npm - eslint-plugin-chrome-extensions - Versions diffs - 2.1.0 → 2.3.0 - Mend

eslint-plugin-chrome-extensions 2.1.0 → 2.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/README.md +153 -33
package/docs/LICENSE.md +1 -1
package/package.json +6 -8
package/src/data/apis.js +75 -23
package/src/data/deprecations.js +5 -5
package/src/data/manifest.js +23 -12
package/src/data/permissions.js +1 -1
package/src/index.js +6 -7
package/src/rules/manifest-key-order.js +0 -1
package/src/rules/manifest-spacing.js +167 -0
package/src/rules/no-missing-permissions.js +16 -3
package/src/rules/no-remote-code.js +0 -1
package/src/rules/no-unused-permissions.js +3 -1
package/src/rules/valid-mv3-schema.js +48 -18
package/src/rules/valid-service-worker.js +8 -3
package/src/utils.js +11 -14

package/README.md CHANGED Viewed

@@ -41,7 +41,7 @@ import json from '@eslint/json'
 export default [
     // other configs
     {
-        files: ['extension/**/*.js'],
+        files: ['**/extension/**/*.js'],
         plugins: { 'chrome-extensions': chromeExtensions },
         rules: {
             ...chromeExtensions.configs.recommended.rules,
@@ -49,7 +49,7 @@ export default [
         }
     },
     {
-        files: ['extension/manifest.json'], language: 'json/json',
+        files: ['**/manifest.json'], language: 'json/json',
         plugins: { 'chrome-extensions': chromeExtensions, json },
         rules: {
             ...chromeExtensions.configs.manifest.rules,
@@ -73,7 +73,7 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 <h3 id="manifest-key-order">
     <code>manifest-key-order</code>
     <a title="Only works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
     <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
         <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Doesn't prevent bugs" href="#manifest-key-order">
@@ -89,7 +89,7 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 <summary>Enforces a preferred order for manifest keys.</summary>
-#### Options
+<h4 id="manifest-key-order-options">Options</h4>
 - `order` (default `[]`) – manifest keys in custom order (e.g. `['name', 'manifest_version']`) to selectively override built-in order with
@@ -129,7 +129,98 @@ If you don't care about the order of manifest keys.
 #### See also
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`valid-mv3-schema`](#valid-mv3-schema)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+<div align="center">
+[Back to index ↑][epce-rules]
+</div>
+---
+</details>
+<h3 id="manifest-spacing">
+    <code>manifest-spacing</code>
+    <a title="Only works w/ 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
+        <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
+    <a title="Doesn't prevent bugs" href="#manifest-spacing">
+        <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23manifest-spacing">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+<details>
+<summary>Enforces consistent indentation and spacing in <code>manifest.json</code>.</summary>
+<h4 id="manifest-spacing-options">Options</h4>
+- `spaces` (default `2`) – number of spaces per indent level
+- `checkColons` (default `true`) – enforce 0 spaces before and 1 space after `:` in key/value pairs
+- `checkCommas` (default `true`) – enforce 0 spaces before and 1 space after `,` in inline objects
+- `checkBraces` (default `true`) – enforce 1 space after `{` and before `}` in inline objects
+- `checkBrackets` (default `true`) – enforce 0 spaces after `[` and before `]` in inline arrays
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+```diff
+  /* eslint chrome-extensions/manifest-spacing: ['error', { spaces: 2 }] */
+  {
+!     "manifest_version": 3,
+!   "version" :       "1.0.0",
+!   "permissions": [  "tabs","cookies" ],
+!   "icons": {"16": "icon16.png"},
+    "name": "My Extension"
+  }
+```
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+```diff
+  /* eslint chrome-extensions/manifest-spacing: ['error', { spaces: 2 }] */
+  {
+-     "manifest_version": 3,
++   "manifest_version": 3,
+-   "version" :       "1.0.0",
++   "version": "1.0.0",
+-   "permissions": [  "tabs","cookies" ],
++   "permissions": ["tabs", "cookies"],
+-   "icons": {"16": "icon16.png"},
++   "icons": { "16": "icon16.png" },
+    "name": "My Extension"
+  }
+```
+#### When not to use it
+If you don't care about visual consistency in your manifest.
+#### Introduced in
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.2.0">v2.2.0</a> (October 12, 2026)
+#### See also
+- [`manifest-key-order`](#manifest-key-order)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
+    <a title="Doesn't prevent bugs" href="#manifest-key-order"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#manifest-key-order-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- [`no-duplicate-manifest-keys`](#no-duplicate-manifest-keys)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
 <div align="center">
@@ -180,8 +271,8 @@ If you intentionally interact w/ host page styles.
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts">Chrome for Developers — Content scripts</a>
-- <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM">MDN — Using shadow DOM</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/content-scripts">Chrome for Developers — Content scripts</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM">MDN — Using shadow DOM</a>
 <div align="center">
@@ -208,7 +299,7 @@ If you intentionally interact w/ host page styles.
 <summary>Disallows deprecated <code>chrome</code> API calls.</summary>
-#### Options
+<h4 id="no-deprecated-apis-options">Options</h4>
 - `target` (default `'mv3'`) – Chrome extension manifest version whose deprecations to validate against (`'mv3'`, `'mv2'`)
 - `allowedAPIs` (default `[]`) – additional deprecated API namespaces to allow, as a single string or array
@@ -246,7 +337,7 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api">Chrome for Developers — API reference</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api">Chrome for Developers — API reference</a>
 <div align="center">
@@ -261,7 +352,7 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 <h3 id="no-duplicate-manifest-keys">
     <code>no-duplicate-manifest-keys</code>
     <a title="Only works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-duplicate-manifest-keys">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -308,7 +399,12 @@ If you rely on a Chromium fork resolving duplicate keys in a specific order.
 #### See also
 - [`manifest-key-order`](#manifest-key-order)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
+    <a title="Doesn't prevent bugs" href="#manifest-key-order"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#manifest-key-order-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 - [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
 <div align="center">
@@ -361,8 +457,7 @@ If you intentionally target HTTP endpoints.
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/network-requests">Chrome for Developers — Cross-origin network requests</a>
-- [`no-remote-code`](#no-remote-code)
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/network-requests">Chrome for Developers — Cross-origin network requests</a>
 <div align="center">
@@ -391,7 +486,7 @@ If you intentionally target HTTP endpoints.
 <summary>Requires sender/origin validation + filtered <code>tabs.query()</code> + explicit <code>window.postMessage()</code> target.</summary>
-#### Options
+<h4 id="no-insecure-messaging-options">Options</h4>
 - `disallowWildcardTarget` (default `true`) – flag <code>postMessage()</code> calls that use <code>'*'</code> as <code>targetOrigin</code>
@@ -445,9 +540,9 @@ If you trust every external caller and open tab, or you intentionally broadcast
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#event-onMessageExternal">Chrome for Developers — `runtime.onMessageExternal`</a>
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/tabs#method-query">Chrome for Developers — `tabs.query()`</a>
-- <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns">MDN — `window.postMessage()` security concerns</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#event-onMessageExternal">Chrome for Developers — `runtime.onMessageExternal`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/tabs#method-query">Chrome for Developers — `tabs.query()`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns">MDN — `window.postMessage()` security concerns</a>
 <div align="center">
@@ -464,7 +559,7 @@ If you trust every external caller and open tab, or you intentionally broadcast
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
@@ -476,7 +571,7 @@ If you trust every external caller and open tab, or you intentionally broadcast
 <summary>Disallows invalid or unsupported manifest permission names.</summary>
-#### Options
+<h4 id="no-invalid-permissions-options">Options</h4>
 - `target` (default `'mv3'`) – Chrome manifest version whose permissions to validate against (`'mv3'`, `'mv2'`)
 - `allowedPermissions` (default `[]`) – additional permission names to allow beyond the built-in list, as a single string or array
@@ -516,7 +611,9 @@ If you don't want permission validation at all. For custom permissions from a Ch
 #### See also
 - [`no-missing-permissions`](#no-missing-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
 - [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
 <div align="center">
@@ -579,7 +676,11 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 #### See also
 - [`no-invalid-permissions`](#no-invalid-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-invalid-permissions-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 - [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
 <div align="center">
@@ -641,8 +742,8 @@ If your paths are built at runtime.
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">Chrome for Developers — `web_accessible_resources`</a>
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#method-getURL">Chrome for Developers — `runtime.getURL()`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">Chrome for Developers — `web_accessible_resources`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/runtime#method-getURL">Chrome for Developers — `runtime.getURL()`</a>
 <div align="center">
@@ -671,7 +772,7 @@ If your paths are built at runtime.
 <summary>Disallows remote or dynamically-evaluated code (blocked by MV3's CSP at runtime).</summary>
-#### Options
+<h4 id="no-remote-code-options">Options</h4>
 - `patterns` (default `['eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']`) – detection paths to enable, as a single string or array
 - `checkExecuteScriptClosures` (default `true`) – additionally flag <code>chrome.scripting.executeScript({ func })</code> bodies that capture outer-scope variables
@@ -709,7 +810,11 @@ If you intentionally target forks w/ relaxed CSPs. For individual patterns you s
 #### See also
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`valid-mv3-schema`](#valid-mv3-schema)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 <div align="center">
@@ -724,7 +829,7 @@ If you intentionally target forks w/ relaxed CSPs. For individual patterns you s
 <h3 id="no-unrestricted-host-permissions">
     <code>no-unrestricted-host-permissions</code>
     <a title="Only works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
@@ -736,7 +841,7 @@ If you intentionally target forks w/ relaxed CSPs. For individual patterns you s
 <summary>Disallows broad host permissions that grant access to every site.</summary>
-#### Options
+<h4 id="no-unrestricted-host-permissions-options">Options</h4>
 - `allowedPatterns` (default `[]`) – host patterns to explicitly allow (e.g. `['<all_urls>']`)
@@ -772,8 +877,8 @@ If you legitimately need broad access (e.g. ad blockers or dev tools).
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">Chrome for Developers — Declare permissions</a>
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">Chrome for Developers — Match patterns</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">Chrome for Developers — Declare permissions</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">Chrome for Developers — Match patterns</a>
 <div align="center">
@@ -788,7 +893,7 @@ If you legitimately need broad access (e.g. ad blockers or dev tools).
 <h3 id="no-unused-permissions">
     <code>no-unused-permissions</code>
     <a title="Only works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-unused-permissions">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -834,7 +939,11 @@ If you access the granted API through an alias or computed property rather than
 #### See also
 - [`no-invalid-permissions`](#no-invalid-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-invalid-permissions-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 - [`no-missing-permissions`](#no-missing-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
 <div align="center">
@@ -851,7 +960,7 @@ If you access the granted API through an alias or computed property rather than
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23require-mv3">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -893,6 +1002,8 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
 #### See also
 - [`valid-mv3-schema`](#valid-mv3-schema)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 <div align="center">
@@ -907,7 +1018,7 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
 <h3 id="valid-manifest-icons">
     <code>valid-manifest-icons</code>
     <a title="Only works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
@@ -919,7 +1030,7 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
 <summary>Ensures manifest <code>icons</code> exist and use the recommended sizes.</summary>
-#### Options
+<h4 id="valid-manifest-icons-options">Options</h4>
 - `requireRecommendedSizes` (default `true`) – require all of `16`, `32`, `48`, `128`
 - `checkIconExists` (default `true`) – flag icon paths that don't resolve to an existing file
@@ -963,7 +1074,7 @@ If your icons are injected at build time, or you target browsers that support SV
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/icons">Chrome for Developers — `icons`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/icons">Chrome for Developers — `icons`</a>
 <div align="center">
@@ -980,7 +1091,7 @@ If your icons are injected at build time, or you target browsers that support SV
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-mv3-schema">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -1028,7 +1139,11 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
 #### See also
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`no-deprecated-apis`](#no-deprecated-apis)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-deprecated-apis-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 <div align="center">
@@ -1086,7 +1201,12 @@ If your background context isn't a service worker.
 #### See also
 - [`require-mv3`](#require-mv3)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works w/ 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
 - [`no-remote-code`](#no-remote-code)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-remote-code-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 <div align="center">
@@ -1103,7 +1223,7 @@ If your background context isn't a service worker.
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works w/ 'json/json' config block" href="#usage">
-        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-32fcee?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank"
@@ -1115,7 +1235,7 @@ If your background context isn't a service worker.
 <summary>Validates the manifest <code>version</code> field.</summary>
-#### Options
+<h4 id="valid-version-field-options">Options</h4>
 - `versionType` (default `'chrome'`) – version format to enforce (`'chrome'`, `'semver'`, `'date'`)
 - `allowFutureDate` (default `false`) – allow `version` dates later than the current date
@@ -1156,7 +1276,7 @@ If you don't care about version format consistency, or your version is injected
 #### See also
-- <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/version">Chrome for Developers — `version`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/version">Chrome for Developers — `version`</a>
 <div align="center">

package/docs/LICENSE.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # 🏛️ MIT License
-**Copyright © 2026 [Adam Lui](https://codeberg.org/adamlui).**
+**Copyright © 2026 [Adam Lui](https://codeberg.org/adamlui)**
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "ESLint rules for Chrome extensions",
   "type": "module",
   "engines": {
@@ -34,7 +34,6 @@
   ],
   "types": "src/index.d.ts",
   "scripts": {
-    "prepare": "husky",
     "lint": "eslint . --cache && yamllint .",
     "lint:all": "eslint . && yamllint .",
     "lint:fix": "eslint . --fix --cache && yamllint .",
@@ -58,17 +57,17 @@
     "chromium"
   ],
   "peerDependencies": {
-    "eslint": ">=9.6.0",
-    "@eslint/json": ">=0.1.0"
+    "@eslint/json": ">=0.1.0",
+    "eslint": ">=9.6.0"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
     "@eslint/js": "^10.0.1",
-    "@eslint/json": "^2.1.0",
-    "@eslint/markdown": "^8.0.3",
+    "@eslint/json": "^2.1.1",
+    "@eslint/markdown": "^7.5.1",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
-    "eslint-plugin-constructors": "^1.4.1",
+    "eslint-plugin-constructors": "^1.4.2",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.4.1",
@@ -77,7 +76,6 @@
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-regexp": "^3.3.1",
     "eslint-plugin-security": "^4.2.0",
-    "husky": "^9.1.7",
     "yamllint-js": "^0.2.4"
   },
   "dependencies": {

package/src/data/apis.js CHANGED Viewed

@@ -1,26 +1,3 @@
-export const deprecatedAPIs = new Map([
-    ['chrome.pageAction.show',             'chrome.action.enable'],
-    ['chrome.pageAction.hide',             'chrome.action.disable'],
-    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
-    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
-    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
-    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
-    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
-    ['chrome.browserAction',               'chrome.action'],
-    ['chrome.pageAction',                  'chrome.action'],
-    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
-    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
-    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
-    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
-    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
-    ['chrome.extension.connect',           'chrome.runtime.connect'],
-    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
-    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
-    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
-    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
-    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
-])
 export const apiPermissionMap = new Map([
     ['chrome.alarms',                'alarms'],
     ['chrome.bookmarks',             'bookmarks'],
@@ -33,6 +10,7 @@ export const apiPermissionMap = new Map([
     ['chrome.history',               'history'],
     ['chrome.idle',                  'idle'],
     ['chrome.management',            'management'],
+    ['chrome.menus',                 'menus'],
     ['chrome.notifications',         'notifications'],
     ['chrome.pageCapture',           'pageCapture'],
     ['chrome.privacy',               'privacy'],
@@ -41,13 +19,86 @@ export const apiPermissionMap = new Map([
     ['chrome.sessions',              'sessions'],
     ['chrome.storage',               'storage'],
     ['chrome.tabCapture',            'tabCapture'],
+    ['chrome.tabs.query',            'tabs'],
     ['chrome.topSites',              'topSites'],
     ['chrome.webRequest',            'webRequest']
 ])
+export const deprecatedAPIs = new Map([
+    ['chrome.pageAction.show',             'chrome.action.enable'],
+    ['chrome.pageAction.hide',             'chrome.action.disable'],
+    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
+    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
+    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
+    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
+    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
+    ['chrome.browserAction',               'chrome.action'],
+    ['chrome.pageAction',                  'chrome.action'],
+    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
+    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
+    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
+    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
+    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
+    ['chrome.extension.connect',           'chrome.runtime.connect'],
+    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
+    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
+    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
+    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
+    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
+])
 export const externalMessagingListeners =
     new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
+export const permlessAPIs = new Set([
+    // https://developer.chrome.com/docs/extensions/reference/api/management
+    'chrome.management.getPermissionWarningsByManifest',
+    'chrome.management.getSelf',
+    'chrome.management.uninstallSelf',
+    // https://developer.chrome.com/docs/extensions/reference/api/runtime
+    'chrome.runtime.connect',
+    'chrome.runtime.getManifest',
+    'chrome.runtime.getPlatformInfo',
+    'chrome.runtime.getURL',
+    'chrome.runtime.onBrowserUpdateAvailable', // eslint-disable-line no-secrets/no-secrets
+    'chrome.runtime.onConnect',
+    'chrome.runtime.onConnectExternal',
+    'chrome.runtime.onInstalled',
+    'chrome.runtime.onMessage',
+    'chrome.runtime.onMessageExternal',
+    'chrome.runtime.onStartup',
+    'chrome.runtime.onSuspend',
+    'chrome.runtime.onSuspendCanceled',
+    'chrome.runtime.onUpdateAvailable',
+    'chrome.runtime.openOptionsPage',
+    'chrome.runtime.reload',
+    'chrome.runtime.requestUpdateCheck',
+    'chrome.runtime.restart',
+    'chrome.runtime.restartAfterDelay',
+    'chrome.runtime.sendMessage',
+    'chrome.runtime.setUninstallURL',
+    // https://developer.chrome.com/docs/extensions/reference/api/tabs
+    'chrome.tabs.captureVisibleTab',
+    'chrome.tabs.connect',
+    'chrome.tabs.create',
+    'chrome.tabs.detectLanguage',
+    'chrome.tabs.discard',
+    'chrome.tabs.duplicate',
+    'chrome.tabs.executeScript',
+    'chrome.tabs.get',
+    'chrome.tabs.getCurrent',
+    'chrome.tabs.goBack',
+    'chrome.tabs.goForward',
+    'chrome.tabs.highlight',
+    'chrome.tabs.insertCSS',
+    'chrome.tabs.move',
+    'chrome.tabs.reload',
+    'chrome.tabs.remove',
+    'chrome.tabs.removeCSS',
+    'chrome.tabs.sendMessage',
+    'chrome.tabs.update'
+])
 export function findDeprecated(api) {
     for (const [deprecated, replacement] of deprecatedAPIs)
         if (api == deprecated || api.startsWith(`${deprecated}.`))
@@ -56,6 +107,7 @@ export function findDeprecated(api) {
 }
 export function findPermission(api) {
+    if (permlessAPIs.has(api)) return null
     for (const [prefix, permission] of apiPermissionMap)
         if (api == prefix || api.startsWith(`${prefix}.`))
             return permission

package/src/data/deprecations.js CHANGED Viewed

@@ -1,10 +1,10 @@
 // Delete a line to end support
-export const bundles = { // ruleId: [bundleName, note]
-    'no-invalid-permissions': ['recommended'],
-    'require-mv3':            ['recommended'],
-    'valid-mv3-schema':       ['recommended'],
-    'valid-version-field':    ['recommended']
+export const bundles = {
+    'no-invalid-permissions': ['recommended'], // 2026-10-5 announced future removal
+    'require-mv3':            ['recommended'], // 2026-10-5 announced future removal
+    'valid-mv3-schema':       ['recommended'], // 2026-10-5 announced future removal
+    'valid-version-field':    ['recommended']  // 2026-10-5 announced future removal
 }
 export default { bundles }

package/src/data/manifest.js CHANGED Viewed

@@ -3,6 +3,20 @@ import globals from 'globals'
 const serviceWorkerGlobals = new Set(Object.keys(globals.serviceworker || {}))
 export const domGlobals = new Set(Object.keys(globals.browser).filter(name => !serviceWorkerGlobals.has(name)))
+export const ffDataCollectionRequired = new Set([
+    'none', 'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo',
+    'locationInfo', 'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'websiteActivity',
+    'websiteContent'
+])
+export const ffDataCollectionOptional = new Set([
+    'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo', 'locationInfo',
+    'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'technicalAndInteraction', 'websiteActivity',
+    'websiteContent'
+])
+export const ffMV3bgKeys = new Set(['scripts', 'page'])
 export const forbiddenCSPdirectives = [
     `'unsafe-eval'`, `'unsafe-inline'`, `'unsafe-hashes'`, `'wasm-unsafe-eval'`, 'http://', 'https://']
@@ -11,19 +25,16 @@ export const manifestKeyOrder = [
     'manifest_version', 'name', 'version',
     // CWS-required
     'description', 'icons',
-    // optional (alphabetical, per docs)
-    'action', 'background', 'chrome_settings_overrides', 'chrome_url_overrides',
-    'commands', 'content_scripts', 'content_security_policy',
-    'cross_origin_embedder_policy', 'cross_origin_opener_policy',
-    'declarative_net_request', 'default_locale', 'devtools_page', 'export',
-    'externally_connectable', 'homepage_url', 'host_permissions', 'import',
-    'incognito', 'key', 'mime_types_handler', 'minimum_chrome_version',
-    'oauth2', 'omnibox', 'optional_host_permissions', 'optional_permissions',
-    'options_page', 'options_ui', 'permissions', 'requirements', 'sandbox',
-    'short_name', 'side_panel', 'storage', 'tts_engine', 'update_url',
-    'version_name', 'web_accessible_resources'
+    // optional
+    'action', 'author', 'background', 'browser_specific_settings', 'chrome_settings_overrides', 'chrome_url_overrides',
+    'commands', 'content_scripts', 'content_security_policy', 'cross_origin_embedder_policy',
+    'cross_origin_opener_policy', 'dark_theme', 'declarative_net_request', 'default_locale', 'developer',
+    'devtools_page', 'dictionaries', 'export', 'externally_connectable', 'homepage_url', 'host_permissions', 'import',
+    'incognito', 'key', 'mime_types_handler', 'minimum_chrome_version', 'oauth2', 'omnibox',
+    'optional_host_permissions', 'optional_permissions', 'options_page', 'options_ui', 'permissions',
+    'protocol_handlers', 'requirements', 'sandbox', 'short_name', 'sidebar_action', 'side_panel', 'storage', 'theme',
+    'theme_experiment', 'tts_engine', 'update_url', 'version_name', 'web_accessible_resources'
 ]
 export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 export const remoteCodePatterns = [

package/src/data/permissions.js CHANGED Viewed

@@ -16,7 +16,7 @@ export const validPermissions = new Set([
     'downloads', 'downloads.open', 'downloads.ui', 'enterprise.deviceAttributes', 'enterprise.hardwarePlatform',
     'enterprise.networkingAttributes', 'enterprise.platformKeys', 'favicon', 'fileBrowserHandler',
     'fileSystemProvider', 'fontSettings', 'gcm', 'geolocation', 'history', 'identity', 'identity.email', 'idle',
-    'loginState', 'management', 'nativeMessaging', 'notifications', 'offscreen', 'pageCapture', 'platformKeys',
+    'loginState', 'management', 'menus', 'nativeMessaging', 'notifications', 'offscreen', 'pageCapture', 'platformKeys',
     'power', 'printerProvider', 'printing', 'printingMetrics', 'privacy', 'processes', 'proxy', 'publicSuffix',
     'readingList', 'runtime', 'scripting', 'search', 'sessions', 'sidePanel', 'storage', 'system.cpu',
     'system.display', 'system.memory', 'system.storage', 'tabCapture', 'tabGroups', 'tabs', 'topSites', 'tts',

package/src/index.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { bundles as oldBundles } from './data/deprecations.js'
 import manifestKeyOrder from './rules/manifest-key-order.js'
+import manifestSpacing from './rules/manifest-spacing.js'
 import noContentStyleLeak from './rules/no-content-style-leak.js'
 import noDeprecatedAPIs from './rules/no-deprecated-apis.js'
 import noDuplicateManifestKeys from './rules/no-duplicate-manifest-keys.js'
@@ -18,11 +19,12 @@ import validMV3schema from './rules/valid-mv3-schema.js'
 import validServiceWorker from './rules/valid-service-worker.js'
 import validVersionField from './rules/valid-version-field.js'
-import { bundleRules, deprecatedFrom, initBundleDeprecation } from './utils.js'
+import { bundleRules, initBundleDeprecation } from './utils.js'
 const plugin = {
     rules: {
         'manifest-key-order': manifestKeyOrder,
+        'manifest-spacing': manifestSpacing,
         'no-content-style-leak': noContentStyleLeak,
         'no-deprecated-apis': noDeprecatedAPIs,
         'no-duplicate-manifest-keys': noDuplicateManifestKeys,
@@ -48,8 +50,7 @@ for (const [ruleId, rule] of Object.entries(plugin.rules))
 plugin.configs = {
     recommended: {
         plugins: { 'chrome-extensions': plugin },
-        rules: bundleRules(plugin.rules, rule => rule.meta.docs.recommended,
-            'chrome-extensions', deprecatedFrom(oldBundles, 'recommended'))
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.recommended, 'chrome-extensions')
     },
     strict: {
         plugins: { 'chrome-extensions': plugin },
@@ -61,13 +62,11 @@ plugin.configs = {
     },
     security: {
         plugins: { 'chrome-extensions': plugin },
-        rules: bundleRules(plugin.rules, rule => rule.meta.docs.security,
-            'chrome-extensions', deprecatedFrom(oldBundles, 'security'))
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.security, 'chrome-extensions')
     },
     manifest: {
         plugins: { 'chrome-extensions': plugin },
-        rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest,
-            'chrome-extensions', deprecatedFrom(oldBundles, 'manifest'))
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest, 'chrome-extensions')
     }
 }

package/src/rules/manifest-key-order.js CHANGED Viewed

@@ -1,5 +1,4 @@
 import { manifestKeyOrder } from '../data/manifest.js'
 import { getFilename } from '../utils.js'
 const re = { manifestFilename: /manifest\.json$/ }

package/src/rules/manifest-spacing.js ADDED Viewed

@@ -0,0 +1,167 @@
+import { getFilename } from '../utils.js'
+const re = { manifestFilename: /manifest\.json$/, leadingWhitespace: /^[ \t]+/ },
+      brackets = { open: new Set(['LBrace', 'LBracket']), close: new Set(['RBrace', 'RBracket']) }
+export default {
+    meta: {
+        type: 'layout',
+        docs: {
+            description: 'Enforces consistent indentation and spacing in `manifest.json`',
+            category: 'Stylistic Issues',
+            recommended: false,
+            manifest: true
+        },
+        fixable: 'whitespace',
+        schema: [{
+            type: 'object',
+            properties: {
+                spaces: {
+                    type: 'number',
+                    description: 'Number of spaces per indent level (default 2)'
+                },
+                checkColons: {
+                    type: 'boolean',
+                    description: 'Enforce no spaces before and 1 space after `:` in key/value pairs (default true)'
+                },
+                checkCommas: {
+                    type: 'boolean',
+                    description: 'Enforce no spaces before and 1 space after `,` in inline objects (default true)'
+                },
+                checkBraces: {
+                    type: 'boolean',
+                    description: 'Enforce 1 space after `{` and before `}` in inline objects (default true)'
+                },
+                checkBrackets: {
+                    type: 'boolean',
+                    description: 'Enforce no spaces after `[` or before `]` in inline arrays (default true)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ spaces: 2, checkColons: true, checkCommas: true,
+                           checkBraces: true, checkBrackets: true }],
+        messages: {
+            wrongIndent: 'Expected {{expected}} spaces of indentation (found {{found}}).',
+            tabFound: 'Expected spaces for indentation, found tabs.',
+            spaceBeforeColon: 'Expected no spaces before `:`.',
+            spaceAfterColon: 'Expected 1 space after `:`.',
+            spaceBeforeComma: 'Expected no spaces before `,`.',
+            spaceAfterComma: 'Expected 1 space after `,`.',
+            spaceAfterBrace: 'Expected 1 space after `{`.',
+            spaceBeforeBrace: 'Expected 1 space before `}`.',
+            spaceInEmptyBraces: 'Expected no spaces in empty `{}`.',
+            spaceAfterBracket: 'Expected no spaces after `[`.',
+            spaceBeforeBracket: 'Expected no spaces before `]`.'
+        }
+    },
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const opts = context.options[0] || {},
+              spaces = opts.spaces ?? 2,
+              checkColons = opts.checkColons ?? true,
+              checkCommas = opts.checkCommas ?? true,
+              checkBraces = opts.checkBraces ?? true,
+              checkBrackets = opts.checkBrackets ?? true
+        return {
+            'Document'(document) {
+                const sourceCode = context.sourceCode,
+                      text = sourceCode.getText(),
+                      lines = text.split('\n'),
+                      tokens = document.tokens || [],
+                      lineOffsets = [0]
+                for (const line of lines)
+                    lineOffsets.push(lineOffsets.at(-1) + line.length +1)
+                let depth = 0, lastLine = 0, prevToken = null
+                for (const token of tokens) { // check indentation
+                    const startLine = token.loc.start.line
+                    if (startLine != lastLine) {
+                        const indent = lines[startLine -1].match(re.leadingWhitespace)?.[0] || '',
+                              effectiveDepth = brackets.close.has(token.type) ? Math.max(0, depth -1) : depth,
+                              expected = ' '.repeat(effectiveDepth * spaces)
+                        if (indent != expected) {
+                            const lineStart = lineOffsets[startLine -1],
+                                  isTab = indent.includes('\t')
+                            context.report({
+                                loc: { line: startLine, column: 1 }, messageId: isTab ? 'tabFound' : 'wrongIndent',
+                                data: { expected: effectiveDepth * spaces, found: indent.length },
+                                fix(fixer) {
+                                    return fixer.replaceTextRange([lineStart, lineStart + indent.length], expected) }
+                            })
+                        }
+                        lastLine = startLine
+                    }
+                    const isOpen = brackets.open.has(token.type),
+                          isClose = brackets.close.has(token.type),
+                          wasOpen = prevToken && brackets.open.has(prevToken.type),
+                          wasClose = prevToken && brackets.close.has(prevToken.type),
+                          isSameLine = prevToken && prevToken.loc.end.line == token.loc.start.line,
+                          isContiguous = prevToken && prevToken.range[1] == token.range[0]
+                    if (isOpen && !(wasOpen && isSameLine)) depth += 1
+                    else if (isClose && !(wasClose && isContiguous)) depth -= 1
+                    prevToken = token
+                }
+                for (let t = 0 ; t < tokens.length ; t++) { // check inline spacing
+                    const token = tokens[t], // eslint-disable-line security/detect-object-injection
+                          type = token.type,
+                          prev = tokens[t -1], next = tokens[t +1]
+                    if (next) {
+                        const between = text.slice(token.range[1], next.range[0]),
+                              inline = !between.includes('\n'),
+                              isColon = type == 'Colon', isComma = type == 'Comma'
+                        if (checkColons && isColon && inline && between != ' ')
+                            context.report({
+                                loc: token.loc.end, messageId: 'spaceAfterColon',
+                                fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], ' ') }
+                            })
+                        if (checkCommas && isComma && inline && between != ' ')
+                            context.report({
+                                loc: token.loc.end, messageId: 'spaceAfterComma',
+                                fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], ' ') }
+                            })
+                        if (checkBraces && type == 'LBrace' && inline) {
+                            const empty = next.type == 'RBrace', want = empty ? '' : ' '
+                            if (between != want)
+                                context.report({
+                                    loc: token.loc.end,
+                                    messageId: empty ? 'spaceInEmptyBraces' : 'spaceAfterBrace',
+                                    fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], want) }
+                                })
+                        }
+                        if (checkBrackets && type == 'LBracket' && inline && between != '')
+                            context.report({
+                                loc: token.loc.end, messageId: 'spaceAfterBracket',
+                                fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], '') }
+                            })
+                    }
+                    if (prev) {
+                        const between = text.slice(prev.range[1], token.range[0]),
+                              inline = !between.includes('\n'),
+                              isColon = type == 'Colon', isComma = type == 'Comma'
+                        if (checkColons && isColon && inline && between != '')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeColon',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], '') }
+                            })
+                        if (checkCommas && isComma && inline && between != '')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeComma',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], '') }
+                            })
+                        if (checkBraces && type == 'RBrace' && prev.type != 'LBrace' && inline && between != ' ')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeBrace',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], ' ') }
+                            })
+                        if (checkBrackets && type == 'RBracket' && prev.type != 'LBracket' && inline && between != '')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeBracket',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], '') }
+                            })
+                    }
+                }
+            }
+        }
+    }
+}

package/src/rules/no-missing-permissions.js CHANGED Viewed

@@ -1,5 +1,14 @@
 import { findPermission } from '../data/apis.js'
-import { readManifest, getMemberPath } from '../utils.js'
+import { getMemberPath, readManifest } from '../utils.js'
+function queriesActiveTab(node) {
+    const arg = node.arguments[0] ; if (arg?.type != 'ObjectExpression') return false
+    return arg.properties.some(prop => {
+        if (prop.type != 'Property') return false
+        const key = prop.key?.name ?? prop.key?.value
+        return key == 'active' && prop.value?.type == 'Literal' && prop.value.value === true
+    })
+}
 export default {
     meta: {
@@ -11,19 +20,23 @@ export default {
         },
         schema: [],
         messages: {
-            missingPermission: '`{{api}}` requires the "{{permission}}" manifest permission.'
+            missingPermission: '`{{api}}` requires the "{{permission}}" manifest permission.',
+            missingActiveTab: '`{{api}}` requires the "activeTab" manifest permission.'
         }
     },
     create(context) {
         const manifest = readManifest(context) ; if (!manifest) return {}
         const declared = new Set([...(manifest.permissions || []), ...(manifest.optional_permissions || [])])
+        if (declared.has('activeTab')) declared.add('tabs')
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
                 const api = getMemberPath(node.callee) ; if (!api) return
                 const permission = findPermission(api) ; if (!permission || declared.has(permission)) return
-                context.report({ node, messageId: 'missingPermission', data: { api, permission }})
+                const messageId = permission == 'tabs' && queriesActiveTab(node)
+                    ? 'missingActiveTab' : 'missingPermission'
+                context.report({ node, messageId, data: { api, permission }})
             }
         }
     }

package/src/rules/no-remote-code.js CHANGED Viewed

@@ -1,5 +1,4 @@
 import { remoteCodePatterns } from '../data/manifest.js'
 import { getMemberPath } from '../utils.js'
 const re = { url: /^https?:\/\// }

package/src/rules/no-unused-permissions.js CHANGED Viewed

@@ -1,6 +1,8 @@
+import { apiPermissionMap, findPermission } from '../data/apis.js'
 import fs from 'node:fs'
 import path from 'node:path'
-import { apiPermissionMap, findPermission } from '../data/apis.js'
 import { findExtensionRoot, getFilename, readManifest } from '../utils.js'
 const re = { manifestFilename: /manifest\.json$/ }

package/src/rules/valid-mv3-schema.js CHANGED Viewed

@@ -1,4 +1,5 @@
-import { mv2OnlyKeys, forbiddenCSPdirectives } from '../data/manifest.js'
+import { mv2OnlyKeys, forbiddenCSPdirectives, ffMV3bgKeys, ffDataCollectionRequired, ffDataCollectionOptional }
+    from '../data/manifest.js'
 import { getFilename, readManifest } from '../utils.js'
@@ -15,6 +16,7 @@ export default {
         },
         schema: [],
         messages: {
+            invalidDataCollectionValue: '`{{value}}` is not a valid data collection permission value for {{kind}}.',
             mv2Key: '`{{key}}` is not allowed in MV3. {{reason}}.',
             unsafeCSP: 'MV3 CSP must not include `{{directive}}`.',
             wrongCSPType: '`content_security_policy` must be an object in MV3, not a string.'
@@ -23,11 +25,11 @@ export default {
     create(context) {
         if (re.manifestFilename.test(getFilename(context))) { // lint it directly
-            const ancestors = [], pendingReports = []
-            let isMV3 = false
-            const keyOf = n => {
-                const k = n?.name || n?.key
-                return k?.value ?? k?.name
+            const ancestors = [], pendingReports = [], deferredMV2 = []
+            let isMV3 = false, isFF = false
+            function keyOf(node) {
+                const keyNode = node?.name || node?.key
+                return keyNode?.value ?? keyNode?.name
             }
             return {
                 '*'(node) {
@@ -36,18 +38,23 @@ export default {
                         const isTopLevel = ancestors.length == 2
                             && ancestors[0].type == 'Document'
                             && ancestors[1].type == 'Object'
-                        const inBackground = ancestors.some(a => keyOf(a) == 'background')
-                        const inCSP = ancestors.some(a => keyOf(a) == 'content_security_policy')
+                        const inBackground = ancestors.some(ancestor => keyOf(ancestor) == 'background')
+                        const inCSP = ancestors.some(ancestor => keyOf(ancestor) == 'content_security_policy')
+                        const inDataCollection = ancestors.some(ancestor =>
+                            keyOf(ancestor) == 'data_collection_permissions')
                         if (keyName == 'manifest_version' && node.value?.value == 3) isMV3 = true
+                        if (isTopLevel && keyName == 'browser_specific_settings') isFF = true
                         if (isTopLevel && mv2OnlyKeys.has(keyName))
                             pendingReports.push({ node, messageId: 'mv2Key',
                                 data: { key: keyName, reason: 'MV2-only key' }})
-                        if (inBackground && keyName == 'scripts')
-                            pendingReports.push({ node, messageId: 'mv2Key',
-                                data: { key: 'background.scripts', reason: 'use background.service_worker' }})
+                        if (inBackground && ffMV3bgKeys.has(keyName))
+                            deferredMV2.push({ node, messageId: 'mv2Key',
+                                data: { key: `background.${keyName}`,
+                                        reason: 'Use background.service_worker instead' }})
                         if (inBackground && keyName == 'persistent')
                             pendingReports.push({ node, messageId: 'mv2Key',
-                                data: { key: 'background.persistent', reason: 'MV3 service workers are never persistent' }})
+                                data: { key: 'background.persistent',
+                                        reason: 'MV3 service workers are never persistent' }})
                         if (isTopLevel && keyName == 'content_security_policy' && node.value?.type == 'String')
                             pendingReports.push({ node: node.value, messageId: 'wrongCSPType' })
                         if (inCSP && keyName == 'extension_pages' && typeof node.value?.value == 'string')
@@ -55,6 +62,17 @@ export default {
                                 if (node.value.value.includes(directive))
                                     pendingReports.push({ node: node.value, messageId: 'unsafeCSP',
                                         data: { directive }})
+                        if (inDataCollection && (keyName == 'required' || keyName == 'optional')
+                            && Array.isArray(node.value?.elements)
+                        ) for (const el of node.value.elements) {
+                            const value = typeof el.value == 'string' ? el.value : el.value?.value
+                            if (typeof value == 'string') {
+                                const set = keyName == 'required' ? ffDataCollectionRequired : ffDataCollectionOptional
+                                if (!set.has(value))
+                                    pendingReports.push({ node: el, messageId: 'invalidDataCollectionValue',
+                                        data: { value, kind: keyName }})
+                            }
+                        }
                     }
                     ancestors.push(node)
                 },
@@ -62,20 +80,23 @@ export default {
                     ancestors.pop()
                     if (node.type == 'Document') {
                         if (!isMV3) return
-                        for (const r of pendingReports) context.report(r)
+                        if (!isFF) pendingReports.push(...deferredMV2)
+                        for (const report of pendingReports) context.report(report)
                     }
                 }
             }
         }
         const manifest = readManifest(context) ; if (!manifest || manifest.manifest_version != 3) return {}
+        const isFF = manifest.browser_specific_settings != null
         return {
-            Program(node) {
+            Program(node) { /* eslint-disable security/detect-object-injection */
                 for (const key of Object.keys(manifest))
                     if (mv2OnlyKeys.has(key))
                         context.report({ node, messageId: 'mv2Key', data: { key, reason: 'MV2-only key' }})
-                if (manifest.background?.scripts)
-                    context.report({ node, messageId: 'mv2Key',
-                        data: { key: 'background.scripts', reason: 'use background.service_worker' }})
+                for (const key of ffMV3bgKeys)
+                    if (manifest.background?.[key] && !isFF)
+                        context.report({ node, messageId: 'mv2Key',
+                            data: { key: `background.${key}`, reason: 'Use background.service_worker instead' }})
                 if (manifest.background?.persistent != null)
                     context.report({ node, messageId: 'mv2Key',
                         data: { key: 'background.persistent', reason: 'MV3 service workers are never persistent' }})
@@ -87,7 +108,16 @@ export default {
                     for (const directive of forbiddenCSPdirectives)
                         if (cspPages.includes(directive))
                             context.report({ node, messageId: 'unsafeCSP', data: { directive }})
-            }
+                if (isFF) { // validate data collection permissions
+                    const dcp = manifest.browser_specific_settings?.gecko?.data_collection_permissions
+                    for (const [kind, set] of [['required', ffDataCollectionRequired], ['optional', ffDataCollectionOptional]])
+                        if (Array.isArray(dcp?.[kind]))
+                            for (const value of dcp[kind])
+                                if (!set.has(value))
+                                    context.report({ node, messageId: 'invalidDataCollectionValue',
+                                        data: { value, kind }})
+                }
+            } /* eslint-enable security/detect-object-injection */
         }
     }
 }

package/src/rules/valid-service-worker.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { domGlobals, serviceWorkerKeepaliveMinMS } from '../data/manifest.js'
-import { readManifest, isServiceWorkerFile, isInsideNestedFunction } from '../utils.js'
+import { isServiceWorkerFile, isInsideNestedFunction, readManifest } from '../utils.js'
 export default {
     meta: {
@@ -30,13 +30,18 @@ export default {
                     && node.arguments[1]?.type == 'Literal'
                     && typeof node.arguments[1].value == 'number'
                     && node.arguments[1].value < serviceWorkerKeepaliveMinMS
+                    && !isInsideNestedFunction(node)
                 ) context.report({ node, messageId: 'keepaliveTimer', data: { fn: node.callee.name }})
             },
             Identifier(node) {
                 if (node.parent?.type == 'MemberExpression' && node.parent.property === node) return
                 if (node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed) return
-                if (domGlobals.has(node.name))
-                    context.report({ node, messageId: 'domInSW', data: { global: node.name }})
+                if (!domGlobals.has(node.name)) return
+                for (let scope = context.sourceCode.getScope(node) ;
+                    scope && scope.type != 'global' ;
+                    scope = scope.upper
+                ) if (scope.set.has(node.name)) return // shadowed by a local binding
+                context.report({ node, messageId: 'domInSW', data: { global: node.name }})
             }
         }
     }

package/src/utils.js CHANGED Viewed

@@ -4,24 +4,21 @@ import path from 'node:path'
 const re = { chromeAPI: /\bchrome(?:\.\w+)+/g }, // eslint-disable-line security/detect-unsafe-regex
       manifestCache = new Map()
-export function bundleRules(rules, predicate, pluginName, removals = []) {
+export function bundleRules(rules, predicate, pluginName) {
     return Object.fromEntries(Object.entries(rules)
-        .filter(([ruleId, rule]) => predicate(rule) || removals.includes(ruleId))
+        .filter(([, rule]) => predicate(rule))
         .map(([ruleId]) => [`${pluginName}/${ruleId}`, 'error']))
 }
-export function deprecatedFrom(bundles, bundleName) {
-    const ruleIds = []
-    for (const [ruleId, [bundle]] of Object.entries(bundles))
-        if (bundle === bundleName) ruleIds.push(ruleId)
-    return ruleIds
-}
-export function initBundleDeprecation(plugin, [ruleId, [bundleName, note]], pluginName) {
-    if (!process.env.DEBUG_MODE) return
-    if (plugin.rules[ruleId]) // eslint-disable-line security/detect-object-injection
-        console.warn(`[${pluginName}] '${ruleId}' will be removed from '${
-            bundleName}' in a future major release${note ? ` (${note})` : ''}`)
+export function initBundleDeprecation(plugin, [ruleId, bundleNames], pluginName) {
+    for (const bundleName of bundleNames) {
+        /* eslint-disable security/detect-object-injection */
+        if (plugin.configs[bundleName])
+            plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
+        /* eslint-enable security/detect-object-injection */
+        if (process.env.DEBUG_MODE)
+            console.warn(`[${pluginName}] '${ruleId}' will be removed from '${bundleName}' in a future major release`)
+    }
 }
 export function findExtensionRoot(context) {