eslint-plugin-chrome-extensions 1.0.0 → 2.0.0

package/README.md

@@ -7,7 +7,7 @@
 <a href="#license">
     <img alt="[License: MIT]" src="https://img.shields.io/badge/License-MIT-f1f20a.svg?logo=internetarchive&logoColor=white&labelColor=464646&style=for-the-badge"></a>
 <a target="_blank" href="https://eslint.org/">
-    <img alt="[Requires ESLint >=9.0.0]" src="https://img.shields.io/badge/Requires-ESLint_%3E%3D9.0.0-4B32C3?style=for-the-badge&logo=eslint"></a>
+    <img alt="[Requires ESLint >=9.6.0]" src="https://img.shields.io/badge/Requires-ESLint_%3E%3D9.6.0-4B32C3?style=for-the-badge&logo=eslint"></a>
 <br><br>
 
 ESLint rules for Chrome extensions.
@@ -31,26 +31,37 @@ npm i -D eslint-plugin-chrome-extensions
     Usage
 </h2>
 
-Add a bundled config to your `eslint.config.*js`:
+Add bundled configs to your `eslint.config.*js`:
 
 ```js
 ...
 import chromeExtensions from 'eslint-plugin-chrome-extensions'
+import json from '@eslint/json'
 
 export default [
     // other configs
     {
-        files: ['**/*.js'], plugins: { 'chrome-extensions': chromeExtensions },
+        files: ['extension/**/*.js'],
+        plugins: { 'chrome-extensions': chromeExtensions },
         rules: {
             ...chromeExtensions.configs.recommended.rules,
-            'chrome-extensions/no-unused-permissions': 'off',  // selectively disable rule
+            'chrome-extensions/no-insecure-messaging': 'off',  // selectively disable rule
             'chrome-extensions/no-deprecated-apis': ['error', { target: 'mv3' }]  // selectively tweak rule
         }
+    },
+    {
+        files: ['extension/manifest.json'], language: 'json/json',
+        plugins: { 'chrome-extensions': chromeExtensions, json },
+        rules: {
+            ...chromeExtensions.configs.manifest.rules,
+            'chrome-extensions/require-mv3': 'off',  // selectively disable rule
+            'chrome-extensions/valid-version-field': ['error', { versionType: 'date' }]  // selectively tweak rule
+        }
     }
 ]
 ```
 
-Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only)
+Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `manifest`
 
 **Note:** Rule config is either a severity string (`'off'`, `'warn'`, `'error'`) or an array `[severity, options]` when the rule accepts options.
 
@@ -61,6 +72,75 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
     Supported rules
 </h2>
 
+<h3 id="manifest-key-order">
+    <code>manifest-key-order</code>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
+        <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
+    <a title="Doesn't prevent bugs" href="#manifest-key-order">
+        <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23manifest-key-order">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Enforces a preferred order for manifest keys.</summary>
+
+#### Options
+
+- `order` (default `[]`) – manifest keys in custom order (e.g. `['name', 'manifest_version']`) to selectively override built-in order with
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  /* eslint chrome-extensions/manifest-key-order: ['error', { order: ['name', 'manifest_version'] }] */
+  
+  {
+    "manifest_version": 3,
+!   "name": "My Extension",
+    "version": "1.0.0"
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  /* eslint chrome-extensions/manifest-key-order: ['error', { order: ['name', 'manifest_version'] }] */
+  
+  {
+-   "manifest_version": 3,
+    "name": "My Extension",
++   "manifest_version": 3,
+    "version": "1.0.0"
+  }
+```
+
+#### When not to use it
+
+If you don't care about the order of manifest keys.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.0.0">v2.0.0</a> (October 4, 2026)
+
+#### See also
+
+- [`require-mv3`](#require-mv3)
+- [`valid-mv3-schema`](#valid-mv3-schema)
+
+<div align="center">
+
+[Back to index ↑][epc-rules]
+
+</div>
+
+---
+
+</details>
+
 <h3 id="no-content-style-leak">
     <code>no-content-style-leak</code>
     <a title="Only included in strict config" href="#usage">
@@ -83,13 +163,16 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
 
 ```diff
++ const host = document.createElement('div'),
++       root = host.attachShadow({ mode: 'open' })
++ document.body.append(host)
 - document.head.append(document.createElement('style'))
-+ await chrome.scripting.insertCSS({ files: ['content.css'] })
++ root.append(document.createElement('style'))
 ```
 
 #### When not to use it
 
-If you already scope every injected style inside a `shadowRoot` you own.
+If you intentionally interact w/ host page styles.
 
 #### Introduced in
 
@@ -97,9 +180,8 @@ If you already scope every injected style inside a `shadowRoot` you own.
 
 #### See also
 
-- [`valid-service-worker`](#valid-service-worker)
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/scripting">Chrome Extensions — `chrome.scripting`</a>
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts">Chrome Extensions — Content scripts</a>
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts">Chrome for Developers — Content scripts</a>
+- <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM">MDN — Using shadow DOM</a>
 
 <div align="center">
 
@@ -138,6 +220,7 @@ If you already scope every injected style inside a `shadowRoot` you own.
   
 ! chrome.pageAction.show(tabId)
 ! chrome.extension.getBackgroundPage().doThing()
+! chrome.tabs.executeScript(tabId, { code: 'doThing()' })
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -149,6 +232,8 @@ If you already scope every injected style inside a `shadowRoot` you own.
 + chrome.action.enable(tabId)
 - chrome.extension.getBackgroundPage().doThing()
 + await chrome.runtime.getContexts({ contextTypes: ['BACKGROUND'] })
+- chrome.tabs.executeScript(tabId, { code: 'doThing()' })
++ chrome.scripting.executeScript({ target: { tabId }, func: doThing })
 ```
 
 #### When not to use it
@@ -161,9 +246,7 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 
 #### See also
 
-- [`no-remote-code`](#no-remote-code)
-- [`valid-mv3-schema`](#valid-mv3-schema)
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api">Chrome Extensions — API reference</a>
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api">Chrome for Developers — API reference</a>
 
 <div align="center">
 
@@ -191,26 +274,27 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
-! chrome.runtime.onMessageExternal.addListener((msg, sender, respond) => {
-!     handle(msg) })
+  chrome.runtime.onMessageExternal.addListener((msg, sender, respond) => {
+!     handle(msg)
+  })
 
-! chrome.tabs.query({}).then(tabs => tabs.forEach(tab =>
-!     chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
+! chrome.tabs.query({})
+      .then(tabs => tabs.forEach(tab =>
+          chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
 
 ```diff
-- chrome.runtime.onMessageExternal.addListener((msg, sender, respond) => {
--     handle(msg) })
-+ chrome.runtime.onMessageExternal.addListener((msg, sender, respond) => {
+  chrome.runtime.onMessageExternal.addListener((msg, sender, respond) => {
 +     if (sender.id != 'allowed-extension-id') return
-+     handle(msg)
-+ })
+      handle(msg)
+  })
 
-- chrome.tabs.query({}).then(tabs => tabs.forEach(tab =>
-+ chrome.tabs.query({ url: 'https://example.com/*' }).then(tabs => tabs.forEach(tab =>
-      chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
+- chrome.tabs.query({})
++ chrome.tabs.query({ url: 'https://allowed-origin.com/*' })
+      .then(tabs => tabs.forEach(tab =>
+          chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
 ```
 
 #### When not to use it
@@ -223,8 +307,8 @@ If you trust every external caller and open tab.
 
 #### See also
 
-- [`no-deprecated-apis`](#no-deprecated-apis)
-- [`no-missing-permissions`](#no-missing-permissions)
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#event-onMessageExternal">Chrome for Developers — `runtime.onMessageExternal`</a>
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/tabs#method-query">Chrome for Developers — `tabs.query()`</a>
 
 <div align="center">
 
@@ -262,8 +346,8 @@ If you trust every external caller and open tab.
   /* eslint chrome-extensions/no-invalid-permissions: ['error', { target: 'mv3' }] */
   
   {
-!     "permissions": ["browserAction", "tabs"],
-!     "optional_permissions": ["history", "pageAction"]
+!   "permissions": ["browserAction", "tabs"],
+!   "optional_permissions": ["history", "pageAction"]
   }
 ```
 
@@ -273,10 +357,10 @@ If you trust every external caller and open tab.
   /* eslint chrome-extensions/no-invalid-permissions: ['error', { target: 'mv3' }] */
   
   {
--     "permissions": ["browserAction", "tabs"],
--     "optional_permissions": ["history", "pageAction"]
-+     "permissions": ["tabs"],
-+     "optional_permissions": ["history"]
+-   "permissions": ["browserAction", "tabs"],
++   "permissions": ["tabs"],
+-   "optional_permissions": ["history", "pageAction"]
++   "optional_permissions": ["history"]
   }
 ```
 
@@ -321,10 +405,10 @@ If you don't want permission validation at all. For custom permissions from a Ch
 ```diff
   // manifest.json
   {
-!     "permissions": []
+!   "permissions": []
   }
 
-  // background.js
+  // service-worker.js
 ! chrome.cookies.get({ url: 'https://example.com', name: 'x' })
 ! chrome.history.search({ text: '' })
 ```
@@ -334,11 +418,11 @@ If you don't want permission validation at all. For custom permissions from a Ch
 ```diff
   // manifest.json
   {
--     "permissions": []
-+     "permissions": ["cookies", "history"]
+-   "permissions": []
++   "permissions": ["cookies", "history"]
   }
 
-  // background.js
+  // service-worker.js
   chrome.cookies.get({ url: 'https://example.com', name: 'x' })
   chrome.history.search({ text: '' })
 ```
@@ -379,7 +463,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 
 <details>
 
-<summary>Disallows remote or dynamically-evaluated code.</summary>
+<summary>Disallows remote or dynamically-evaluated code (blocked by MV3's CSP at runtime).</summary>
 
 #### Options
 
@@ -389,46 +473,32 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
+! await import('https://cdn.example.com/lib.js')
 ! const run = eval('1 + 1')
 ! setTimeout('doThing()', 1000)
-! await import('https://cdn.example.com/lib.js')
-! document.head.append(Object.assign(document.createElement('script'),
-!     { src: 'https://cdn.example.com/remote.js' }))
-
-  const secret = 'abc'
-! chrome.scripting.executeScript({ func: () => alert(secret), target: { tabId } })
+! chrome.scripting.executeScript({ target: { tabId }, func: () => doThing(value) })
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
 
 ```diff
+- await import('https://cdn.example.com/lib.js')
++ await import('./lib.js')
 - const run = eval('1 + 1')
 + const run = 1 + 1
 - setTimeout('doThing()', 1000)
 + setTimeout(doThing, 1000)
-- await import('https://cdn.example.com/lib.js')
-+ await import('./lib.js')
-- document.head.append(Object.assign(document.createElement('script'),
--     { src: 'https://cdn.example.com/remote.js' }))
-+ document.head.append(Object.assign(document.createElement('script'),
-+     { src: chrome.runtime.getURL('inject.js') }))
-
-  const secret = 'abc'
-- chrome.scripting.executeScript({ func: () => alert(secret), target: { tabId } })
-+ chrome.scripting.executeScript({ func: (s) => alert(s), args: [secret], target: { tabId } })
+- chrome.scripting.executeScript({ target: { tabId }, func: () => doThing(value) })
++ chrome.scripting.executeScript({ target: { tabId }, func: doThing, args: [value] })
 ```
 
-#### When not to use it
-
-Never (MV3 CSP blocks remote code at runtime).
-
 #### Introduced in
 
 <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v1.0.0">v1.0.0</a> (October 2, 2026)
 
 #### See also
 
-- [`no-deprecated-apis`](#no-deprecated-apis)
+- [`require-mv3`](#require-mv3)
 - [`valid-mv3-schema`](#valid-mv3-schema)
 
 <div align="center">
@@ -443,7 +513,7 @@ Never (MV3 CSP blocks remote code at runtime).
 
 <h3 id="no-unused-permissions">
     <code>no-unused-permissions</code>
-    <a title="Only included in recommended + strict configs" href="#usage">
+    <a title="Included in recommended + strict configs" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-unused-permissions">
@@ -459,10 +529,10 @@ Never (MV3 CSP blocks remote code at runtime).
 ```diff
   // manifest.json
   {
-!     "permissions": ["tabs", "downloads"]
+!   "permissions": ["tabs", "downloads"]
   }
 
-  // background.js
+  // service-worker.js
   chrome.tabs.create({ url: 'https://example.com' })
 ```
 
@@ -471,11 +541,11 @@ Never (MV3 CSP blocks remote code at runtime).
 ```diff
   // manifest.json
   {
--     "permissions": ["tabs", "downloads"]
-+     "permissions": ["tabs"]
+-   "permissions": ["tabs", "downloads"]
++   "permissions": ["tabs"]
   }
 
-  // background.js
+  // service-worker.js
   chrome.tabs.create({ url: 'https://example.com' })
 ```
 
@@ -518,23 +588,21 @@ If you access the granted API through an alias or computed property rather than
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
-  // manifest.json
   {
-!     "manifest_version": 2,
-      "name": "My Extension",
-      "version": "1.0.0"
+!   "manifest_version": 2,
+    "name": "My Extension",
+    "version": "1.0.0"
   }
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
 
 ```diff
-  // manifest.json
   {
--     "manifest_version": 2,
-+     "manifest_version": 3,
-      "name": "My Extension",
-      "version": "1.0.0"
+-   "manifest_version": 2,
++   "manifest_version": 3,
+    "name": "My Extension",
+    "version": "1.0.0"
   }
 ```
 
@@ -577,11 +645,11 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 
 ```diff
   {
-      "manifest_version": 3,
-!     "browser_action": {},
-!     "page_action": {},
-!     "background": { "scripts": ["bg.js"], "persistent": true },
-!     "content_security_policy": "script-src 'self' 'unsafe-eval'"
+    "manifest_version": 3,
+!   "browser_action": {},
+!   "page_action": {},
+!   "background": { "scripts": ["background.js"], "persistent": true },
+!   "content_security_policy": "script-src 'self' 'unsafe-eval'"
   }
 ```
 
@@ -589,14 +657,14 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 
 ```diff
   {
-      "manifest_version": 3,
--     "browser_action": {},
--     "page_action": {},
--     "background": { "scripts": ["bg.js"], "persistent": true },
--     "content_security_policy": "script-src 'self' 'unsafe-eval'"
-+     "action": {},
-+     "background": { "service_worker": "sw.js" },
-+     "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'self'" }
+    "manifest_version": 3,
+-   "browser_action": {},
+-   "page_action": {},
++   "action": {},
+-   "background": { "scripts": ["background.js"], "persistent": true },
++   "background": { "service_worker": "service-worker.js" },
+-   "content_security_policy": "script-src 'self' 'unsafe-eval'"
++   "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'self'" }
   }
 ```
 
@@ -642,7 +710,7 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 ! (function init() { chrome.runtime.onMessage.addListener(handler) })()
 ! setInterval(() => {}, 5000)
 ! const loc = window.location
-! localStorage.setItem('key', 'val')
+! localStorage.setItem('key', 'value')
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -668,7 +736,7 @@ If your background context isn't a service worker.
 
 #### See also
 
-- [`no-content-style-leak`](#no-content-style-leak)
+- [`require-mv3`](#require-mv3)
 - [`no-remote-code`](#no-remote-code)
 
 <div align="center">
@@ -677,11 +745,81 @@ If your background context isn't a service worker.
 
 </div>
 
+---
+
+</details>
+
+<h3 id="valid-version-field">
+    <code>valid-version-field</code>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-version-field">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Validates the manifest <code>version</code> field.</summary>
+
+#### Options
+
+- `versionType` (default `'chrome'`) – version format to enforce (`'chrome'`, `'semver'`, `'date'`)
+- `allowFutureDate` (default `false`) – allow `version` dates later than the current date
+- `timezone` (default `''`) – <a target="_blank" href="https://data.iana.org/time-zones/tzdb/zone1970.tab">IANA timezone</a> used to determine the current date (when omitted, only year/month are enforced)
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  /* eslint chrome-extensions/valid-version-field: ['error', { versionType: 'date' }] */
+  
+  // manifest.json
+  {
+    "manifest_version": 3,
+!   "version": "2026.1.111",
+    "name": "My Extension"
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  /* eslint chrome-extensions/valid-version-field: ['error', { versionType: 'date' }] */
+  
+  // manifest.json
+  {
+    "manifest_version": 3,
+-   "version": "2026.1.111",
++   "version": "2026.10.3",
+    "name": "My Extension"
+  }
+```
+
+#### When not to use it
+
+If you don't care about version format consistency, or your version is injected at build time.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.0.0">v2.0.0</a> (October 4, 2026)
+
+#### See also
+
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/version">Chrome for Developers — `version`</a>
+
+<div align="center">
+
+[Back to index ↑][epc-rules]
+
+</div>
+
 </details>
 
 ---
 
-## <img height=30 align="top" src="https://api.iconify.design/boxicons/code-alt-filled.svg?color=%232b2b2a"> Shield embed
+## <img width=30 align="top" src="https://api.iconify.design/boxicons/code-alt-filled.svg?color=%232b2b2a"> Shield embed
 
 <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/#readme">
     <img height=32 alt="[Linted by eslint-plugin-chrome-extensions]" src="https://img.shields.io/badge/Linted_by-eslint--plugin--chrome--extensions-black?logo=eslint&logoColor=white&labelColor=464646&style=for-the-badge"></a>
@@ -689,7 +827,7 @@ If your background context isn't a service worker.
 #### HTML
 
 ```html
-<a href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/#readme">
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/#readme">
     <img height=32 alt="[Linted by eslint-plugin-chrome-extensions]" src="https://img.shields.io/badge/Linted_by-eslint--plugin--chrome--extensions-black?logo=eslint&logoColor=white&labelColor=464646&style=for-the-badge"></a>
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "ESLint rules for Chrome extensions",
   "type": "module",
   "engines": {
@@ -58,7 +58,8 @@
     "chromium"
   ],
   "peerDependencies": {
-    "eslint": ">=9.0.0"
+    "eslint": ">=9.6.0",
+    "@eslint/json": ">=0.1.0"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
@@ -66,11 +67,11 @@
     "@eslint/json": "^2.1.0",
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.11.0",
+    "eslint": "^10.12.0",
     "eslint-plugin-constructors": "^1.4.0",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-n": "^18.4.0",
+    "eslint-plugin-n": "^18.4.1",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-no-unsanitized": "^4.1.5",
     "eslint-plugin-promise": "^7.3.0",

package/src/data/manifest.js

@@ -1,13 +1,32 @@
 import globals from 'globals'
 
-export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
-export const forbiddenCSPDirectives = [
+const serviceWorkerGlobals = new Set(Object.keys(globals.serviceworker || {}))
+export const domGlobals = new Set(Object.keys(globals.browser).filter(name => !serviceWorkerGlobals.has(name)))
+
+export const forbiddenCSPdirectives = [
     `'unsafe-eval'`, `'unsafe-inline'`, `'unsafe-hashes'`, `'wasm-unsafe-eval'`, 'http://', 'https://']
 
-export const serviceWorkerKeepaliveMinMS = 30000
+export const manifestKeyOrder = [
+    // platform-required
+    'manifest_version', 'name', 'version',
+    // CWS-required
+    'description', 'icons',
+    // optional (alphabetical, per docs)
+    'action', 'background', 'chrome_settings_overrides', 'chrome_url_overrides',
+    'commands', 'content_scripts', 'content_security_policy',
+    'cross_origin_embedder_policy', 'cross_origin_opener_policy',
+    'declarative_net_request', 'default_locale', 'devtools_page', 'export',
+    'externally_connectable', 'homepage_url', 'host_permissions', 'import',
+    'incognito', 'key', 'mime_types_handler', 'minimum_chrome_version',
+    'oauth2', 'omnibox', 'optional_host_permissions', 'optional_permissions',
+    'options_page', 'options_ui', 'permissions', 'requirements', 'sandbox',
+    'short_name', 'side_panel', 'storage', 'tts_engine', 'update_url',
+    'version_name', 'web_accessible_resources'
+]
 
-const serviceWorkerGlobals = new Set(Object.keys(globals.serviceworker || {}))
-export const domGlobals = new Set(Object.keys(globals.browser).filter(name => !serviceWorkerGlobals.has(name)))
+export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 
 export const remoteCodePatterns = [
     'eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']
+
+export const serviceWorkerKeepaliveMinMS = 30000

package/src/index.js

@@ -1,3 +1,6 @@
+import { bundleRules } from './utils.js'
+
+import manifestKeyOrder from './rules/manifest-key-order.js'
 import noContentStyleLeak from './rules/no-content-style-leak.js'
 import noDeprecatedAPIs from './rules/no-deprecated-apis.js'
 import noInsecureMessaging from './rules/no-insecure-messaging.js'
@@ -8,19 +11,22 @@ import noUnusedPermissions from './rules/no-unused-permissions.js'
 import requireMV3 from './rules/require-mv3.js'
 import validMV3schema from './rules/valid-mv3-schema.js'
 import validServiceWorker from './rules/valid-service-worker.js'
+import validVersionField from './rules/valid-version-field.js'
 
 const plugin = {
     rules: {
-        'require-mv3': requireMV3,
-        'valid-mv3-schema': validMV3schema,
-        'no-deprecated-apis': noDeprecatedAPIs,
-        'no-remote-code': noRemoteCode,
-        'valid-service-worker': validServiceWorker,
+        'manifest-key-order': manifestKeyOrder,
         'no-content-style-leak': noContentStyleLeak,
+        'no-deprecated-apis': noDeprecatedAPIs,
+        'no-insecure-messaging': noInsecureMessaging,
         'no-invalid-permissions': noInvalidPermissions,
         'no-missing-permissions': noMissingPermissions,
+        'no-remote-code': noRemoteCode,
         'no-unused-permissions': noUnusedPermissions,
-        'no-insecure-messaging': noInsecureMessaging
+        'require-mv3': requireMV3,
+        'valid-mv3-schema': validMV3schema,
+        'valid-service-worker': validServiceWorker,
+        'valid-version-field': validVersionField
     }
 }
 
@@ -30,28 +36,19 @@ for (const [ruleId, rule] of Object.entries(plugin.rules))
 plugin.configs = {
     recommended: {
         plugins: { 'chrome-extensions': plugin },
-        rules: {
-            'chrome-extensions/require-mv3': 'error',
-            'chrome-extensions/valid-mv3-schema': 'error',
-            'chrome-extensions/no-deprecated-apis': 'error',
-            'chrome-extensions/no-remote-code': 'error',
-            'chrome-extensions/valid-service-worker': 'error',
-            'chrome-extensions/no-invalid-permissions': 'error',
-            'chrome-extensions/no-missing-permissions': 'error',
-            'chrome-extensions/no-unused-permissions': 'error',
-            'chrome-extensions/no-insecure-messaging': 'error'
-        }
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.recommended, 'chrome-extensions')
     },
     strict: {
         plugins: { 'chrome-extensions': plugin },
-        rules: Object.fromEntries(Object.keys(plugin.rules)
-            .map(ruleId => [`chrome-extensions/${ruleId}`, 'error']))
+        rules: bundleRules(plugin.rules, () => true, 'chrome-extensions')
     },
     problem: {
         plugins: { 'chrome-extensions': plugin },
-        rules: Object.fromEntries(Object.entries(plugin.rules)
-            .filter(([, rule]) => rule.meta.type == 'problem')
-            .map(([ruleId]) => [`chrome-extensions/${ruleId}`, 'error']))
+        rules: bundleRules(plugin.rules, rule => rule.meta.type == 'problem', 'chrome-extensions')
+    },
+    manifest: {
+        plugins: { 'chrome-extensions': plugin },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest, 'chrome-extensions')
     }
 }
 

package/src/rules/manifest-key-order.js

@@ -0,0 +1,75 @@
+import { manifestKeyOrder } from '../data/manifest.js'
+import { getFilename } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
+
+function keyOf(member) {
+    const keyNode = member.name || member.key
+    return keyNode?.value ?? keyNode?.name
+}
+
+function findViolation(members, keys) {
+    const ranks = new Map(keys.map((key, index) => [key, index])),
+          known = members.map(member => {
+              const key = keyOf(member)
+              return { member, key, rank: ranks.get(key) }
+          }).filter(item => item.rank !== undefined)
+    for (let i = 1; i < known.length; i++)
+        // eslint-disable-next-line security/detect-object-injection
+        if (known[i -1].rank > known[i].rank) return [known[i -1], known[i]]
+}
+
+export default {
+    meta: {
+        type: 'layout',
+        docs: {
+            description: 'Enforce an order for manifest keys',
+            category: 'Stylistic Issues',
+            recommended: false,
+            manifest: true
+        },
+        fixable: 'code',
+        schema: [{
+            type: 'object',
+            properties: {
+                order: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'Manifest keys in preferred order; unspecified keys are ignored'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ order: [] }],
+        messages: { wrongOrder: '`{{first}}` should appear before `{{second}}`' }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const custom = context.options[0]?.order ?? [],
+              master = custom.length ? manifestKeyOrder.filter(key => !custom.includes(key))
+                     : manifestKeyOrder
+        return {
+            'Document:exit'(document) {
+                const root = document.body ; if (root?.type != 'Object') return
+                const members = root.members || root.properties || []
+                const violation = findViolation(members, master) ?? (custom.length && findViolation(members, custom))
+                if (!violation) return
+                const [first, second] = violation
+                context.report({
+                    node: second.member, messageId: 'wrongOrder',
+                    data: { first: second.key, second: first.key },
+                    fix(fixer) {
+                        const sourceCode = context.sourceCode,
+                              firstText = sourceCode.text.slice(first.member.range[0], first.member.range[1]),
+                              secondText = sourceCode.text.slice(second.member.range[0], second.member.range[1]),
+                              between = sourceCode.text.slice(first.member.range[1], second.member.range[0])
+                        return fixer.replaceTextRange(
+                            [first.member.range[0], second.member.range[1]],
+                            secondText + between + firstText
+                        )
+                    }
+                })
+            }
+        }
+    }
+}

package/src/rules/no-content-style-leak.js

@@ -10,7 +10,7 @@ export default {
         },
         schema: [],
         messages: {
-            styleLeak: 'Inject styles via `chrome.scripting.insertCSS()` or `content_scripts.css` instead of appending to the host document.'
+            styleLeak: 'Inject styles into a `shadowRoot` instead of the host document.'
         }
     },
 

package/src/rules/no-invalid-permissions.js

@@ -1,5 +1,7 @@
 import { isValidPermission } from '../data/permissions.js'
-import { readManifest } from '../utils.js'
+import { getFilename, readManifest } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
 
 export default {
     meta: {
@@ -7,7 +9,8 @@ export default {
         docs: {
             description: 'Disallow invalid or unsupported manifest permission names',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            manifest: true
         },
         defaultOptions: [{ target: 'mv3', allowedPermissions: [] }],
         schema: [{
@@ -40,9 +43,27 @@ export default {
         const opts = context.options[0] || {},
               target = opts.target || 'mv3',
               allowed = new Set(Array.isArray(opts.allowedPermissions) ? opts.allowedPermissions
-                      : opts.allowedPermissions ? [opts.allowedPermissions] : []),
-              manifest = readManifest(context)
-        if (!manifest) return {}
+                      : opts.allowedPermissions ? [opts.allowedPermissions] : [])
+        function checkPermission(node, permission) {
+            if (typeof permission != 'string') return
+            if (allowed.has(permission) || isValidPermission(permission, target)) return
+            context.report({ node, messageId: 'invalidPermission', data: { permission, target }})
+        }
+        if (re.manifestFilename.test(getFilename(context))) // lint it directly
+            return {
+                '*'(node) {
+                    const keyNode = node.name || node.key ; if (!keyNode) return
+                    const keyName = keyNode.value ?? keyNode.name
+                    if (keyName != 'permissions' && keyName != 'optional_permissions') return
+                    const arrNode = node.value ; if (arrNode?.type != 'Array') return
+                    const elements = arrNode.elements || arrNode.items || []
+                    for (const el of elements) {
+                        const valueNode = el.value || el
+                        checkPermission(valueNode, valueNode?.value)
+                    }
+                }
+            }
+        const manifest = readManifest(context) ; if (!manifest) return {}
         const all = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])]
         return {
             'Program:exit'() {

package/src/rules/no-remote-code.js

@@ -32,11 +32,11 @@ export default {
             additionalProperties: false
         }],
         messages: {
-            eval: '`eval()` is forbidden by the MV3 CSP.',
-            newFunction: '`new Function()` is forbidden by the MV3 CSP.',
-            stringTimer: 'String-argument `{{fn}}` is forbidden by the MV3 CSP - pass a function reference.',
-            dynamicImport: 'Remote dynamic `import()` is forbidden by the MV3 CSP.',
-            remoteScriptSrc: 'Injecting remote `<script src>` is forbidden by the MV3 CSP - use `chrome.runtime.getURL()`.',
+            eval: '`eval()` is forbidden under MV3\'s CSP - refactor to use static code.',
+            newFunction: '`new Function()` is forbidden under MV3\'s CSP - refactor to use a real function.',
+            stringTimer: 'String-argument `{{fn}}` is forbidden under MV3\'s CSP - pass a function reference instead.',
+            dynamicImport: 'Remote dynamic `import()` is forbidden under MV3\'s CSP - import local modules w/ a relative path.',
+            remoteScriptSrc: 'Injecting remote `<script src>` is forbidden under MV3\'s CSP - use `chrome.runtime.getURL()` for bundled scripts.',
             executeScriptURL: '`chrome.scripting.executeScript` must use local `files`, not a remote URL.',
             executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization - pass them via `args`.'
         }

package/src/rules/no-unused-permissions.js

@@ -1,15 +1,40 @@
-import { apiPermissionMap } from '../data/apis.js'
-import { readManifest, getChromeAPIcalls } from '../utils.js'
+import fs from 'node:fs'
+import path from 'node:path'
+import { apiPermissionMap, findPermission } from '../data/apis.js'
+import { findExtensionRoot, getFilename, readManifest } from '../utils.js'
 
-const mappedPermissions = new Set(apiPermissionMap.values())
+const re = { manifestFilename: /manifest\.json$/ }
+
+function collectUsedAPIs(manifest, root) {
+    const files = new Set()
+    if (manifest.background?.service_worker) files.add(manifest.background.service_worker)
+    for (const script of manifest.background?.scripts || []) files.add(script)
+    for (const contentScript of manifest.content_scripts || [])
+        for (const file of contentScript.js || []) files.add(file)
+    if (manifest.action?.default_popup) files.add(manifest.action.default_popup)
+    if (manifest.options_ui?.page) files.add(manifest.options_ui.page)
+    if (manifest.devtools_page) files.add(manifest.devtools_page)
+    const re = { /* eslint-disable-next-line security/detect-unsafe-regex */
+        chromeAPI: /\bchrome\.\w+(?:\.\w+)*/g }
+    const used = new Set()
+    for (const file of files) {
+        try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename
+            const src = fs.readFileSync(path.resolve(root, file), 'utf8')
+            for (const match of src.matchAll(re.chromeAPI)) used.add(match[0])
+        } catch {} // eslint-disable-line no-empty
+    }
+    return used
+}
 
 export default {
     meta: {
-        type: 'suggestion',
+        type: 'problem',
         docs: {
-            description: 'Flag manifest permissions whose APIs are never used in this file',
-            category: 'Best Practices',
-            recommended: true
+            description: 'Flag manifest permissions whose APIs are never used',
+            category: 'Possible Errors',
+            recommended: true,
+            manifest: true
         },
         schema: [],
         messages: {
@@ -18,20 +43,40 @@ export default {
     },
 
     create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
         const manifest = readManifest(context) ; if (!manifest) return {}
+        const root = findExtensionRoot(context) ; if (!root) return {}
+        const usedAPIs = collectUsedAPIs(manifest, root)
+        const permissionNodes = new Map()
+        function isUsed(permission) {
+            let known = false
+            for (const [, perm] of apiPermissionMap)
+                if (perm == permission) { known = true ; break }
+            if (!known) return true // custom permission → not our business
+            for (const api of usedAPIs)
+                if (findPermission(api) == permission) return true
+            return false
+        }
         return {
-            'Program:exit'() {
-                const declared = manifest.permissions || [] ; if (!declared.length) return
-                const calls = getChromeAPIcalls(context.sourceCode)
-                const used = new Set()
-                for (const api of calls)
-                    for (const [prefix, permission] of apiPermissionMap)
-                        if (api == prefix || api.startsWith(`${prefix}.`)) { used.add(permission) ; break }
-                for (const permission of declared) {
-                    if (!mappedPermissions.has(permission)) continue
-                    if (used.has(permission)) continue
-                    context.report({ loc: { line: 1, column: 0 },
-                        messageId: 'unusedPermission', data: { permission }})
+            '*'(node) {
+                const keyNode = node.name || node.key ; if (!keyNode) return
+                const keyName = keyNode.value ?? keyNode.name
+                if (keyName != 'permissions' && keyName != 'optional_permissions') return
+                const arrNode = node.value ; if (arrNode?.type != 'Array') return
+                const elements = arrNode.elements || arrNode.items || []
+                for (const el of elements) {
+                    const valueNode = el.value || el
+                    const perm = valueNode?.value
+                    if (typeof perm != 'string') continue
+                    if (!permissionNodes.has(perm)) permissionNodes.set(perm, [])
+                    permissionNodes.get(perm).push(valueNode)
+                }
+            },
+            'Document:exit'() {
+                for (const [permission, nodes] of permissionNodes) {
+                    if (isUsed(permission)) continue
+                    for (const n of nodes)
+                        context.report({ node: n, messageId: 'unusedPermission', data: { permission }})
                 }
             }
         }

package/src/rules/require-mv3.js

@@ -1,4 +1,6 @@
-import { readManifest } from '../utils.js'
+import { getFilename, readManifest } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
 
 export default {
     meta: {
@@ -6,7 +8,8 @@ export default {
         docs: {
             description: 'Require manifest_version 3',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            manifest: true
         },
         schema: [],
         messages: {
@@ -15,6 +18,21 @@ export default {
     },
 
     create(context) {
+        if (re.manifestFilename.test(getFilename(context))) { // lint it directly
+            let foundVersion = null, versionNode = null
+            return {
+                '*'(node) {
+                    const keyNode = node.name || node.key ; if (!keyNode) return
+                    if ((keyNode.value ?? keyNode.name) != 'manifest_version') return
+                    foundVersion = node.value?.value
+                    versionNode = node.value || keyNode
+                },
+                '*:exit'(node) {
+                    if (node.type != 'Document' || foundVersion == 3) return
+                    context.report({ node: versionNode || node, messageId: 'notMV3' })
+                }
+            }
+        }
         const manifest = readManifest(context) ; if (!manifest || manifest.manifest_version == 3) return {}
         return { Program(node) { context.report({ node, messageId: 'notMV3' }) }}
     }

package/src/rules/valid-mv3-schema.js

@@ -1,5 +1,7 @@
-import { mv2OnlyKeys, forbiddenCSPDirectives } from '../data/manifest.js'
-import { readManifest } from '../utils.js'
+import { mv2OnlyKeys, forbiddenCSPdirectives } from '../data/manifest.js'
+import { getFilename, readManifest } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
 
 export default {
     meta: {
@@ -7,7 +9,8 @@ export default {
         docs: {
             description: 'Validate manifest against the MV3 schema',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            manifest: true
         },
         schema: [],
         messages: {
@@ -18,6 +21,51 @@ export default {
     },
 
     create(context) {
+        if (re.manifestFilename.test(getFilename(context))) { // lint it directly
+            const ancestors = [], pendingReports = []
+            let isMV3 = false
+            const keyOf = n => {
+                const k = n?.name || n?.key
+                return k?.value ?? k?.name
+            }
+            return {
+                '*'(node) {
+                    const keyName = keyOf(node)
+                    if (keyName) {
+                        const isTopLevel = ancestors.length == 2
+                            && ancestors[0].type == 'Document'
+                            && ancestors[1].type == 'Object'
+                        const inBackground = ancestors.some(a => keyOf(a) == 'background')
+                        const inCSP = ancestors.some(a => keyOf(a) == 'content_security_policy')
+                        if (keyName == 'manifest_version' && node.value?.value == 3) isMV3 = true
+                        if (isTopLevel && mv2OnlyKeys.has(keyName))
+                            pendingReports.push({ node, messageId: 'mv2Key',
+                                data: { key: keyName, reason: 'MV2-only key' }})
+                        if (inBackground && keyName == 'scripts')
+                            pendingReports.push({ node, messageId: 'mv2Key',
+                                data: { key: 'background.scripts', reason: 'use background.service_worker' }})
+                        if (inBackground && keyName == 'persistent')
+                            pendingReports.push({ node, messageId: 'mv2Key',
+                                data: { key: 'background.persistent', reason: 'MV3 service workers are never persistent' }})
+                        if (isTopLevel && keyName == 'content_security_policy' && node.value?.type == 'String')
+                            pendingReports.push({ node: node.value, messageId: 'wrongCSPType' })
+                        if (inCSP && keyName == 'extension_pages' && typeof node.value?.value == 'string')
+                            for (const directive of forbiddenCSPdirectives)
+                                if (node.value.value.includes(directive))
+                                    pendingReports.push({ node: node.value, messageId: 'unsafeCSP',
+                                        data: { directive }})
+                    }
+                    ancestors.push(node)
+                },
+                '*:exit'(node) {
+                    ancestors.pop()
+                    if (node.type == 'Document') {
+                        if (!isMV3) return
+                        for (const r of pendingReports) context.report(r)
+                    }
+                }
+            }
+        }
         const manifest = readManifest(context) ; if (!manifest || manifest.manifest_version != 3) return {}
         return {
             Program(node) {
@@ -35,7 +83,7 @@ export default {
                     context.report({ node, messageId: 'wrongCSPType' })
                 const cspPages = csp?.extension_pages
                 if (typeof cspPages == 'string')
-                    for (const directive of forbiddenCSPDirectives)
+                    for (const directive of forbiddenCSPdirectives)
                         if (cspPages.includes(directive))
                             context.report({ node, messageId: 'unsafeCSP', data: { directive }})
             }

package/src/rules/valid-version-field.js

@@ -0,0 +1,95 @@
+import { getFilename, readManifest } from '../utils.js'
+
+const re = { /* eslint-disable security/detect-unsafe-regex */
+    chromeParts: /^\d+(?:\.\d+){0,3}$/,
+    date: /^\d{4}\.(?:0?[1-9]|1[0-2])\.(?:0?[1-9]|[12]\d|3[01])(?:\.\d+)?$/,
+    manifestFilename: /manifest\.json$/,
+    semver: /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/
+} /* eslint-enable security/detect-unsafe-regex */
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validate the manifest version field format',
+            category: 'Possible Errors',
+            recommended: true,
+            manifest: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                versionType: {
+                    type: 'string',
+                    enum: ['chrome', 'semver', 'date'],
+                    description: 'Version format to enforce (default: chrome)'
+                },
+                allowFutureDate: {
+                    type: 'boolean',
+                    description: 'Allow version dates later than the current date (default: false)'
+                },
+                timezone: {
+                    type: 'string',
+                    description: 'IANA timezone for determining the current date (when omitted, only year and month are checked)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{}],
+        messages: {
+            invalidVersion: 'Invalid manifest `version`: must be a valid {{versionType}} version (expected format: {{example}})',
+            futureVersion: 'Invalid manifest `version`: date cannot be in the future'
+        }
+    },
+
+    create(context) {
+        const options = context.options[0] || {},
+              versionType = options.versionType || 'chrome',
+              allowFutureDate = options.allowFutureDate ?? false,
+              timezone = options.timezone,
+              example = versionType == 'semver' ? '1.2.3'
+                      : versionType == 'date' ? 'YYYY.M.D or YYYY.M.D.N'
+                      : '1.2.3 or 1.2.3.4'
+        const now = timezone
+            ? Object.fromEntries(new Intl.DateTimeFormat('en', {
+                timeZone: timezone, year: 'numeric', month: 'numeric', day: 'numeric'
+            }).formatToParts().filter(({ type }) => ['year', 'month', 'day'].includes(type))
+                .map(({ type, value }) => [type, Number(value)]))
+            : { year: new Date().getUTCFullYear(), month: new Date().getUTCMonth() +1 }
+        function validate(node, version) {
+            if (typeof version != 'string') return
+            const parts = version.split('.')
+            if (!re.chromeParts.test(version) || parts.some(part => Number(part) > 65535))
+                return context.report({ node, messageId: 'invalidVersion', data: { versionType, example }})
+            if (versionType == 'semver') {
+                if (!re.semver.test(version))
+                    context.report({ node, messageId: 'invalidVersion', data: { versionType, example }})
+            } else if (versionType == 'date') {
+                if (!re.date.test(version))
+                    context.report({ node, messageId: 'invalidVersion', data: { versionType, example }})
+                else {
+                    const [year, month, day] = parts.map(Number)
+                    if (!allowFutureDate && (
+                           year > now.year
+                        || year == now.year && month > now.month
+                        || timezone && year == now.year && month == now.month && day > now.day
+                    )) context.report({ node, messageId: 'futureVersion' })
+                }
+            }
+        }
+        if (re.manifestFilename.test(getFilename(context))) // lint it directly
+            return {
+                '*'(node) {
+                    const keyNode = node.name || node.key ; if (!keyNode) return
+                    const keyName = keyNode.value ?? keyNode.name ; if (keyName != 'version') return
+                    const valueNode = node.value ; if (valueNode?.type != 'String') return
+                    validate(valueNode, valueNode.value)
+                }
+            }
+        return {
+            Program(node) {
+                validate(node, readManifest(context)?.version)
+            }
+        }
+    }
+}

package/src/utils.js

@@ -4,13 +4,20 @@ import path from 'node:path'
 const re = { chromeAPI: /\bchrome(?:\.\w+)+/g }, // eslint-disable-line security/detect-unsafe-regex
       manifestCache = new Map()
 
+export function bundleRules(rules, predicate, pluginName) {
+    return Object.fromEntries(Object.entries(rules)
+        .filter(([, rule]) => predicate(rule))
+        .map(([ruleId]) => [`${pluginName}/${ruleId}`, 'error']))
+}
+
 export function findExtensionRoot(context) {
     let dir = path.dirname(getFilename(context))
-    const root = path.parse(dir).root
-    while (dir != root) {
+    while (dir) {
         // eslint-disable-next-line security/detect-non-literal-fs-filename
         if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
-        dir = path.dirname(dir)
+        const parent = path.dirname(dir)
+        if (parent == dir) break // reached filesystem root or a stuck relative "."
+        dir = parent
     }
     return null
 }