 0;
     const shouldErrorOnNoFiles = noFilesFound && !looseGlobMatching;
 
     if (shouldErrorOnNoFiles) {
+      hasPatternWithNoFiles = true;
       handleMissingFiles(pattern, options);
     }
 
@@ -149,13 +151,7 @@ function findFiles(patterns, options) {
     );
   }
 
-  const hasError = patterns.some((pattern) => {
-    const globbedFiles = glob.sync(pattern, globOpts);
-    const noFilesFound = globbedFiles.length === 0;
-    return noFilesFound && !looseGlobMatching;
-  });
-
-  return { files: allMatchedFiles, hasError };
+  return { files: allMatchedFiles, hasError: hasPatternWithNoFiles };
 }
 
 function handleBrowserslistError(browserslistError, options) {
@@ -323,13 +319,26 @@ function processFullAST(
   const parseSourceType = acornOpts.sourceType || "script";
   const esVersion = parseInt(ecmaVersion, 10);
 
-  const { foundFeatures, unsupportedFeatures } = detectFeatures(
-    code,
-    esVersion,
-    parseSourceType,
-    ignoreList,
-    { ast, checkForPolyfills: config.checkForPolyfills },
-  );
+  let foundFeatures;
+  let unsupportedFeatures;
+
+  try {
+    const result = detectFeatures(
+      code,
+      esVersion,
+      parseSourceType,
+      ignoreList,
+      { ast, checkForPolyfills: config.checkForPolyfills },
+    );
+    foundFeatures = result.foundFeatures;
+    unsupportedFeatures = result.unsupportedFeatures;
+  } catch (err) {
+    const isESCheckFeatureError = err.type === "ES-Check" && err.features;
+    if (isESCheckFeatureError) {
+      return { err, file, stack: err.stack };
+    }
+    throw err;
+  }
 
   if (isDebug) {
     const stringifiedFeatures = JSON.stringify(foundFeatures, null, 2);
@@ -388,13 +397,9 @@ function processFullAST(
 function createFileProcessor(config, options) {
   const { acornOpts, ignoreList, logger, isDebug, ecmaVersion } = options;
 
-  return async (file) => {
+  return (file) => {
     const useCache = config.cache !== false;
-    const { content: code, error: readError } = await readFileAsync(
-      file,
-      fs,
-      useCache,
-    );
+    const { content: code, error: readError } = readFile(file, fs, useCache);
 
     const hasReadError = readError !== null;
     if (hasReadError) return readError;
@@ -416,7 +421,7 @@ function createFileProcessor(config, options) {
   };
 }
 
-async function logErrors(errors, logger) {
+function logErrors(errors, logger) {
   const hasLogger = logger !== null && logger !== undefined;
   if (!hasLogger) return;
 
@@ -429,7 +434,7 @@ async function logErrors(errors, logger) {
   for (const error of errors) {
     const hasLocation = error.line !== null && error.line !== undefined;
     const mapped = hasLocation
-      ? await mapErrorPosition(error.file, error.line, error.column)
+      ? mapErrorPosition(error.file, error.line, error.column)
       : { file: error.file, line: error.line, column: error.column };
 
     const locationInfo = hasLocation
@@ -448,7 +453,7 @@ async function logErrors(errors, logger) {
   }
 }
 
-async function processConfigResult(
+function processConfigResult(
   errors,
   logger,
   isNodeAPI,
@@ -458,7 +463,7 @@ async function processConfigResult(
   const hasFileErrors = errors.length > 0;
 
   if (hasFileErrors) {
-    await logErrors(errors, logger);
+    logErrors(errors, logger);
     allErrors.push(...errors);
 
     const isExiting = !isNodeAPI;

package/lib/constants/versions.js

@@ -99,8 +99,8 @@ const BROWSER_TO_ES_VERSION = {
   chrome: {
     51: 6,
     55: 7,
-    60: 8,
-    70: 9,
+    58: 8,
+    60: 9,
     75: 10,
     80: 11,
     85: 12,

package/lib/helpers/ast.js

@@ -1,3 +1,18 @@
+function hasOptionsCause(node) {
+  const args = node.arguments;
+  if (!args || args.length < 2) return false;
+
+  const optionsArg = args[1];
+  if (optionsArg?.type !== "ObjectExpression") return false;
+
+  return optionsArg.properties?.some(
+    (prop) =>
+      prop.type === "Property" &&
+      prop.key?.type === "Identifier" &&
+      prop.key?.name === "cause",
+  );
+}
+
 function checkMap(node, astInfo) {
   const hasKindMismatch = astInfo.kind && node.kind !== astInfo.kind;
   const hasOperatorMismatch =
@@ -15,15 +30,28 @@ function checkMap(node, astInfo) {
     node.callee?.object?.name,
   );
 
+  const needsObjectAndProperty = astInfo.object && astInfo.property;
+  const hasObjectAndPropertyMismatch =
+    needsObjectAndProperty && !(hasCalleeObject && hasPropertyMatch);
+
   const hasObjectPropertyMismatch =
-    astInfo.object && hasCalleeObject && hasPropertyMismatch;
+    !needsObjectAndProperty &&
+    astInfo.object &&
+    hasCalleeObject &&
+    hasPropertyMismatch;
   const hasObjectButNoMatch =
-    astInfo.object && !hasCalleeObject && !hasCalleeIdentifier;
+    !needsObjectAndProperty &&
+    astInfo.object &&
+    !hasCalleeObject &&
+    !hasCalleeIdentifier;
   const hasPropertyWithoutMatch =
     astInfo.property && !astInfo.object && !hasPropertyMatch;
   const hasPropertyWithExclusion =
     astInfo.property && !astInfo.object && hasPropertyMatch && shouldExclude;
 
+  const hasOptionsCauseMismatch =
+    astInfo.hasOptionsCause && !hasOptionsCause(node);
+
   const hasMismatch =
     hasKindMismatch ||
     hasOperatorMismatch ||
@@ -31,7 +59,9 @@ function checkMap(node, astInfo) {
     hasObjectPropertyMismatch ||
     hasObjectButNoMatch ||
     hasPropertyWithoutMatch ||
-    hasPropertyWithExclusion;
+    hasPropertyWithExclusion ||
+    hasObjectAndPropertyMismatch ||
+    hasOptionsCauseMismatch;
 
   if (hasMismatch) return false;
 

package/lib/helpers/astDetector.js

@@ -1,6 +1,13 @@
 const { ES_FEATURES } = require("../constants");
 const { checkMap } = require("./ast");
 
+const FUNCTION_TYPES = new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression",
+  "MethodDefinition",
+]);
+
 const CHILD_KEYS = [
   "body",
   "declarations",
@@ -64,7 +71,7 @@ function buildFeatureIndex(features) {
 
 const featuresByNodeType = buildFeatureIndex(ES_FEATURES);
 
-function matchesFeature(node, astInfo) {
+function matchesFeature(node, astInfo, context = {}) {
   if (astInfo.childType) {
     return node.elements?.some((el) => el?.type === astInfo.childType) || false;
   }
@@ -93,6 +100,14 @@ function matchesFeature(node, astInfo) {
     return node.superClass !== null;
   }
 
+  if (astInfo.topLevel && node.type === "AwaitExpression") {
+    return context.isTopLevel === true;
+  }
+
+  if (astInfo.leftIsPrivate && node.type === "BinaryExpression") {
+    return node.left?.type === "PrivateIdentifier";
+  }
+
   if (node.type === "CallExpression" || node.type === "NewExpression") {
     return checkMap(node, astInfo);
   }
@@ -107,17 +122,21 @@ function detectFeaturesFromAST(ast) {
   }
 
   const remaining = new Set(Object.keys(ES_FEATURES));
-  const stack = [ast];
+  const stack = [{ node: ast, functionDepth: 0 }];
 
   while (stack.length > 0 && remaining.size > 0) {
-    const node = stack.pop();
+    const { node, functionDepth } = stack.pop();
     if (!node || typeof node !== "object") continue;
 
+    const isFunction = FUNCTION_TYPES.has(node.type);
+    const newFunctionDepth = isFunction ? functionDepth + 1 : functionDepth;
+
     const candidates = featuresByNodeType[node.type];
     if (candidates) {
+      const context = { isTopLevel: functionDepth === 0 };
       for (const { name, astInfo } of candidates) {
         if (!remaining.has(name)) continue;
-        if (matchesFeature(node, astInfo)) {
+        if (matchesFeature(node, astInfo, context)) {
           foundFeatures[name] = true;
           remaining.delete(name);
         }
@@ -129,10 +148,11 @@ function detectFeaturesFromAST(ast) {
       if (!child) continue;
       if (Array.isArray(child)) {
         for (let i = child.length - 1; i >= 0; i--) {
-          if (child[i]) stack.push(child[i]);
+          if (child[i])
+            stack.push({ node: child[i], functionDepth: newFunctionDepth });
         }
       } else if (child.type) {
-        stack.push(child);
+        stack.push({ node: child, functionDepth: newFunctionDepth });
       }
     }
   }

package/lib/helpers/files.js

@@ -2,26 +2,25 @@ const fileCache = new Map();
 let cacheHits = 0;
 let cacheMisses = 0;
 
-async function processBatchedFiles(files, processor, batchSize = 0) {
+function processBatchedFiles(files, processor, batchSize = 0) {
   if (batchSize <= 0) {
-    return await Promise.all(files.map(processor));
+    return files.map(processor);
   }
 
   const results = [];
   for (let i = 0; i < files.length; i += batchSize) {
     const batch = files.slice(i, i + batchSize);
-    const batchResults = await Promise.all(batch.map(processor));
+    const batchResults = batch.map(processor);
     results.push(...batchResults);
   }
 
   return results;
 }
 
-async function readFileAsync(file, fs, useCache = false) {
+function readFile(file, fs, useCache = false) {
   if (useCache && fileCache.has(file)) {
     cacheHits++;
-    const cached = fileCache.get(file);
-    return cached;
+    return fileCache.get(file);
   }
 
   if (useCache) {
@@ -29,7 +28,7 @@ async function readFileAsync(file, fs, useCache = false) {
   }
 
   try {
-    const content = await fs.promises.readFile(file, "utf8");
+    const content = fs.readFileSync(file, "utf8");
     const result = { content, error: null };
 
     if (useCache) {
@@ -75,7 +74,7 @@ function getFileCacheStats() {
 
 module.exports = {
   processBatchedFiles,
-  readFileAsync,
+  readFile,
   clearFileCache,
   getFileCacheStats,
 };

package/lib/helpers/sourcemap.js

@@ -239,28 +239,27 @@ class SourceMapConsumer {
   }
 }
 
-async function loadSourceMap(file) {
+function loadSourceMap(file) {
   const mapFile = `${file}.map`;
 
   try {
     const mapExists = fs.existsSync(mapFile);
     if (!mapExists) return null;
 
-    const mapContent = await fs.promises.readFile(mapFile, "utf8");
+    const mapContent = fs.readFileSync(mapFile, "utf8");
     const sourceMapData = JSON.parse(mapContent);
 
     const isValidVersion = sourceMapData.version === 3;
     if (!isValidVersion) return null;
 
-    const consumer = new SourceMapConsumer(sourceMapData);
-    return consumer;
+    return new SourceMapConsumer(sourceMapData);
   } catch {
     return null;
   }
 }
 
-async function mapErrorPosition(file, line, column) {
-  const consumer = await loadSourceMap(file);
+function mapErrorPosition(file, line, column) {
+  const consumer = loadSourceMap(file);
   const hasNoConsumer = !consumer;
 
   if (hasNoConsumer) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "es-check",
-  "version": "9.5.2",
+  "version": "9.5.4",
   "description": "Checks the ECMAScript version of .js glob against a specified version of ECMAScript with a shell command",
   "main": "lib/index.js",
   "license": "MIT",
@@ -52,11 +52,11 @@
   "homepage": "https://github.com/yowainwright/es-check#readme",
   "website": "https://jeffry.in/es-check",
   "devDependencies": {
-    "codependence": "^0.3.1",
+    "codependence": "1.0.0-1",
     "oxlint": "^1.29.0",
-    "pastoralist": "1.8.2",
-    "prettier": "3.6.2",
-    "release-it": "19.0.6"
+    "pastoralist": "1.10.0-1",
+    "prettier": "3.7.4",
+    "release-it": "19.2.3"
   },
   "dependencies": {
     "acorn": "8.15.0",
@@ -109,22 +109,16 @@
       "after:release": "echo Successfully released ${name} v${version} to ${repo.repository}."
     }
   },
-  "packageManager": "pnpm@10.12.1",
+  "packageManager": "pnpm@10.27.0",
   "pastoralist": {
     "appendix": {
       "vite@6.4.1": {
         "dependents": {
-          "es-check": "vite (transitive dependency)"
+          "es-check": "vite (transitive dependency)",
+          "es-check-docs": "vite@^7.3.0"
         },
         "ledger": {
-          "addedDate": "2025-11-21T20:27:19.148Z",
-          "reason": "Security fix: vite allows server.fs.deny bypass via backslash on Windows (medium)",
-          "securityChecked": true,
-          "securityCheckDate": "2025-11-21T20:27:19.148Z",
-          "securityProvider": "github",
-          "cve": "CVE-2025-62522",
-          "severity": "medium",
-          "url": "https://github.com/yowainwright/es-check/security/dependabot/39"
+          "addedDate": "2026-01-12T05:15:47.989Z"
         }
       },
       "tmp@0.2.4": {
@@ -132,38 +126,38 @@
           "es-check": "tmp (transitive dependency)"
         },
         "ledger": {
-          "addedDate": "2025-11-21T20:27:19.148Z"
+          "addedDate": "2026-01-12T05:15:47.989Z"
         }
       },
-      "astro@5.15.9": {
+      "js-yaml@4.1.1": {
         "dependents": {
-          "es-check": "astro (transitive dependency)",
-          "es-check-docs": "astro@^5.15.9"
+          "es-check": "js-yaml (transitive dependency)"
         },
         "ledger": {
-          "addedDate": "2025-11-21T20:27:19.148Z",
-          "reason": "Security fix: Astro Cloudflare adapter has Stored Cross Site Scripting vulnerability in /_image endpoint (medium)",
-          "securityChecked": true,
-          "securityCheckDate": "2025-11-21T20:27:19.148Z",
-          "securityProvider": "github",
-          "cve": "CVE-2025-65019",
-          "severity": "medium",
-          "url": "https://github.com/yowainwright/es-check/security/dependabot/51"
+          "addedDate": "2026-01-12T05:15:47.989Z"
         }
       },
-      "js-yaml@4.1.1": {
+      "mdast-util-to-hast@13.2.1": {
         "dependents": {
-          "es-check": "js-yaml (transitive dependency)"
+          "es-check": "mdast-util-to-hast (transitive dependency)"
+        },
+        "ledger": {
+          "addedDate": "2026-01-12T05:15:47.989Z"
+        }
+      },
+      "undici@6.23.0": {
+        "dependents": {
+          "es-check": "undici (transitive dependency)"
         },
         "ledger": {
-          "addedDate": "2025-11-21T20:27:19.148Z",
-          "reason": "Security fix: js-yaml has prototype pollution in merge (<<) (medium)",
+          "addedDate": "2026-01-17T00:15:11.438Z",
+          "reason": "Security fix: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion (low)",
           "securityChecked": true,
-          "securityCheckDate": "2025-11-21T20:27:19.148Z",
+          "securityCheckDate": "2026-01-17T00:15:11.438Z",
           "securityProvider": "github",
-          "cve": "CVE-2025-64718",
-          "severity": "medium",
-          "url": "https://github.com/yowainwright/es-check/security/dependabot/46"
+          "cve": "CVE-2026-22036",
+          "severity": "low",
+          "url": "https://github.com/yowainwright/es-check/security/dependabot/57"
         }
       }
     },
@@ -184,8 +178,9 @@
     "overrides": {
       "vite": "6.4.1",
       "tmp": "0.2.4",
-      "astro": "5.15.9",
-      "js-yaml": "4.1.1"
+      "js-yaml": "4.1.1",
+      "mdast-util-to-hast": "13.2.1",
+      "undici": "6.23.0"
     }
   }
 }