eslint-plugin-chrome-extensions 2.0.0 → 2.1.0

package/README.md

@@ -12,7 +12,7 @@
 
 ESLint rules for Chrome extensions.
 
-<img src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-chrome-extensions/0b5e3e49/assets/images/screenshots/vs-code/squiggles.png">
+<img src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-chrome-extensions/04d2f53b22/assets/images/screenshots/vs-code/squiggles.png">
 
 ---
 
@@ -45,8 +45,7 @@ export default [
         plugins: { 'chrome-extensions': chromeExtensions },
         rules: {
             ...chromeExtensions.configs.recommended.rules,
-            'chrome-extensions/no-insecure-messaging': 'off',  // selectively disable rule
-            'chrome-extensions/no-deprecated-apis': ['error', { target: 'mv3' }]  // selectively tweak rule
+            'chrome-extensions/no-deprecated-apis': 'off'  // selectively disable rule
         }
     },
     {
@@ -54,14 +53,13 @@ export default [
         plugins: { 'chrome-extensions': chromeExtensions, json },
         rules: {
             ...chromeExtensions.configs.manifest.rules,
-            'chrome-extensions/require-mv3': 'off',  // selectively disable rule
             'chrome-extensions/valid-version-field': ['error', { versionType: 'date' }]  // selectively tweak rule
         }
     }
 ]
 ```
 
-Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `manifest`
+Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `security`, `manifest`
 
 **Note:** Rule config is either a severity string (`'off'`, `'warn'`, `'error'`) or an array `[severity, options]` when the rule accepts options.
 
@@ -74,6 +72,8 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 
 <h3 id="manifest-key-order">
     <code>manifest-key-order</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
     <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
         <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Doesn't prevent bugs" href="#manifest-key-order">
@@ -99,8 +99,8 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
   /* eslint chrome-extensions/manifest-key-order: ['error', { order: ['name', 'manifest_version'] }] */
   
   {
-    "manifest_version": 3,
-!   "name": "My Extension",
+!   "manifest_version": 3,
+    "name": "My Extension",
     "version": "1.0.0"
   }
 ```
@@ -133,7 +133,7 @@ If you don't care about the order of manifest keys.
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -185,7 +185,7 @@ If you intentionally interact w/ host page styles.
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -250,7 +250,123 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-duplicate-manifest-keys">
+    <code>no-duplicate-manifest-keys</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-duplicate-manifest-keys">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Disallows duplicate keys in <code>manifest.json</code>.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+!   "name": "Foo",
+!   "name": "Bar",
+!   "version": "1.0.0",
+!   "version": "2.0.0"
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+-   "name": "Foo",
+-   "name": "Bar",
+    "name": "My Extension",
+-   "version": "1.0.0",
+-   "version": "2.0.0"
+    "version": "1.0.0"
+  }
+```
+
+#### When not to use it
+
+If you rely on a Chromium fork resolving duplicate keys in a specific order.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- [`manifest-key-order`](#manifest-key-order)
+- [`no-unused-permissions`](#no-unused-permissions)
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-insecure-fetch">
+    <code>no-insecure-fetch</code>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-insecure-fetch">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Flags <code>fetch()</code> and <code>XMLHttpRequest.open()</code> calls that use <code>http://</code>.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+! fetch('http://api.example.com/data')
+! xhr.open('GET', 'http://cdn.example.com/lib.js')
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+- fetch('http://api.example.com/data')
++ fetch('https://api.example.com/data')
+- xhr.open('GET', 'http://cdn.example.com/lib.js')
++ xhr.open('GET', 'https://cdn.example.com/lib.js')
+```
+
+#### When not to use it
+
+If you intentionally target HTTP endpoints.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/network-requests">Chrome for Developers — Cross-origin network requests</a>
+- [`no-remote-code`](#no-remote-code)
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -262,6 +378,10 @@ If you don't want deprecation validation at all. For individual deprecated APIs
     <code>no-insecure-messaging</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-insecure-messaging">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -269,7 +389,11 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 
 <details>
 
-<summary>Requires external message handlers validate <code>sender</code> + flags unfiltered <code>tabs.query()</code>.</summary>
+<summary>Requires sender/origin validation + filtered <code>tabs.query()</code> + explicit <code>window.postMessage()</code> target.</summary>
+
+#### Options
+
+- `disallowWildcardTarget` (default `true`) – flag <code>postMessage()</code> calls that use <code>'*'</code> as <code>targetOrigin</code>
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
@@ -278,9 +402,15 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 !     handle(msg)
   })
 
+  window.addEventListener('message', event => {
+!     handle(event.data)
+  })
+
 ! chrome.tabs.query({})
       .then(tabs => tabs.forEach(tab =>
           chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
+
+! window.postMessage(payload, '*')
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -291,15 +421,23 @@ If you don't want deprecation validation at all. For individual deprecated APIs
       handle(msg)
   })
 
+  window.addEventListener('message', event => {
++     if (event.origin != 'https://allowed-origin.com') return
+      handle(event.data)
+  })
+
 - chrome.tabs.query({})
 + chrome.tabs.query({ url: 'https://allowed-origin.com/*' })
       .then(tabs => tabs.forEach(tab =>
           chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
+
+- window.postMessage(payload, '*')
++ window.postMessage(payload, 'https://allowed-origin.com')
 ```
 
 #### When not to use it
 
-If you trust every external caller and open tab.
+If you trust every external caller and open tab, or you intentionally broadcast to any origin.
 
 #### Introduced in
 
@@ -309,10 +447,11 @@ If you trust every external caller and open tab.
 
 - <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#event-onMessageExternal">Chrome for Developers — `runtime.onMessageExternal`</a>
 - <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/tabs#method-query">Chrome for Developers — `tabs.query()`</a>
+- <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns">MDN — `window.postMessage()` security concerns</a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -324,6 +463,8 @@ If you trust every external caller and open tab.
     <code>no-invalid-permissions</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -379,7 +520,7 @@ If you don't want permission validation at all. For custom permissions from a Ch
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -442,7 +583,70 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-missing-web-accessible-resources">
+    <code>no-missing-web-accessible-resources</code>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-missing-web-accessible-resources">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Flags <code>chrome.runtime.getURL()</code> paths missing from <code>web_accessible_resources</code>.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  // manifest.json
+  {
+    "manifest_version": 3,
+!   "web_accessible_resources": []
+  }
+
+  // content.js
+! img.src = chrome.runtime.getURL('logo.png')
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  // manifest.json
+  {
+    "manifest_version": 3,
+-   "web_accessible_resources": []
++   "web_accessible_resources": [{ "resources": ["logo.png"], "matches": ["<all_urls>"] }]
+  }
+
+  // content.js
+  img.src = chrome.runtime.getURL('logo.png')
+```
+
+#### When not to use it
+
+If your paths are built at runtime.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">Chrome for Developers — `web_accessible_resources`</a>
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#method-getURL">Chrome for Developers — `runtime.getURL()`</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -454,6 +658,8 @@ If you use APIs through aliases or wrappers that obscure the original call site.
     <code>no-remote-code</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -492,6 +698,10 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 + chrome.scripting.executeScript({ target: { tabId }, func: doThing, args: [value] })
 ```
 
+#### When not to use it
+
+If you intentionally target forks w/ relaxed CSPs. For individual patterns you still need, prefer narrowing via `patterns` over disabling the rule.
+
 #### Introduced in
 
 <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v1.0.0">v1.0.0</a> (October 2, 2026)
@@ -503,7 +713,71 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-unrestricted-host-permissions">
+    <code>no-unrestricted-host-permissions</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-unrestricted-host-permissions">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Disallows broad host permissions that grant access to every site.</summary>
+
+#### Options
+
+- `allowedPatterns` (default `[]`) – host patterns to explicitly allow (e.g. `['<all_urls>']`)
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+!   "host_permissions": ["<all_urls>"],
+!   "optional_host_permissions": ["*://*/*"]
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+-   "host_permissions": ["<all_urls>"],
++   "host_permissions": ["https://example.com/*", "https://*.trusted.com/*"],
+-   "optional_host_permissions": ["*://*/*"]
++   "optional_host_permissions": ["https://user-content.example.com/*"]
+  }
+```
+
+#### When not to use it
+
+If you legitimately need broad access (e.g. ad blockers or dev tools).
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">Chrome for Developers — Declare permissions</a>
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">Chrome for Developers — Match patterns</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -513,8 +787,8 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 
 <h3 id="no-unused-permissions">
     <code>no-unused-permissions</code>
-    <a title="Included in recommended + strict configs" href="#usage">
-        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-unused-permissions">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -564,7 +838,7 @@ If you access the granted API through an alias or computed property rather than
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -576,6 +850,8 @@ If you access the granted API through an alias or computed property rather than
     <code>require-mv3</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23require-mv3">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -608,7 +884,7 @@ If you access the granted API through an alias or computed property rather than
 
 #### When not to use it
 
-If you intentionally target MV2 for a Chromium fork that still supports it.
+If you intentionally target MV2 for a browser that still supports it (e.g. Firefox).
 
 #### Introduced in
 
@@ -620,7 +896,78 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="valid-manifest-icons">
+    <code>valid-manifest-icons</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-manifest-icons">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Ensures manifest <code>icons</code> exist and use the recommended sizes.</summary>
+
+#### Options
+
+- `requireRecommendedSizes` (default `true`) – require all of `16`, `32`, `48`, `128`
+- `checkIconExists` (default `true`) – flag icon paths that don't resolve to an existing file
+- `noSVG` (default `true`) – flag SVG icon paths (unsupported by Chrome)
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+    "icons": {
+!     "48": "icon48.svg",
+      "256": "icon256.png"
+    }
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+    "icons": {
++     "16": "icon16.png",
++     "32": "icon32.png",
+-     "48": "icon48.svg",
++     "48": "icon48.png",
++     "128": "icon128.png",
+      "256": "icon256.png"
+    }
+  }
+```
+
+#### When not to use it
+
+If your icons are injected at build time, or you target browsers that support SVGs (e.g. Firefox).
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/icons">Chrome for Developers — `icons`</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -632,6 +979,8 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
     <code>valid-mv3-schema</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-mv3-schema">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -670,7 +1019,7 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 
 #### When not to use it
 
-If you intentionally target MV2 for a Chromium fork that still supports it.
+If you intentionally target MV2 for a browser that still supports it (e.g. Firefox).
 
 #### Introduced in
 
@@ -683,7 +1032,7 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -741,7 +1090,7 @@ If your background context isn't a service worker.
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -753,6 +1102,8 @@ If your background context isn't a service worker.
     <code>valid-version-field</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -775,7 +1126,6 @@ If your background context isn't a service worker.
 ```diff
   /* eslint chrome-extensions/valid-version-field: ['error', { versionType: 'date' }] */
   
-  // manifest.json
   {
     "manifest_version": 3,
 !   "version": "2026.1.111",
@@ -788,7 +1138,6 @@ If your background context isn't a service worker.
 ```diff
   /* eslint chrome-extensions/valid-version-field: ['error', { versionType: 'date' }] */
   
-  // manifest.json
   {
     "manifest_version": 3,
 -   "version": "2026.1.111",
@@ -811,7 +1160,7 @@ If you don't care about version format consistency, or your version is injected
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -902,4 +1251,4 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 <!-- Links -->
 
-[epc-rules]: #supported-rules
+[epce-rules]: #supported-rules

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "ESLint rules for Chrome extensions",
   "type": "module",
   "engines": {
@@ -68,7 +68,7 @@
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
-    "eslint-plugin-constructors": "^1.4.0",
+    "eslint-plugin-constructors": "^1.4.1",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.4.1",

package/src/data/deprecations.js

@@ -0,0 +1,10 @@
+// Delete a line to end support
+
+export const bundles = { // ruleId: [bundleName, note]
+    'no-invalid-permissions': ['recommended'],
+    'require-mv3':            ['recommended'],
+    'valid-mv3-schema':       ['recommended'],
+    'valid-version-field':    ['recommended']
+}
+
+export default { bundles }