eslint-plugin-etc-misc 1.1.7 → 1.1.8

package/docs/rules/no-use-extend-native.md

@@ -2,20 +2,6 @@
 
 Disallow usage of non-native members on built-in JavaScript objects.
 
-## Why this rule is included here
-
-This rule was integrated into `eslint-plugin-etc-misc` to avoid requiring a separate single-rule plugin dependency.
-
-Original plugin source: [`eslint-plugin-no-use-extend-native`](https://github.com/dustinspecker/eslint-plugin-no-use-extend-native).
-
-## Rule details
-
-This rule helps prevent implicit reliance on monkey-patched native prototypes (for example from legacy libraries that add methods like `String.prototype.green`).
-
-Relying on extended native objects can make code unpredictable across runtimes, bundling targets, and dependency versions.
-
-This rule reports member usage on obvious built-in values when the accessed member is not part of the native API.
-
 ## Targeted pattern scope
 
 This rule is intentionally conservative and focuses on obvious built-in object shapes such as:
@@ -27,6 +13,16 @@ This rule is intentionally conservative and focuses on obvious built-in object s
 
 It does **not** attempt full-flow inference for arbitrary identifiers.
 
+## What this rule reports
+
+This rule helps prevent implicit reliance on monkey-patched native prototypes (for example from legacy libraries that add methods like `String.prototype.green`).
+
+This rule reports member usage on obvious built-in values when the accessed member is not part of the native API.
+
+## Why this rule exists
+
+Relying on extended native objects can make code unpredictable across runtimes, bundling targets, and dependency versions.
+
 ## ❌ Incorrect
 
 ```ts
@@ -55,11 +51,11 @@ const value = [].map((entry) => entry);
 const value = String.prototype.toLowerCase.call("ABC");
 ```
 
-## Options
+## Behavior and migration notes
 
 This rule has no options.
 
-## Relationship to ESLint `no-extend-native`
+### Relationship to ESLint `no-extend-native`
 
 - ESLint core [`no-extend-native`](https://eslint.org/docs/latest/rules/no-extend-native) prevents adding properties to native prototypes.
 - This rule prevents consuming non-native members when they appear in code.
@@ -69,15 +65,7 @@ Using both rules together gives better protection:
 1. Prevent introducing prototype extension.
 2. Prevent relying on prototype extension from third-party code.
 
-## When not to use it
-
-- If your project intentionally and explicitly relies on controlled prototype extension.
-- If your runtime environment guarantees specific prototype patches and that dependency is accepted in your architecture.
-
-## Further reading
-
-- [ESLint `no-extend-native`](https://eslint.org/docs/latest/rules/no-extend-native)
-- [MDN: Inheritance and the prototype chain](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Inheritance_and_the_prototype_chain)
+Original plugin source: [`eslint-plugin-no-use-extend-native`](https://github.com/dustinspecker/eslint-plugin-no-use-extend-native).
 
 ## ESLint flat config example
 
@@ -93,3 +81,13 @@ export default [
  },
 ];
 ```
+
+## When not to use it
+
+- If your project intentionally and explicitly relies on controlled prototype extension.
+- If your runtime environment guarantees specific prototype patches and that dependency is accepted in your architecture.
+
+## Further reading
+
+- [ESLint `no-extend-native`](https://eslint.org/docs/latest/rules/no-extend-native)
+- [MDN: Inheritance and the prototype chain](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Inheritance_and_the_prototype_chain)

package/docs/rules/no-vulnerable.md

@@ -2,28 +2,24 @@
 
 Disallow regular expressions that are potentially vulnerable to ReDoS (Regular Expression Denial of Service).
 
-## Why this rule is included here
+## Targeted pattern scope
 
-This rule was integrated into `eslint-plugin-etc-misc` to avoid requiring a separate single-rule plugin dependency.
+This rule checks:
 
-Original plugin source: [`eslint-plugin-redos-detector`](https://github.com/tjenkinson/eslint-plugin-redos-detector).
+- `/(...)/flags` literals.
+- `RegExp("...")` and `new RegExp("...", "flags")` when both arguments are statically-known strings.
+
+This rule intentionally skips dynamic patterns/flags it cannot resolve safely at lint time.
 
-## Rule details
+## What this rule reports
 
 This rule analyzes regular expression literals and statically-resolvable `RegExp(...)` constructor calls using [`recheck`](https://www.npmjs.com/package/recheck).
 
-Catastrophic backtracking can make an application spend excessive CPU time on crafted inputs. In server contexts, that can become an availability issue.
-
 This rule reports patterns that `recheck` identifies as vulnerable with polynomial or exponential complexity.
 
-## What this rule checks
-
-This rule checks:
-
-- `/(...)/flags` literals.
-- `RegExp("...")` and `new RegExp("...", "flags")` when both arguments are statically-known strings.
+## Why this rule exists
 
-This rule intentionally skips dynamic patterns/flags it cannot resolve safely at lint time.
+Catastrophic backtracking can make an application spend excessive CPU time on crafted inputs. In server contexts, that can become an availability issue.
 
 ## ❌ Incorrect
 
@@ -50,7 +46,7 @@ const source = getPatternFromConfig();
 const maybeUnsafe = RegExp(source); // Dynamic value: intentionally not analyzed.
 ```
 
-## Options
+## Behavior and migration notes
 
 ```ts
 type Options = [
@@ -94,17 +90,7 @@ For example, to allow polynomial but still report exponential:
 }
 ```
 
-## When not to use it
-
-- If your codebase never handles untrusted input with regexes.
-- If lint-time regex analysis cost is unacceptable for your workflow.
-- If you prefer running ReDoS scanning as a separate CI security step rather than as an ESLint rule.
-
-## Further reading
-
-- [OWASP: Regular expression Denial of Service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
-- [`recheck` package](https://www.npmjs.com/package/recheck)
-- [MDN: Regular expressions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions)
+Original plugin source: [`eslint-plugin-redos-detector`](https://github.com/tjenkinson/eslint-plugin-redos-detector).
 
 ## ESLint flat config example
 
@@ -120,3 +106,15 @@ export default [
  },
 ];
 ```
+
+## When not to use it
+
+- If your codebase never handles untrusted input with regexes.
+- If lint-time regex analysis cost is unacceptable for your workflow.
+- If you prefer running ReDoS scanning as a separate CI security step rather than as an ESLint rule.
+
+## Further reading
+
+- [OWASP: Regular expression Denial of Service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
+- [`recheck` package](https://www.npmjs.com/package/recheck)
+- [MDN: Regular expressions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions)

package/package.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://www.schemastore.org/package.json",
     "name": "eslint-plugin-etc-misc",
-    "version": "1.1.7",
+    "version": "1.1.8",
     "private": false,
     "description": "ESLint Plugin combining eslint-plugin-etc and eslint-plugin-misc!",
     "keywords": [
@@ -239,8 +239,8 @@
         "cross-env": "^10.1.0",
         "detect-secrets": "^1.0.6",
         "esbuild": "^0.28.0",
-        "eslint": "^10.3.0",
-        "eslint-config-nick2bad4u": "^1.0.16",
+        "eslint": "^10.5.0",
+        "eslint-config-nick2bad4u": "^2.0.4",
         "eslint-formatter-unix": "^9.0.1",
         "fast-check": "^4.8.0",
         "git-cliff": "^2.13.1",
@@ -283,10 +283,10 @@
         "yamllint-js": "^0.2.4"
     },
     "peerDependencies": {
-        "eslint": "^9.0.0 || ^10.3.0",
+        "eslint": "^9.0.0 || ^10.5.0",
         "typescript": ">=5.0.0"
     },
-    "packageManager": "npm@11.14.1",
+    "packageManager": "npm@11.18.0",
     "engines": {
         "node": ">=20.19.0"
     },