eslint-plugin-chrome-extensions 2.0.0 → 2.2.0

package/README.md

@@ -12,7 +12,7 @@
 
 ESLint rules for Chrome extensions.
 
-<img src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-chrome-extensions/0b5e3e49/assets/images/screenshots/vs-code/squiggles.png">
+<img src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-chrome-extensions/04d2f53b22/assets/images/screenshots/vs-code/squiggles.png">
 
 ---
 
@@ -41,27 +41,25 @@ import json from '@eslint/json'
 export default [
     // other configs
     {
-        files: ['extension/**/*.js'],
+        files: ['**/extension/**/*.js'],
         plugins: { 'chrome-extensions': chromeExtensions },
         rules: {
             ...chromeExtensions.configs.recommended.rules,
-            'chrome-extensions/no-insecure-messaging': 'off',  // selectively disable rule
-            'chrome-extensions/no-deprecated-apis': ['error', { target: 'mv3' }]  // selectively tweak rule
+            'chrome-extensions/no-deprecated-apis': 'off'  // selectively disable rule
         }
     },
     {
-        files: ['extension/manifest.json'], language: 'json/json',
+        files: ['**/manifest.json'], language: 'json/json',
         plugins: { 'chrome-extensions': chromeExtensions, json },
         rules: {
             ...chromeExtensions.configs.manifest.rules,
-            'chrome-extensions/require-mv3': 'off',  // selectively disable rule
             'chrome-extensions/valid-version-field': ['error', { versionType: 'date' }]  // selectively tweak rule
         }
     }
 ]
 ```
 
-Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `manifest`
+Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `security`, `manifest`
 
 **Note:** Rule config is either a severity string (`'off'`, `'warn'`, `'error'`) or an array `[severity, options]` when the rule accepts options.
 
@@ -74,6 +72,8 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 
 <h3 id="manifest-key-order">
     <code>manifest-key-order</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
     <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
         <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Doesn't prevent bugs" href="#manifest-key-order">
@@ -89,7 +89,7 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 
 <summary>Enforces a preferred order for manifest keys.</summary>
 
-#### Options
+<h4 id="manifest-key-order-options">Options</h4>
 
 - `order` (default `[]`) – manifest keys in custom order (e.g. `['name', 'manifest_version']`) to selectively override built-in order with
 
@@ -99,8 +99,8 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
   /* eslint chrome-extensions/manifest-key-order: ['error', { order: ['name', 'manifest_version'] }] */
   
   {
-    "manifest_version": 3,
-!   "name": "My Extension",
+!   "manifest_version": 3,
+    "name": "My Extension",
     "version": "1.0.0"
   }
 ```
@@ -129,11 +129,102 @@ If you don't care about the order of manifest keys.
 #### See also
 
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`valid-mv3-schema`](#valid-mv3-schema)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="manifest-spacing">
+    <code>manifest-spacing</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
+        <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
+    <a title="Doesn't prevent bugs" href="#manifest-spacing">
+        <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23manifest-spacing">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Enforces consistent indentation and spacing in <code>manifest.json</code>.</summary>
+
+<h4 id="manifest-spacing-options">Options</h4>
+
+- `spaces` (default `2`) – number of spaces per indent level
+- `checkColons` (default `true`) – enforce 0 spaces before and 1 space after `:` in key/value pairs
+- `checkCommas` (default `true`) – enforce 0 spaces before and 1 space after `,` in inline objects
+- `checkBraces` (default `true`) – enforce 1 space after `{` and before `}` in inline objects
+- `checkBrackets` (default `true`) – enforce 0 spaces after `[` and before `]` in inline arrays
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  /* eslint chrome-extensions/manifest-spacing: ['error', { spaces: 2 }] */
+  
+  {
+!     "manifest_version": 3,
+!   "version" :       "1.0.0",
+!   "permissions": [  "tabs","cookies" ],
+!   "icons": {"16": "icon16.png"},
+    "name": "My Extension"
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  /* eslint chrome-extensions/manifest-spacing: ['error', { spaces: 2 }] */
+  
+  {
+-     "manifest_version": 3,
++   "manifest_version": 3,
+-   "version" :       "1.0.0",
++   "version": "1.0.0",
+-   "permissions": [  "tabs","cookies" ],
++   "permissions": ["tabs", "cookies"],
+-   "icons": {"16": "icon16.png"},
++   "icons": { "16": "icon16.png" },
+    "name": "My Extension"
+  }
+```
+
+#### When not to use it
+
+If you don't care about visual consistency in your manifest.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.2.0">v2.2.0</a> (October 12, 2026)
+
+#### See also
+
+- [`manifest-key-order`](#manifest-key-order)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
+    <a title="Doesn't prevent bugs" href="#manifest-key-order"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#manifest-key-order-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- [`no-duplicate-manifest-keys`](#no-duplicate-manifest-keys)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -180,12 +271,12 @@ If you intentionally interact w/ host page styles.
 
 #### See also
 
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts">Chrome for Developers — Content scripts</a>
-- <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM">MDN — Using shadow DOM</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts">Chrome for Developers — Content scripts</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM">MDN — Using shadow DOM</a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -208,7 +299,7 @@ If you intentionally interact w/ host page styles.
 
 <summary>Disallows deprecated <code>chrome</code> API calls.</summary>
 
-#### Options
+<h4 id="no-deprecated-apis-options">Options</h4>
 
 - `target` (default `'mv3'`) – Chrome extension manifest version whose deprecations to validate against (`'mv3'`, `'mv2'`)
 - `allowedAPIs` (default `[]`) – additional deprecated API namespaces to allow, as a single string or array
@@ -246,11 +337,131 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 
 #### See also
 
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api">Chrome for Developers — API reference</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api">Chrome for Developers — API reference</a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-duplicate-manifest-keys">
+    <code>no-duplicate-manifest-keys</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-duplicate-manifest-keys">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Disallows duplicate keys in <code>manifest.json</code>.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+!   "name": "Foo",
+!   "name": "Bar",
+!   "version": "1.0.0",
+!   "version": "2.0.0"
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+-   "name": "Foo",
+-   "name": "Bar",
+    "name": "My Extension",
+-   "version": "1.0.0",
+-   "version": "2.0.0"
+    "version": "1.0.0"
+  }
+```
+
+#### When not to use it
+
+If you rely on a Chromium fork resolving duplicate keys in a specific order.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- [`manifest-key-order`](#manifest-key-order)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
+    <a title="Doesn't prevent bugs" href="#manifest-key-order"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#manifest-key-order-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-insecure-fetch">
+    <code>no-insecure-fetch</code>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-insecure-fetch">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Flags <code>fetch()</code> and <code>XMLHttpRequest.open()</code> calls that use <code>http://</code>.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+! fetch('http://api.example.com/data')
+! xhr.open('GET', 'http://cdn.example.com/lib.js')
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+- fetch('http://api.example.com/data')
++ fetch('https://api.example.com/data')
+- xhr.open('GET', 'http://cdn.example.com/lib.js')
++ xhr.open('GET', 'https://cdn.example.com/lib.js')
+```
+
+#### When not to use it
+
+If you intentionally target HTTP endpoints.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/network-requests">Chrome for Developers — Cross-origin network requests</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -262,6 +473,10 @@ If you don't want deprecation validation at all. For individual deprecated APIs
     <code>no-insecure-messaging</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-insecure-messaging">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -269,7 +484,11 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 
 <details>
 
-<summary>Requires external message handlers validate <code>sender</code> + flags unfiltered <code>tabs.query()</code>.</summary>
+<summary>Requires sender/origin validation + filtered <code>tabs.query()</code> + explicit <code>window.postMessage()</code> target.</summary>
+
+<h4 id="no-insecure-messaging-options">Options</h4>
+
+- `disallowWildcardTarget` (default `true`) – flag <code>postMessage()</code> calls that use <code>'*'</code> as <code>targetOrigin</code>
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
@@ -278,9 +497,15 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 !     handle(msg)
   })
 
+  window.addEventListener('message', event => {
+!     handle(event.data)
+  })
+
 ! chrome.tabs.query({})
       .then(tabs => tabs.forEach(tab =>
           chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
+
+! window.postMessage(payload, '*')
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -291,15 +516,23 @@ If you don't want deprecation validation at all. For individual deprecated APIs
       handle(msg)
   })
 
+  window.addEventListener('message', event => {
++     if (event.origin != 'https://allowed-origin.com') return
+      handle(event.data)
+  })
+
 - chrome.tabs.query({})
 + chrome.tabs.query({ url: 'https://allowed-origin.com/*' })
       .then(tabs => tabs.forEach(tab =>
           chrome.tabs.sendMessage(tab.id, { action: 'ping' })))
+
+- window.postMessage(payload, '*')
++ window.postMessage(payload, 'https://allowed-origin.com')
 ```
 
 #### When not to use it
 
-If you trust every external caller and open tab.
+If you trust every external caller and open tab, or you intentionally broadcast to any origin.
 
 #### Introduced in
 
@@ -307,12 +540,13 @@ If you trust every external caller and open tab.
 
 #### See also
 
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#event-onMessageExternal">Chrome for Developers — `runtime.onMessageExternal`</a>
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/tabs#method-query">Chrome for Developers — `tabs.query()`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#event-onMessageExternal">Chrome for Developers — `runtime.onMessageExternal`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/tabs#method-query">Chrome for Developers — `tabs.query()`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns">MDN — `window.postMessage()` security concerns</a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -324,6 +558,8 @@ If you trust every external caller and open tab.
     <code>no-invalid-permissions</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -335,7 +571,7 @@ If you trust every external caller and open tab.
 
 <summary>Disallows invalid or unsupported manifest permission names.</summary>
 
-#### Options
+<h4 id="no-invalid-permissions-options">Options</h4>
 
 - `target` (default `'mv3'`) – Chrome manifest version whose permissions to validate against (`'mv3'`, `'mv2'`)
 - `allowedPermissions` (default `[]`) – additional permission names to allow beyond the built-in list, as a single string or array
@@ -375,11 +611,13 @@ If you don't want permission validation at all. For custom permissions from a Ch
 #### See also
 
 - [`no-missing-permissions`](#no-missing-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
 - [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -438,11 +676,78 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 #### See also
 
 - [`no-invalid-permissions`](#no-invalid-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-invalid-permissions-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 - [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-missing-web-accessible-resources">
+    <code>no-missing-web-accessible-resources</code>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-missing-web-accessible-resources">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Flags <code>chrome.runtime.getURL()</code> paths missing from <code>web_accessible_resources</code>.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  // manifest.json
+  {
+    "manifest_version": 3,
+!   "web_accessible_resources": []
+  }
+
+  // content.js
+! img.src = chrome.runtime.getURL('logo.png')
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  // manifest.json
+  {
+    "manifest_version": 3,
+-   "web_accessible_resources": []
++   "web_accessible_resources": [{ "resources": ["logo.png"], "matches": ["<all_urls>"] }]
+  }
+
+  // content.js
+  img.src = chrome.runtime.getURL('logo.png')
+```
+
+#### When not to use it
+
+If your paths are built at runtime.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">Chrome for Developers — `web_accessible_resources`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#method-getURL">Chrome for Developers — `runtime.getURL()`</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -454,6 +759,8 @@ If you use APIs through aliases or wrappers that obscure the original call site.
     <code>no-remote-code</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -465,7 +772,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 
 <summary>Disallows remote or dynamically-evaluated code (blocked by MV3's CSP at runtime).</summary>
 
-#### Options
+<h4 id="no-remote-code-options">Options</h4>
 
 - `patterns` (default `['eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']`) – detection paths to enable, as a single string or array
 - `checkExecuteScriptClosures` (default `true`) – additionally flag <code>chrome.scripting.executeScript({ func })</code> bodies that capture outer-scope variables
@@ -492,6 +799,10 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 + chrome.scripting.executeScript({ target: { tabId }, func: doThing, args: [value] })
 ```
 
+#### When not to use it
+
+If you intentionally target forks w/ relaxed CSPs. For individual patterns you still need, prefer narrowing via `patterns` over disabling the rule.
+
 #### Introduced in
 
 <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v1.0.0">v1.0.0</a> (October 2, 2026)
@@ -499,11 +810,79 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 #### See also
 
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`valid-mv3-schema`](#valid-mv3-schema)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-unrestricted-host-permissions">
+    <code>no-unrestricted-host-permissions</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-unrestricted-host-permissions">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Disallows broad host permissions that grant access to every site.</summary>
+
+<h4 id="no-unrestricted-host-permissions-options">Options</h4>
+
+- `allowedPatterns` (default `[]`) – host patterns to explicitly allow (e.g. `['<all_urls>']`)
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+!   "host_permissions": ["<all_urls>"],
+!   "optional_host_permissions": ["*://*/*"]
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+-   "host_permissions": ["<all_urls>"],
++   "host_permissions": ["https://example.com/*", "https://*.trusted.com/*"],
+-   "optional_host_permissions": ["*://*/*"]
++   "optional_host_permissions": ["https://user-content.example.com/*"]
+  }
+```
+
+#### When not to use it
+
+If you legitimately need broad access (e.g. ad blockers or dev tools).
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">Chrome for Developers — Declare permissions</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">Chrome for Developers — Match patterns</a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -513,8 +892,8 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 
 <h3 id="no-unused-permissions">
     <code>no-unused-permissions</code>
-    <a title="Included in recommended + strict configs" href="#usage">
-        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-unused-permissions">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -560,11 +939,15 @@ If you access the granted API through an alias or computed property rather than
 #### See also
 
 - [`no-invalid-permissions`](#no-invalid-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-invalid-permissions-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 - [`no-missing-permissions`](#no-missing-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -576,6 +959,8 @@ If you access the granted API through an alias or computed property rather than
     <code>require-mv3</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23require-mv3">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -608,7 +993,7 @@ If you access the granted API through an alias or computed property rather than
 
 #### When not to use it
 
-If you intentionally target MV2 for a Chromium fork that still supports it.
+If you intentionally target MV2 for a browser that still supports it (e.g. Firefox).
 
 #### Introduced in
 
@@ -617,10 +1002,83 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 #### See also
 
 - [`valid-mv3-schema`](#valid-mv3-schema)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="valid-manifest-icons">
+    <code>valid-manifest-icons</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-manifest-icons">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Ensures manifest <code>icons</code> exist and use the recommended sizes.</summary>
+
+<h4 id="valid-manifest-icons-options">Options</h4>
+
+- `requireRecommendedSizes` (default `true`) – require all of `16`, `32`, `48`, `128`
+- `checkIconExists` (default `true`) – flag icon paths that don't resolve to an existing file
+- `noSVG` (default `true`) – flag SVG icon paths (unsupported by Chrome)
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+    "icons": {
+!     "48": "icon48.svg",
+      "256": "icon256.png"
+    }
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+    "icons": {
++     "16": "icon16.png",
++     "32": "icon32.png",
+-     "48": "icon48.svg",
++     "48": "icon48.png",
++     "128": "icon128.png",
+      "256": "icon256.png"
+    }
+  }
+```
+
+#### When not to use it
+
+If your icons are injected at build time, or you target browsers that support SVGs (e.g. Firefox).
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.1.0">v2.1.0</a> (October 5, 2026)
+
+#### See also
+
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/icons">Chrome for Developers — `icons`</a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -632,6 +1090,8 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
     <code>valid-mv3-schema</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-mv3-schema">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -670,7 +1130,7 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 
 #### When not to use it
 
-If you intentionally target MV2 for a Chromium fork that still supports it.
+If you intentionally target MV2 for a browser that still supports it (e.g. Firefox).
 
 #### Introduced in
 
@@ -679,11 +1139,15 @@ If you intentionally target MV2 for a Chromium fork that still supports it.
 #### See also
 
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`no-deprecated-apis`](#no-deprecated-apis)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-deprecated-apis-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -737,11 +1201,16 @@ If your background context isn't a service worker.
 #### See also
 
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`no-remote-code`](#no-remote-code)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-remote-code-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -753,6 +1222,8 @@ If your background context isn't a service worker.
     <code>valid-version-field</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -764,7 +1235,7 @@ If your background context isn't a service worker.
 
 <summary>Validates the manifest <code>version</code> field.</summary>
 
-#### Options
+<h4 id="valid-version-field-options">Options</h4>
 
 - `versionType` (default `'chrome'`) – version format to enforce (`'chrome'`, `'semver'`, `'date'`)
 - `allowFutureDate` (default `false`) – allow `version` dates later than the current date
@@ -775,7 +1246,6 @@ If your background context isn't a service worker.
 ```diff
   /* eslint chrome-extensions/valid-version-field: ['error', { versionType: 'date' }] */
   
-  // manifest.json
   {
     "manifest_version": 3,
 !   "version": "2026.1.111",
@@ -788,7 +1258,6 @@ If your background context isn't a service worker.
 ```diff
   /* eslint chrome-extensions/valid-version-field: ['error', { versionType: 'date' }] */
   
-  // manifest.json
   {
     "manifest_version": 3,
 -   "version": "2026.1.111",
@@ -807,11 +1276,11 @@ If you don't care about version format consistency, or your version is injected
 
 #### See also
 
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/version">Chrome for Developers — `version`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/version">Chrome for Developers — `version`</a>
 
 <div align="center">
 
-[Back to index ↑][epc-rules]
+[Back to index ↑][epce-rules]
 
 </div>
 
@@ -902,4 +1371,4 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 <!-- Links -->
 
-[epc-rules]: #supported-rules
+[epce-rules]: #supported-rules