eslint-plugin-chrome-extensions 2.0.0 → 2.1.0

package/src/index.js

@@ -1,29 +1,41 @@
-import { bundleRules } from './utils.js'
+import { bundles as oldBundles } from './data/deprecations.js'
 
 import manifestKeyOrder from './rules/manifest-key-order.js'
 import noContentStyleLeak from './rules/no-content-style-leak.js'
 import noDeprecatedAPIs from './rules/no-deprecated-apis.js'
+import noDuplicateManifestKeys from './rules/no-duplicate-manifest-keys.js'
+import noInsecureFetch from './rules/no-insecure-fetch.js'
 import noInsecureMessaging from './rules/no-insecure-messaging.js'
 import noInvalidPermissions from './rules/no-invalid-permissions.js'
 import noMissingPermissions from './rules/no-missing-permissions.js'
+import noMissingWebAccessibleResources from './rules/no-missing-web-accessible-resources.js'
 import noRemoteCode from './rules/no-remote-code.js'
+import noUnrestrictedHostPermissions from './rules/no-unrestricted-host-permissions.js'
 import noUnusedPermissions from './rules/no-unused-permissions.js'
 import requireMV3 from './rules/require-mv3.js'
+import validManifestIcons from './rules/valid-manifest-icons.js'
 import validMV3schema from './rules/valid-mv3-schema.js'
 import validServiceWorker from './rules/valid-service-worker.js'
 import validVersionField from './rules/valid-version-field.js'
 
+import { bundleRules, deprecatedFrom, initBundleDeprecation } from './utils.js'
+
 const plugin = {
     rules: {
         'manifest-key-order': manifestKeyOrder,
         'no-content-style-leak': noContentStyleLeak,
         'no-deprecated-apis': noDeprecatedAPIs,
+        'no-duplicate-manifest-keys': noDuplicateManifestKeys,
+        'no-insecure-fetch': noInsecureFetch,
         'no-insecure-messaging': noInsecureMessaging,
         'no-invalid-permissions': noInvalidPermissions,
         'no-missing-permissions': noMissingPermissions,
+        'no-missing-web-accessible-resources': noMissingWebAccessibleResources,
         'no-remote-code': noRemoteCode,
+        'no-unrestricted-host-permissions': noUnrestrictedHostPermissions,
         'no-unused-permissions': noUnusedPermissions,
         'require-mv3': requireMV3,
+        'valid-manifest-icons': validManifestIcons,
         'valid-mv3-schema': validMV3schema,
         'valid-service-worker': validServiceWorker,
         'valid-version-field': validVersionField
@@ -36,7 +48,8 @@ for (const [ruleId, rule] of Object.entries(plugin.rules))
 plugin.configs = {
     recommended: {
         plugins: { 'chrome-extensions': plugin },
-        rules: bundleRules(plugin.rules, rule => rule.meta.docs.recommended, 'chrome-extensions')
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.recommended,
+            'chrome-extensions', deprecatedFrom(oldBundles, 'recommended'))
     },
     strict: {
         plugins: { 'chrome-extensions': plugin },
@@ -46,10 +59,19 @@ plugin.configs = {
         plugins: { 'chrome-extensions': plugin },
         rules: bundleRules(plugin.rules, rule => rule.meta.type == 'problem', 'chrome-extensions')
     },
+    security: {
+        plugins: { 'chrome-extensions': plugin },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.security,
+            'chrome-extensions', deprecatedFrom(oldBundles, 'security'))
+    },
     manifest: {
         plugins: { 'chrome-extensions': plugin },
-        rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest, 'chrome-extensions')
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest,
+            'chrome-extensions', deprecatedFrom(oldBundles, 'manifest'))
     }
 }
 
+for (const entry of Object.entries(oldBundles))
+    initBundleDeprecation(plugin, entry, 'chrome-extensions')
+
 export { plugin as default, plugin as chromeExtensions }

package/src/rules/manifest-key-order.js

@@ -1,4 +1,5 @@
 import { manifestKeyOrder } from '../data/manifest.js'
+
 import { getFilename } from '../utils.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
@@ -23,7 +24,7 @@ export default {
     meta: {
         type: 'layout',
         docs: {
-            description: 'Enforce an order for manifest keys',
+            description: 'Enforces a preferred order for manifest keys',
             category: 'Stylistic Issues',
             recommended: false,
             manifest: true
@@ -40,7 +41,7 @@ export default {
             additionalProperties: false
         }],
         defaultOptions: [{ order: [] }],
-        messages: { wrongOrder: '`{{first}}` should appear before `{{second}}`' }
+        messages: { wrongOrder: '`{{first}}` should appear before `{{second}}`.' }
     },
 
     create(context) {

package/src/rules/no-duplicate-manifest-keys.js

@@ -0,0 +1,36 @@
+import { getFilename } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow duplicate keys in manifest.json',
+            category: 'Possible Errors',
+            recommended: false,
+            manifest: true
+        },
+        schema: [],
+        messages: {
+            duplicateKey: 'Duplicate manifest key "{{key}}".'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        return {
+            Object(node) {
+                const members = node.members || node.properties || [],
+                      seen = new Set()
+                for (const member of members) {
+                    const keyNode = member.name || member.key ; if (!keyNode) continue
+                    const keyName = keyNode.value ?? keyNode.name ; if (typeof keyName != 'string') continue
+                    if (seen.has(keyName))
+                        context.report({ node: keyNode, messageId: 'duplicateKey', data: { key: keyName } })
+                    else seen.add(keyName)
+                }
+            }
+        }
+    }
+}

package/src/rules/no-insecure-fetch.js

@@ -0,0 +1,52 @@
+const re = { insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flags `fetch()` and `XMLHttpRequest.open()` calls that use `http://`',
+            category: 'Possible Errors',
+            recommended: true,
+            security: true
+        },
+        schema: [],
+        messages: {
+            insecureFetch: '`fetch()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureXHR: '`XMLHttpRequest.open()` to "{{url}}" insecure. Use HTTPS or a relative path instead.'
+        }
+    },
+
+    create(context) {
+        const xhrVars = new Set()
+        function urlFromLiteral(node) {
+            return ( node?.type == 'Literal'
+                && typeof node.value == 'string'
+                && re.insecureURL.test(node.value)
+            ) ? node.value : null
+        }
+        return {
+            VariableDeclarator(node) {
+                if (node.init?.type == 'NewExpression'
+                    && node.init.callee?.name == 'XMLHttpRequest'
+                    && node.id.type == 'Identifier'
+                ) xhrVars.add(node.id.name)
+            },
+            CallExpression(node) {
+                if (node.callee.type == 'Identifier' && node.callee.name == 'fetch') {
+                    const url = urlFromLiteral(node.arguments[0])
+                    if (url)
+                        context.report({ node: node.arguments[0], messageId: 'insecureFetch', data: { url }})
+                }
+                if (node.callee.type == 'MemberExpression'
+                    && node.callee.property?.name == 'open'
+                    && node.callee.object?.type == 'Identifier'
+                    && xhrVars.has(node.callee.object.name)
+                ) {
+                    const url = urlFromLiteral(node.arguments[1])
+                    if (url)
+                        context.report({ node: node.arguments[1], messageId: 'insecureXHR', data: { url }})
+                }
+            }
+        }
+    }
+}

package/src/rules/no-insecure-messaging.js

@@ -1,24 +1,46 @@
-import { isExternalMessagingListener } from '../data/apis.js'
 import { getMemberPath } from '../utils.js'
+import { isExternalMessagingListener } from '../data/apis.js'
 
-const RE_SENDER_VALIDATION = /sender\.(?:id|origin)/
+const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ }
 
 export default {
     meta: {
         type: 'problem',
         docs: {
-            description: 'Require sender validation on external messaging + filtered tab broadcasts',
+            description: 'Requires sender/origin validation + filtered `tabs.query()` + explicit `window.postMessage()` target',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            security: true
         },
-        schema: [],
+        defaultOptions: [{ disallowWildcardTarget: true }],
+        schema: [{
+            type: 'object',
+            properties: {
+                disallowWildcardTarget: {
+                    type: 'boolean',
+                    description: 'Flag postMessage calls that use "*" as targetOrigin'
+                }
+            },
+            additionalProperties: false
+        }],
         messages: {
             unvalidatedExternal: '`{{listener}}` handler must validate `sender.<id|origin>` before processing messages.',
-            unfilteredBroadcast: '`chrome.tabs.query({})` with no filter broadcasts to every open tab - add `url` or `currentWindow`.'
+            unfilteredBroadcast: '`chrome.tabs.query({})` w/ no filter broadcasts to every open tab. Add `url` or `currentWindow` instead.',
+            unvalidatedPostMessage: '`{{target}}` message handler must validate `event.origin`/`event.source` before processing messages.',
+            wildcardTarget: '`postMessage` to `"*"` leaks data to any origin. Explicitly specify `targetOrigin` instead.'
         }
     },
 
     create(context) {
+        const opts = context.options[0] || {},
+              disallowWildcard = opts.disallowWildcardTarget !== false
+        function checkPostMessageHandler(node, handlerNode, target) {
+            if (!handlerNode) return
+            const body = context.sourceCode.getText(handlerNode)
+            if (re.postmsgValidation.test(body)) return
+            context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
+        }
+        function isMessageTarget(obj) { return obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name) }
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
@@ -27,7 +49,7 @@ export default {
                 if (listenerRoot && isExternalMessagingListener(listenerRoot)) {
                     const handler = node.arguments[0] ; if (!handler) return
                     const body = context.sourceCode.getText(handler)
-                    if (!RE_SENDER_VALIDATION.test(body))
+                    if (!re.senderValidation.test(body))
                         context.report({ node, messageId: 'unvalidatedExternal', data: { listener: listenerRoot }})
                 }
                 if (path == 'chrome.tabs.query') {
@@ -36,6 +58,21 @@ export default {
                     if (isEmpty)
                         context.report({ node, messageId: 'unfilteredBroadcast' })
                 }
+                if (node.callee.property?.name == 'addEventListener'
+                    && node.arguments[0]?.value == 'message'
+                    && isMessageTarget(node.callee.object)
+                ) checkPostMessageHandler(node, node.arguments[1], node.callee.object.name)
+                if (disallowWildcard && node.callee.property?.name == 'postMessage') {
+                    const target = node.arguments[1]
+                    if (target?.type == 'Literal' && target.value == '*')
+                        context.report({ node: target, messageId: 'wildcardTarget' })
+                }
+            },
+            AssignmentExpression(node) {
+                if (node.left.type == 'MemberExpression'
+                    && node.left.property?.name == 'onmessage'
+                    && isMessageTarget(node.left.object)
+                ) checkPostMessageHandler(node, node.right, node.left.object.name)
             }
         }
     }

package/src/rules/no-invalid-permissions.js

@@ -1,5 +1,5 @@
-import { isValidPermission } from '../data/permissions.js'
 import { getFilename, readManifest } from '../utils.js'
+import { isValidPermission } from '../data/permissions.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
 
@@ -9,7 +9,7 @@ export default {
         docs: {
             description: 'Disallow invalid or unsupported manifest permission names',
             category: 'Possible Errors',
-            recommended: true,
+            recommended: false,
             manifest: true
         },
         defaultOptions: [{ target: 'mv3', allowedPermissions: [] }],

package/src/rules/no-missing-web-accessible-resources.js

@@ -0,0 +1,51 @@
+import { getMemberPath, isContentScriptFile, readManifest } from '../utils.js'
+
+const re = { leadingSlash: /^\//, regexSpecial: /[.+?^${}()|[\]\\]/g }
+
+function collectWarPatterns(manifest) {
+    const war = manifest.web_accessible_resources
+    if (!Array.isArray(war)) return []
+    const patterns = []
+    for (const entry of war) {
+        if (typeof entry == 'string') patterns.push(entry)  // MV2 flat
+        else if (Array.isArray(entry?.resources))
+            for (const res of entry.resources) patterns.push(res)  // MV3 object
+    }
+    return patterns
+}
+
+function patternToRegex(pattern) {
+    const escaped = pattern.replace(re.regexSpecial, '\\$&').replace(/\*/g, '.*')
+    return new RegExp(`^${escaped}$`) // eslint-disable-line security/detect-non-literal-regexp
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require content-script getURL() paths to be listed in `web_accessible_resources`',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        schema: [],
+        messages: {
+            missingWar: '`{{path}}` is not in `web_accessible_resources`.'
+        }
+    },
+
+    create(context) {
+        const manifest = readManifest(context) ; if (!manifest) return {}
+        if (!isContentScriptFile(context, manifest)) return {}
+        const regexes = collectWarPatterns(manifest).map(patternToRegex)
+        return {
+            CallExpression(node) {
+                if (node.callee.type != 'MemberExpression') return
+                if (getMemberPath(node.callee) != 'chrome.runtime.getURL') return
+                const arg = node.arguments[0] ; if (arg?.type != 'Literal' || typeof arg.value != 'string') return
+                const resourcePath = arg.value.replace(re.leadingSlash, '')
+                for (const regex of regexes) if (regex.test(resourcePath)) return
+                context.report({ node: arg, messageId: 'missingWar', data: { path: arg.value }})
+            }
+        }
+    }
+}

package/src/rules/no-remote-code.js

@@ -1,4 +1,5 @@
 import { remoteCodePatterns } from '../data/manifest.js'
+
 import { getMemberPath } from '../utils.js'
 
 const re = { url: /^https?:\/\// }
@@ -7,9 +8,10 @@ export default {
     meta: {
         type: 'problem',
         docs: {
-            description: 'Disallow remote or dynamically-evaluated code, per the MV3 CSP',
+            description: 'Disallow remote or dynamically-evaluated code, per MV3\'s CSP',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            security: true
         },
         defaultOptions: [{
             patterns: ['eval', 'new-function', 'string-timer',
@@ -26,19 +28,19 @@ export default {
                 },
                 checkExecuteScriptClosures: {
                     type: 'boolean',
-                    description: 'Flag chrome.scripting.executeScript calls whose func captures outer scope'
+                    description: 'Flag `chrome.scripting.executeScript` calls whose func captures outer scope'
                 }
             },
             additionalProperties: false
         }],
         messages: {
-            eval: '`eval()` is forbidden under MV3\'s CSP - refactor to use static code.',
-            newFunction: '`new Function()` is forbidden under MV3\'s CSP - refactor to use a real function.',
-            stringTimer: 'String-argument `{{fn}}` is forbidden under MV3\'s CSP - pass a function reference instead.',
-            dynamicImport: 'Remote dynamic `import()` is forbidden under MV3\'s CSP - import local modules w/ a relative path.',
-            remoteScriptSrc: 'Injecting remote `<script src>` is forbidden under MV3\'s CSP - use `chrome.runtime.getURL()` for bundled scripts.',
+            eval: '`eval()` is forbidden under MV3\'s CSP. Use static code instead.',
+            newFunction: '`new Function()` is forbidden under MV3\'s CSP. Use a real function instead.',
+            stringTimer: 'String-argument `{{fn}}` is forbidden under MV3\'s CSP. Pass a function reference instead.',
+            dynamicImport: 'Remote dynamic `import()` is forbidden under MV3\'s CSP. Use a relative path instead.',
+            remoteScriptSrc: 'Injecting remote `<script src>` is forbidden under MV3\'s CSP. Use `chrome.runtime.getURL()` for bundled scripts instead.',
             executeScriptURL: '`chrome.scripting.executeScript` must use local `files`, not a remote URL.',
-            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization - pass them via `args`.'
+            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization. Pass them via `args` instead.'
         }
     },
 

package/src/rules/no-unrestricted-host-permissions.js

@@ -0,0 +1,54 @@
+import { getFilename } from '../utils.js'
+
+const re = { broadHost: /^(?:<all_urls>|\*:\/\/\*\/\*|\w+:\/\/\*\/\*)$/, manifestFilename: /manifest\.json$/ },
+      hostKeys = new Set(['host_permissions', 'optional_host_permissions', 'optional_permissions', 'permissions'])
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow broad host permissions that grant access to every site',
+            category: 'Possible Errors',
+            recommended: false,
+            manifest: true
+        },
+        defaultOptions: [{ allowedPatterns: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedPatterns: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Host patterns to explicitly allow despite being broad'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            unrestrictedHost: 'Host permission "{{pattern}}" grants access to every site. Narrow to specific origins or allow explicitly instead.'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const allowed = new Set(context.options[0]?.allowedPatterns || [])
+        return {
+            '*'(node) {
+                const keyNode = node.name || node.key ; if (!keyNode) return
+                const keyName = keyNode.value ?? keyNode.name
+                if (!hostKeys.has(keyName)) return
+                const arrNode = node.value ; if (arrNode?.type != 'Array') return
+                const elements = arrNode.elements || arrNode.items || []
+                for (const el of elements) {
+                    const valueNode = el.value || el,
+                          pattern = valueNode?.value
+                    if (typeof pattern != 'string'
+                        || allowed.has(pattern)
+                        || !re.broadHost.test(pattern)
+                    ) continue
+                    context.report({ node: valueNode, messageId: 'unrestrictedHost', data: { pattern }})
+                }
+            }
+        }
+    }
+}

package/src/rules/no-unused-permissions.js

@@ -33,7 +33,7 @@ export default {
         docs: {
             description: 'Flag manifest permissions whose APIs are never used',
             category: 'Possible Errors',
-            recommended: true,
+            recommended: false,
             manifest: true
         },
         schema: [],

package/src/rules/require-mv3.js

@@ -8,12 +8,12 @@ export default {
         docs: {
             description: 'Require manifest_version 3',
             category: 'Possible Errors',
-            recommended: true,
+            recommended: false,
             manifest: true
         },
         schema: [],
         messages: {
-            notMV3: 'manifest.json must declare `"manifest_version": 3` (MV2 rejected by the Chrome Web Store).'
+            notMV3: 'manifest.json must declare `"manifest_version": 3`.'
         }
     },
 

package/src/rules/valid-manifest-icons.js

@@ -0,0 +1,85 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { findExtensionRoot, getFilename } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/, svg: /\.svg$/i },
+      sizes = { recommended: ['16', '32', '48', '128'], required: '128' }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validate manifest icons: sizes, existing files, no SVG',
+            category: 'Possible Errors',
+            recommended: false,
+            manifest: true
+        },
+        defaultOptions: [{
+            requireRecommendedSizes: true,
+            checkIconExists: true,
+            noSVG: true
+        }],
+        schema: [{
+            type: 'object',
+            properties: {
+                requireRecommendedSizes: {
+                    type: 'boolean',
+                    description: 'Require all recommended sizes (16, 32, 48, 128)'
+                },
+                checkIconExists: {
+                    type: 'boolean',
+                    description: 'Flag icon paths that do not resolve to a file'
+                },
+                noSVG: {
+                    type: 'boolean',
+                    description: 'Flag SVG icon paths (unsupported by Chrome)'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            missingSize: 'Recommended icon size "{{size}}" is missing (16, 32, 48, 128).',
+            missingRequiredSize: 'Icons must include a 128x128 icon.',
+            missingFile: 'Icon file "{{file}}" does not exist in the extension root.',
+            svgNotSupported: 'SVG icons are not supported by Chrome. Use PNG instead.'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const opts = context.options[0] || {},
+              requireRecommended = opts.requireRecommendedSizes !== false,
+              checkFiles = opts.checkIconExists !== false,
+              checkSVG = opts.noSVG !== false
+        const root = checkFiles ? findExtensionRoot(context) : null
+        return {
+            '*'(node) {
+                const keyNode = node.name || node.key ; if (!keyNode) return
+                const keyName = keyNode.value ?? keyNode.name ; if (keyName != 'icons') return
+                const iconsObj = node.value ; if (iconsObj?.type != 'Object') return
+                const members = iconsObj.members || iconsObj.properties || []
+                const declaredSizes = new Set()
+                for (const member of members) {
+                    const sizeNode = member.name || member.key,
+                          size = sizeNode?.value ?? sizeNode?.name,
+                          fileNode = member.value,
+                          file = fileNode?.value
+                    if (typeof size == 'string') declaredSizes.add(size)
+                    if (typeof file != 'string') continue
+                    if (checkSVG && re.svg.test(file))
+                        context.report({ node: fileNode, messageId: 'svgNotSupported' })
+                    else if (checkFiles && root // eslint-disable-next-line security/detect-non-literal-fs-filename
+                        && !fs.existsSync(path.resolve(root, file))
+                    ) context.report({ node: fileNode, messageId: 'missingFile', data: { file }})
+                }
+                if (requireRecommended) {
+                    for (const size of sizes.recommended)
+                        if (!declaredSizes.has(size))
+                            context.report({ node: iconsObj, messageId: 'missingSize', data: { size }})
+                } else if (!declaredSizes.has(sizes.required))
+                    context.report({ node: iconsObj, messageId: 'missingRequiredSize' })
+            }
+        }
+    }
+}

package/src/rules/valid-mv3-schema.js

@@ -1,4 +1,5 @@
 import { mv2OnlyKeys, forbiddenCSPdirectives } from '../data/manifest.js'
+
 import { getFilename, readManifest } from '../utils.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
@@ -9,12 +10,12 @@ export default {
         docs: {
             description: 'Validate manifest against the MV3 schema',
             category: 'Possible Errors',
-            recommended: true,
+            recommended: false,
             manifest: true
         },
         schema: [],
         messages: {
-            mv2Key: '`{{key}}` is not allowed in MV3 - {{reason}}.',
+            mv2Key: '`{{key}}` is not allowed in MV3. {{reason}}.',
             unsafeCSP: 'MV3 CSP must not include `{{directive}}`.',
             wrongCSPType: '`content_security_policy` must be an object in MV3, not a string.'
         }

package/src/rules/valid-service-worker.js

@@ -12,7 +12,7 @@ export default {
         schema: [],
         messages: {
             listenerNotTopLevel: '`chrome.*.addListener()` must be registered at module top level so it attaches on service worker wake-up.',
-            keepaliveTimer: 'Sub-30s `{{fn}}` will not keep the MV3 service worker alive - use `chrome.alarms` instead.',
+            keepaliveTimer: 'Sub-30s `{{fn}}` will not keep the MV3 service worker alive. Use `chrome.alarms` instead.',
             domInSW: '`{{global}}` is not available in a service worker.'
         }
     },

package/src/rules/valid-version-field.js

@@ -13,7 +13,7 @@ export default {
         docs: {
             description: 'Validate the manifest version field format',
             category: 'Possible Errors',
-            recommended: true,
+            recommended: false,
             manifest: true
         },
         schema: [{
@@ -37,8 +37,8 @@ export default {
         }],
         defaultOptions: [{}],
         messages: {
-            invalidVersion: 'Invalid manifest `version`: must be a valid {{versionType}} version (expected format: {{example}})',
-            futureVersion: 'Invalid manifest `version`: date cannot be in the future'
+            invalidVersion: 'Invalid manifest `version`: must be a valid {{versionType}} version (expected format: {{example}}).',
+            futureVersion: 'Invalid manifest `version`: date cannot be in the future.'
         }
     },
 

package/src/utils.js

@@ -4,12 +4,26 @@ import path from 'node:path'
 const re = { chromeAPI: /\bchrome(?:\.\w+)+/g }, // eslint-disable-line security/detect-unsafe-regex
       manifestCache = new Map()
 
-export function bundleRules(rules, predicate, pluginName) {
+export function bundleRules(rules, predicate, pluginName, removals = []) {
     return Object.fromEntries(Object.entries(rules)
-        .filter(([, rule]) => predicate(rule))
+        .filter(([ruleId, rule]) => predicate(rule) || removals.includes(ruleId))
         .map(([ruleId]) => [`${pluginName}/${ruleId}`, 'error']))
 }
 
+export function deprecatedFrom(bundles, bundleName) {
+    const ruleIds = []
+    for (const [ruleId, [bundle]] of Object.entries(bundles))
+        if (bundle === bundleName) ruleIds.push(ruleId)
+    return ruleIds
+}
+
+export function initBundleDeprecation(plugin, [ruleId, [bundleName, note]], pluginName) {
+    if (!process.env.DEBUG_MODE) return
+    if (plugin.rules[ruleId]) // eslint-disable-line security/detect-object-injection
+        console.warn(`[${pluginName}] '${ruleId}' will be removed from '${
+            bundleName}' in a future major release${note ? ` (${note})` : ''}`)
+}
+
 export function findExtensionRoot(context) {
     let dir = path.dirname(getFilename(context))
     while (dir) {