eslint-plugin-chrome-extensions 2.7.0 → 2.8.0

package/README.md

@@ -8,8 +8,8 @@
     <img alt="[License: MIT]" src="https://img.shields.io/badge/License-MIT-f1f20a.svg?logo=internetarchive&logoColor=white&labelColor=464646&style=for-the-badge"></a>
 <a target="_blank" href="https://getnpmstats.com/?package=eslint-plugin-chrome-extensions&range=last-year&interval=monthly">
     <img src="https://img.shields.io/npm/dm/eslint-plugin-chrome-extensions?style=for-the-badge&logo=npm&color=black"></a>
-<a target="_blank" href="https://eslint.org/">
-    <img alt="[Requires ESLint >=9.6.0]" src="https://img.shields.io/badge/Requires-ESLint_%3E%3D9.6.0-4B32C3?style=for-the-badge&logo=eslint"></a>
+<a href="#usage">
+    <img alt="[Supports ESLint >=9.6.0 / Oxlint >=1.65.0]" src="https://img.shields.io/badge/Supports-ESLint_%3E%3D9.6.0_%2F_Oxlint_%3E%3D1.65.0-4B32C3?style=for-the-badge&logo=eslint"></a>
 <br><br>
 
 ESLint rules for Chrome extensions.
@@ -33,6 +33,8 @@ npm i -D eslint-plugin-chrome-extensions
     Usage
 </h2>
 
+### ESLint
+
 Add bundled configs to your `eslint.config.*js` for each file type you need:
 
 ```js
@@ -46,31 +48,55 @@ export default [
         plugins: { 'chrome-extensions': chromeExtensions },
         rules: {
             ...chromeExtensions.configs.recommended.rules,
-            'chrome-extensions/no-deprecated-apis': 'off'  // selectively disable rule
-        }
-    },
-    {
-        files: ['**/manifest.json'], ...chromeExtensions.configs.manifest,
-        rules: {
-            ...chromeExtensions.configs.manifest.rules,
-            'chrome-extensions/manifest-spacing': ['warn', { spaces: 4 }]  // selectively tweak rule
+            'chrome-extensions/no-deprecated-apis': 'off',  // selectively disable rule
+            'chrome-extensions/valid-version-field': ['error', { versionType: 'date' }]  // selectively tweak rule
         }
     },
-    { files: ['**/*LICENSE*'],            ...chromeExtensions.configs.license },
-    { files: ['**/extension/**/*.css'],   ...chromeExtensions.configs.css     },
-    { files: ['**/extension/**/*.html'],  ...chromeExtensions.configs.html    },
-    { files: ['**/extension/**/*.json'],  ...chromeExtensions.configs.json    },
-    { files: ['**/extension/**/*.json5'], ...chromeExtensions.configs.json5   },
-    { files: ['**/extension/**/*.jsonc'], ...chromeExtensions.configs.jsonc   }
+    { files: ['**/*LICENSE*'],            ...chromeExtensions.configs.license  },
+    { files: ['**/manifest.json'],        ...chromeExtensions.configs.manifest },
+    { files: ['**/extension/**/*.css'],   ...chromeExtensions.configs.css      },
+    { files: ['**/extension/**/*.html'],  ...chromeExtensions.configs.html     },
+    { files: ['**/extension/**/*.json'],  ...chromeExtensions.configs.json     },
+    { files: ['**/extension/**/*.json5'], ...chromeExtensions.configs.json5    },
+    { files: ['**/extension/**/*.jsonc'], ...chromeExtensions.configs.jsonc    }
 ]
 ```
 
-Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `security`, `manifest`, `license`, `css`, `html`, `json`, `json5`, `jsonc`
+### Oxlint
+
+Add a JS bundle to your `oxlint.config.ts` (non-JS parsing unsupported by Oxlint):
+
+```ts
+...
+import chromeExtensions from 'eslint-plugin-chrome-extensions'
+
+export default defineConfig({
+    // main config
+    overrides: [
+        // other overrides
+        {
+            files: ['**/extension/**/*.{cjs,js,jsx,mjs,ts,tsx}'],
+            jsPlugins: ['eslint-plugin-chrome-extensions'],
+            rules: {
+                ...chromeExtensions.configs.recommended.rules,
+                'chrome-extensions/no-deprecated-apis': 'off',  // selectively disable rule
+                'chrome-extensions/no-insecure-messaging': ['error', { disallowWildcardTarget: false }]  // selectively tweak rule
+            }
+        }
+    ]
+})
+```
 
 **Note:** Rule config is either a severity string (`'off'`, `'warn'`, `'error'`) or an array `[severity, options]` when the rule accepts options.
 
 ---
 
+*Available JS bundles:* `recommended`, `strict` (everything), `problem` (deterministic bugs only), `security`
+
+*Available filetype bundles (ESLint only):* `manifest`, `license`, `css`, `html`, `json`, `json5`, `jsonc`
+
+---
+
 <h2 id="supported-rules">
     <img height=30 width=27 align="top" src="https://api.iconify.design/mdi/format-list-checks.svg?color=%232b2b2a">
     Supported rules
@@ -78,8 +104,6 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 
 <h3 id="css-spacing">
     <code>css-spacing</code>
-    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.7.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Only works in 'css/css' config block" href="#usage">
         <img height=18 alt="[CSS only]" src="https://img.shields.io/badge/CSS_only-dcd6f7?style=flat-square" align="middle"></a>
     <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
@@ -506,8 +530,6 @@ If you rely on a Chromium fork resolving duplicate keys in a specific order.
 
 <h3 id="no-global-keyframes">
     <code>no-global-keyframes</code>
-    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.7.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Only works in 'css/css' config block" href="#usage">
         <img height=18 alt="[CSS only]" src="https://img.shields.io/badge/CSS_only-dcd6f7?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
@@ -568,10 +590,155 @@ If your CSS is scoped inside a Shadow DOM root.
 
 </details>
 
+<h3 id="no-inline-event-handlers">
+    <code>no-inline-event-handlers</code>
+    <a title="Introduced in latest minor release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0">
+        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
+    <a title="Only works in 'html/html' config block" href="#usage">
+        <img height=18 alt="[HTML only]" src="https://img.shields.io/badge/HTML_only-a8d8ea?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-inline-event-handlers">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Disallows inline event handlers (e.g. <code>onclick</code>, <code>onload</code>) in HTML (blocked by MV3's <code>script-src 'self'</code> at runtime).</summary>
+
+<h4 id="no-inline-event-handlers-options">Options</h4>
+
+- `allowedAttributes` (default `[]`) – inline event handler attributes to permit (e.g. `['onafterprint']`), as a single string or array <a title="Introduced in v2.8.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0"><img height=14 alt="[Since v2.8.0]" src="https://img.shields.io/badge/since-v2.8.0-8a9199?style=flat-square" align="middle"></a>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+! <button onclick="alert('hi')">Click</button>
+! <body onload="init()">
+! <img src="logo.png" onerror="this.hidden = true">
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+- <button onclick="alert('hi')">Click</button>
++ <button id="myButton">Click</button>
+- <body onload="init()">
++ <body>
+- <img src="logo.png" onerror="this.hidden = true">
++ <img src="logo.png" id="logo">
+
+  // popup.js
++ document.getElementById('myButton').addEventListener('click', () => alert('hi'))
++ document.addEventListener('DOMContentLoaded', init)
++ document.getElementById('logo').addEventListener('error', event => event.target.hidden = true)
+```
+
+#### When not to use it
+
+If your HTML is a <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/sandbox">sandbox page</a> (where the CSP is intentionally relaxed). For individual handlers you still need, prefer `allowedAttributes` over disabling the rule.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0">v2.8.0</a> (October 20, 2026)
+
+#### See also
+
+- [`no-inline-scripts`](#no-inline-scripts)
+    <a title="Only works in 'html/html' config block" href="#usage"><img height=14 alt="[HTML only]" src="https://img.shields.io/badge/HTML_only-a8d8ea?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-inline-scripts-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- [`no-remote-code`](#no-remote-code)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-remote-code-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy">Chrome for Developers — `content_security_policy`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src">MDN — CSP `script-src`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener">MDN — `addEventListener()`</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-inline-scripts">
+    <code>no-inline-scripts</code>
+    <a title="Introduced in latest minor release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0">
+        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
+    <a title="Only works in 'html/html' config block" href="#usage">
+        <img height=18 alt="[HTML only]" src="https://img.shields.io/badge/HTML_only-a8d8ea?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-inline-scripts">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Disallows inline <code>&lt;script&gt;</code> bodies and remote <code>&lt;script src&gt;</code> in HTML (blocked by MV3's <code>script-src 'self'</code> at runtime).</summary>
+
+<h4 id="no-inline-scripts-options">Options</h4>
+
+- `allowedSrcPrefixes` (default `['chrome-extension://']`) – additional `src` prefixes to permit, as a single string or array <a title="Introduced in v2.8.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0"><img height=14 alt="[Since v2.8.0]" src="https://img.shields.io/badge/since-v2.8.0-8a9199?style=flat-square" align="middle"></a>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+! <script>alert('hi')</script>
+! <script src="https://cdn.example.com/lib.js"></script>
+! <script src="//cdn.example.com/lib.js"></script>
+! <script src="data:text/javascript;base64,YWxlcnQoMSk="></script>
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+- <script>alert('hi')</script>
++ <script src="popup.js"></script>
+- <script src="https://cdn.example.com/lib.js"></script>
++ <script src="./vendor/lib.js"></script>
+- <script src="//cdn.example.com/lib.js"></script>
++ <script type="module" src="popup.js"></script>
+- <script src="data:text/javascript;base64,YWxlcnQoMSk="></script>
++ <script src="chrome-extension://abc123/popup.js"></script>
+```
+
+#### When not to use it
+
+If your HTML is a <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/sandbox">sandbox page</a> (where the CSP is intentionally relaxed).
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0">v2.8.0</a> (October 20, 2026)
+
+#### See also
+
+- [`no-remote-code`](#no-remote-code)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-remote-code-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy">Chrome for Developers — `content_security_policy`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src">MDN — CSP `script-src`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/script">MDN — `<script>` element</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
 <h3 id="no-host-page-selectors">
     <code>no-host-page-selectors</code>
-    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.7.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Only works in 'css/css' config block" href="#usage">
         <img height=18 alt="[CSS only]" src="https://img.shields.io/badge/CSS_only-dcd6f7?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
@@ -681,7 +848,10 @@ If you intentionally target HTTP endpoints.
 
 #### See also
 
+- <img height=12 src="https://www.google.com/s2/favicons?domain=rfc-editor.org&sz=64">&ensp;<a target="_blank" href="https://www.rfc-editor.org/info/rfc9110/">RFC 9110 — HTTP Semantics</a>
 - <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/network-requests">Chrome for Developers — Cross-origin network requests</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/open">MDN — `XMLHttpRequest.open()`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch">MDN — `fetch()`</a>
 
 <div align="center">
 
@@ -929,8 +1099,6 @@ If you don't want permission validation at all. For custom permissions from a Ch
 
 <h3 id="no-missing-default-locale">
     <code>no-missing-default-locale</code>
-    <a title="JS support + new option added in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.6.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
@@ -1257,7 +1425,7 @@ If your paths are built at runtime.
 
 <h4 id="no-remote-code-options">Options</h4>
 
-- `patterns` (default `['eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']`) – detection paths to enable, as a single string or array <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v1.0.0"><img height=14 alt="[Since v1.0.0]" src="https://img.shields.io/badge/since-v1.0.0-8a9199?style=flat-square&labelColor=464646" align="middle"></a>
+- `patterns` (default `['dynamic-import', 'eval', 'execute-script-url', 'inline-event-handler', 'inline-script-body', 'new-function', 'remote-script-src', 'string-timer']`) – detection paths to enable, as a single string or array <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v1.0.0"><img height=14 alt="[Since v1.0.0]" src="https://img.shields.io/badge/since-v1.0.0-8a9199?style=flat-square&labelColor=464646" align="middle"></a>
 - `checkExecuteScriptClosures` (default `true`) – additionally flag <code>chrome.scripting.executeScript({ func })</code> bodies that capture outer-scope variables <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v1.0.0"><img height=14 alt="[Since v1.0.0]" src="https://img.shields.io/badge/since-v1.0.0-8a9199?style=flat-square&labelColor=464646" align="middle"></a>
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
@@ -1306,10 +1474,76 @@ If you intentionally target forks w/ relaxed CSPs. For individual patterns you s
 
 </details>
 
+<h3 id="no-remote-objects">
+    <code>no-remote-objects</code>
+    <a title="Introduced in latest minor release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0">
+        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
+    <a title="Only works in 'html/html' config block" href="#usage">
+        <img height=18 alt="[HTML only]" src="https://img.shields.io/badge/HTML_only-a8d8ea?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-remote-objects">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Disallows remote <code>&lt;object data&gt;</code> and <code>&lt;embed src&gt;</code> in HTML (blocked by MV3's <code>object-src 'self'</code> at runtime).</summary>
+
+<h4 id="no-remote-objects-options">Options</h4>
+
+- `allowedPrefixes` (default `['chrome-extension://']`) – additional URL prefixes to permit, as a single string or array <a title="Introduced in v2.8.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0"><img height=14 alt="[Since v2.8.0]" src="https://img.shields.io/badge/since-v2.8.0-8a9199?style=flat-square" align="middle"></a>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+! <object data="https://cdn.example.com/report.pdf"></object>
+! <embed src="http://cdn.example.com/game.swf">
+! <object data="//cdn.example.com/chart.svg"></object>
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+- <object data="https://cdn.example.com/report.pdf"></object>
++ <object data="report.pdf"></object>
+- <embed src="http://cdn.example.com/game.swf">
++ <embed src="./vendor/game.swf">
+- <object data="//cdn.example.com/chart.svg"></object>
++ <object data="chrome-extension://abc123/chart.svg"></object>
+```
+
+#### When not to use it
+
+If your HTML is a <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/sandbox">sandbox page</a> (where the CSP is intentionally relaxed).
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.8.0">v2.8.0</a> (October 20, 2026)
+
+#### See also
+
+- [`no-inline-scripts`](#no-inline-scripts)
+    <a title="Only works in 'html/html' config block" href="#usage"><img height=14 alt="[HTML only]" src="https://img.shields.io/badge/HTML_only-a8d8ea?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-inline-scripts-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy">Chrome for Developers — `content_security_policy`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/object-src">MDN — CSP `object-src`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/object">MDN — `<object>` element</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/embed">MDN — `<embed>` element</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
 <h3 id="no-remote-urls">
     <code>no-remote-urls</code>
-    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.7.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Only works in 'css/css' config block" href="#usage">
         <img height=18 alt="[CSS only]" src="https://img.shields.io/badge/CSS_only-dcd6f7?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
@@ -1386,8 +1620,6 @@ If you intentionally reference remote stylesheets, fonts, or images (e.g. Google
 
 <h3 id="no-scrollbar-styling">
     <code>no-scrollbar-styling</code>
-    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.7.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Only works in 'css/css' config block" href="#usage">
         <img height=18 alt="[CSS only]" src="https://img.shields.io/badge/CSS_only-dcd6f7?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
@@ -1530,8 +1762,6 @@ If you legitimately require sensitive permissions, or prefer manual security rev
 
 <h3 id="no-unrestricted-host-permissions">
     <code>no-unrestricted-host-permissions</code>
-    <a title="JS support added in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.6.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Included in security config" href="#usage">
@@ -1675,8 +1905,6 @@ If your i18n keys are referenced dynamically.
     <code>no-unused-permissions</code>
     <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v1.0.0">
         <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
-    <a title="JS support added in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.6.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
@@ -1755,14 +1983,13 @@ If you access the granted API through an alias or computed property rather than
 
 <summary>Requires a license file.</summary>
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect directory structure
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect dir structure
 
 ```diff
   /extension/manifest.json
-!
 ```
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct directory structure
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct dir structure
 
 ```diff
   /extension/manifest.json
@@ -2081,8 +2308,6 @@ If your license is injected at build time, or you use one w/ no existing SPDX id
 
 <h3 id="valid-manifest-icons">
     <code>valid-manifest-icons</code>
-    <a title="JS support added in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.6.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
@@ -2300,8 +2525,6 @@ If your background context isn't a service worker.
 
 <h3 id="valid-url-fields">
     <code>valid-url-fields</code>
-    <a title="JS support added in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/releases/tag/v2.6.0">
-        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
@@ -2467,8 +2690,8 @@ If you don't care about version format consistency, or your version is injected
 
 ## <img height=30 width=27 align="top" src="https://api.iconify.design/ic/baseline-account-balance.svg?color=%232b2b2a"> License
 
-<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/src/branch/main/docs/LICENSE.md">
-    <img height=80 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
+<a href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/src/branch/main/docs/LICENSE.md">
+    <img height=88 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-chrome-extensions/d79e1db7e2/assets/images/banners/mit-license/banner.png"></a>
 <br><br>
 
 <details>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "ESLint rules for Chrome extensions",
   "keywords": [
     "eslint",
@@ -53,10 +53,10 @@
     "bump:major": "bash utils/bump.sh major",
     "bump:minor": "bash utils/bump.sh minor",
     "bump:patch": "bash utils/bump.sh patch",
-    "demo": "node demo/run.js",
+    "demo": "eslint demo",
     "lint": "pre-commit run",
     "lint:all": "pre-commit run --all-files",
-    "test": "node tests/run.js"
+    "test": "node tests/run"
   },
   "dependencies": {
     "globals": "^17.13.0",
@@ -65,14 +65,13 @@
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
-    "@eslint/css": "^2.0.0",
-    "@eslint/js": "^10.0.1",
+    "@eslint/css": "^2.0.1",
     "@eslint/json": "^2.1.1",
     "@eslint/markdown": "^7.5.1",
     "@html-eslint/eslint-plugin": "^0.67.0",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.12.0",
-    "eslint-plugin-constructors": "^1.4.3",
+    "eslint": "^10.13.0",
+    "eslint-plugin-constructors": "^1.5.0",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.4.1",
@@ -82,7 +81,9 @@
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-regexp": "^3.3.1",
     "eslint-plugin-security": "^4.2.0",
-    "eslint-plugin-woodpecker": "^1.0.0"
+    "eslint-plugin-sonarjs": "^4.2.2",
+    "eslint-plugin-woodpecker": "^1.1.0",
+    "oxlint": "^1.89.0"
   },
   "peerDependencies": {
     "@eslint/css": ">=0.5.0",