eslint-plugin-greasemonkey 1.3.0 → 1.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-greasemonkey",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "ESLint rules for Greasemonkey/Tampermonkey userscripts",
   "type": "module",
   "engines": {
@@ -35,10 +35,10 @@
   "types": "src/index.d.ts",
   "scripts": {
     "prepare": "husky",
-    "lint": "eslint . --cache",
-    "lint:all": "eslint .",
-    "lint:fix": "eslint . --fix --cache",
-    "lint:fix-all": "eslint . --fix",
+    "lint": "eslint . --cache && yamllint .",
+    "lint:all": "eslint . && yamllint .",
+    "lint:fix": "eslint . --fix --cache && yamllint .",
+    "lint:fix-all": "eslint . --fix && yamllint .",
     "test": "node tests/run.js",
     "demo": "node demo/run.js",
     "bump:patch": "bash utils/bump.sh patch",
@@ -69,7 +69,7 @@
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.10.0",
-    "eslint-plugin-constructors": "^1.1.1",
+    "eslint-plugin-constructors": "^1.2.0",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.3.0",
@@ -79,6 +79,7 @@
     "eslint-plugin-regexp": "^3.3.0",
     "eslint-plugin-security": "^4.0.1",
     "globals": "^17.12.0",
-    "husky": "^9.1.7"
+    "husky": "^9.1.7",
+    "yamllint-js": "^0.2.4"
   }
 }

package/src/{apis.js → data/apis.js}

@@ -8,9 +8,10 @@ export const gmLegacyAPIs = new Set([ /* eslint-disable no-secrets/no-secrets */
 
 export const gmModernAPIs = new Set([
     'GM.addElement', 'GM.addStyle', 'GM.addValueChangeListener', 'GM.deleteValue', 'GM.download',
-    'GM.getResourceText', 'GM.getResourceUrl', 'GM.getValue', 'GM.info', 'GM.listValues', 'GM.log',
-    'GM.notification', 'GM.openInTab', 'GM.registerMenuCommand', 'GM.removeValueChangeListener',
-    'GM.setClipboard', 'GM.setValue', 'GM.unregisterMenuCommand', 'GM.xmlHttpRequest'
+    'GM.getResourceText', 'GM.getResourceUrl', 'GM.getTab', 'GM.getTabs', 'GM.getValue', 'GM.getValues',
+    'GM.info', 'GM.listValues', 'GM.log', 'GM.notification', 'GM.openInTab', 'GM.registerMenuCommand',
+    'GM.removeValueChangeListener', 'GM.saveTab', 'GM.setClipboard', 'GM.setValue', 'GM.setValues',
+    'GM.unregisterMenuCommand', 'GM.webRequest', 'GM.xmlHttpRequest'
 ])
 
 export const scAPIs = new Set([
@@ -18,3 +19,18 @@ export const scAPIs = new Set([
     'CAT.agent.opfs', 'CAT.agent.skills', 'CAT.agent.task',
     'CAT_fileStorage', 'CAT_scriptLoaded', 'CAT_userConfig'
 ])
+
+const tmAPIs = new Set([
+    'GM_getTab', 'GM_getTabs', 'GM_saveTab', 'GM_webRequest',
+    'GM.getTab', 'GM.getTabs', 'GM.saveTab', 'GM.webRequest'
+])
+
+export const allAPIs = new Set([...gmLegacyAPIs, ...gmModernAPIs, ...scAPIs])
+
+export function supportsAPI({ manager, api }) {
+    return !allAPIs.has(api) ? false
+         : api.startsWith('CAT') ? manager == 'scriptcat'
+         : tmAPIs.has(api) ? manager == 'tampermonkey'
+         : true
+
+}

package/src/data/deprecations.js

@@ -0,0 +1,3 @@
+export default { // val = replacement
+    rules: { 'require-meta-newline': 'require-blank-line-after-meta-block' } // 2026-9-13
+}

package/src/data/headers.js

@@ -0,0 +1,29 @@
+export const universalHeaders = new Set([
+    'antifeature', 'author', 'compatible', 'connect', 'contributionAmount', 'contributionURL', 'copyright',
+    'defaulticon', 'description', 'downloadURL', 'exclude', 'exclude-match', 'grant', 'homepage', 'homepageURL',
+    'icon', 'icon64', 'include', 'license', 'match', 'name', 'namespace', 'noframes', 'require', 'resource',
+    'run-at', 'source', 'supportURL', 'unwrap', 'updateURL', 'version', 'website'
+])
+
+export const managerHeaders = new Map([
+    ['inject-into',     ['violentmonkey']],
+    ['top-level-await', ['violentmonkey']],
+    ['user-agent',      ['tampermonkey']],
+    ['run-in',          ['tampermonkey']],
+    ['sandbox',         ['tampermonkey']],
+    ['webRequest',      ['tampermonkey']],
+    ['nocompat',        ['tampermonkey']]
+])
+
+export const localizedHeaders = ['name', 'description', 'antifeature']
+export const managers = ['tampermonkey', 'violentmonkey', 'greasemonkey']
+export const validHeaders = new Map()
+
+validHeaders.set('all', new Set([...universalHeaders, ...managerHeaders.keys()]))
+
+for (const manager of managers) {
+    const specific = [...managerHeaders]
+        .filter(([, supportedBy]) => supportedBy.includes(manager))
+        .map(([header]) => header)
+    validHeaders.set(manager, new Set([...universalHeaders, ...specific]))
+}

package/src/index.js

@@ -1,14 +1,20 @@
+import aliases from './data/deprecations.js'
+
+import metaOrder from './rules/meta-order.js'
 import metaSpacing from './rules/meta-spacing.js'
 import noDuplicateKeys from './rules/no-duplicate-keys.js'
+import noInvalidHeaders from './rules/no-invalid-headers.js'
 import noMissingGrants from './rules/no-missing-grants.js'
+import noMissingResources from './rules/no-missing-resources.js'
 import noUnusedGrants from './rules/no-unused-grants.js'
 import noUnusedResources from './rules/no-unused-resources.js'
 import preferMatch from './rules/prefer-match.js'
+import requireBlankLineAfterMetaBlock from './rules/require-blank-line-after-meta-block.js'
 import requireHomepagePair from './rules/require-homepage-pair.js'
 import requireMatchingLocalizedFields from './rules/require-matching-localized-fields.js'
-import requireMetaNewline from './rules/require-meta-newline.js'
 import requireRequiredFields from './rules/require-required-fields.js'
 import requireSpaceBeforeMetaKey from './rules/require-space-before-meta-key.js'
+import requireSRIhashing from './rules/require-sri-hashing.js'
 import requireUpdateDownloadPair from './rules/require-update-download-pair.js'
 import requireUserJsFilename from './rules/require-user-js-filename.js'
 import validFieldValues from './rules/valid-field-values.js'
@@ -16,17 +22,21 @@ import validGrants from './rules/valid-grants.js'
 
 const plugin = {
     rules: {
+        'meta-order': metaOrder,
         'meta-spacing': metaSpacing,
         'no-duplicate-keys': noDuplicateKeys,
+        'no-invalid-headers': noInvalidHeaders,
         'no-missing-grants': noMissingGrants,
         'no-unused-grants': noUnusedGrants,
+        'no-missing-resources': noMissingResources,
         'no-unused-resources': noUnusedResources,
         'prefer-match': preferMatch,
+        'require-blank-line-after-meta-block': requireBlankLineAfterMetaBlock,
         'require-homepage-pair': requireHomepagePair,
         'require-matching-localized-fields': requireMatchingLocalizedFields,
-        'require-meta-newline': requireMetaNewline,
         'require-required-fields': requireRequiredFields,
         'require-space-before-meta-key': requireSpaceBeforeMetaKey,
+        'require-sri-hashing': requireSRIhashing,
         'require-update-download-pair': requireUpdateDownloadPair,
         'require-user-js-filename': requireUserJsFilename,
         'valid-field-values': validFieldValues,
@@ -34,45 +44,59 @@ const plugin = {
     }
 }
 
+const docsURL = 'https://codeberg.org/adamlui/eslint-plugin-greasemonkey/#'
+for (const [ruleId, rule] of Object.entries(plugin.rules))
+    rule.meta.docs.url = docsURL + ruleId
+
+// Generate deprecated aliases
+for (const [oldName, newName] of Object.entries(aliases.rules)) { /* eslint-disable security/detect-object-injection */
+    const newRule = plugin.rules[newName]
+    plugin.rules[oldName] = {
+        ...newRule,
+        meta: {
+            ...newRule.meta,
+            docs: { ...newRule.meta.docs, recommended: false },
+            deprecated: { message: `Use \`${newName}\` instead.`, replacedBy: [{ rule: { name: newName }}] }
+        }
+    }
+} /* eslint-enable security/detect-object-injection */
+
 plugin.configs = {
     recommended: {
         plugins: { greasemonkey: plugin },
         rules: {
             'greasemonkey/meta-spacing': 'error',
             'greasemonkey/no-duplicate-keys': 'error',
+            'greasemonkey/no-invalid-headers': 'error',
             'greasemonkey/no-missing-grants': 'error',
             'greasemonkey/no-unused-grants': 'error',
+            'greasemonkey/no-missing-resources': 'error',
             'greasemonkey/no-unused-resources': 'error',
             'greasemonkey/prefer-match': 'error',
+            'greasemonkey/require-blank-line-after-meta-block': 'error',
             'greasemonkey/require-matching-localized-fields': 'error',
-            'greasemonkey/require-meta-newline': 'error',
             'greasemonkey/require-required-fields': 'error',
             'greasemonkey/require-space-before-meta-key': 'error',
             'greasemonkey/require-user-js-filename': 'error',
             'greasemonkey/valid-field-values': 'error',
             'greasemonkey/valid-grants': 'error'
         }
-    },
-    strict: {
+    }
+}
+
+plugin.configs.strict = {
+    plugins: { greasemonkey: plugin },
+    rules: Object.fromEntries(Object.keys(plugin.rules).map(ruleId => [`greasemonkey/${ruleId}`, 'error']))
+}
+
+for (const manager of ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat'])
+    plugin.configs[manager] = { // eslint-disable-line security/detect-object-injection
         plugins: { greasemonkey: plugin },
         rules: {
-            'greasemonkey/meta-spacing': 'error',
-            'greasemonkey/no-duplicate-keys': 'error',
-            'greasemonkey/no-missing-grants': 'error',
-            'greasemonkey/no-unused-grants': 'error',
-            'greasemonkey/no-unused-resources': 'error',
-            'greasemonkey/prefer-match': 'error',
-            'greasemonkey/require-homepage-pair': 'error',
-            'greasemonkey/require-matching-localized-fields': 'error',
-            'greasemonkey/require-meta-newline': 'error',
-            'greasemonkey/require-required-fields': 'error',
-            'greasemonkey/require-space-before-meta-key': 'error',
-            'greasemonkey/require-update-download-pair': 'error',
-            'greasemonkey/require-user-js-filename': 'error',
-            'greasemonkey/valid-field-values': 'error',
-            'greasemonkey/valid-grants': 'error'
+            ...plugin.configs.recommended.rules,
+            'greasemonkey/no-invalid-headers': ['error', { target: manager }],
+            'greasemonkey/valid-grants': ['error', { target: manager }]
         }
     }
-}
 
 export { plugin as default, plugin as greasemonkey }

package/src/rules/meta-order.js

@@ -0,0 +1,76 @@
+import { extractMetadata } from '../utils.js'
+
+const defaultOrder = [
+    'name', 'description', 'author', 'namespace', 'version', 'license', 'icon', 'icon64',
+    'compatible', 'match', 'exclude', 'include', 'connect', 'require', 'resource', 'grant',
+    'noframes', 'downloadURL', 'updateURL', 'homepageURL', 'supportURL', 'contributionURL'
+]
+
+function findViolation(entries, keys) {
+    const ranks = new Map(keys.map((key, index) => [key, index])),
+          known = entries.map(entry => {
+              const key = entry.key.split(':', 1)[0]
+              return { entry, key, rank: ranks.get(key) }
+          }).filter(item => item.rank !== undefined)
+    for (let i = 1; i < known.length; i++) // eslint-disable-next-line security/detect-object-injection
+        if (known[i - 1].rank > known[i].rank) return [known[i - 1], known[i]]
+}
+
+function sortEntries(entries, keys) {
+    const ranks = new Map(keys.map((key, index) => [key, index]))
+    return entries.toSorted((a, b) => {
+        const aRank = ranks.get(a.key.split(':', 1)[0]),
+              bRank = ranks.get(b.key.split(':', 1)[0])
+        return (aRank ?? Infinity) - (bRank ?? Infinity)
+    })
+}
+
+export default {
+    meta: {
+        type: 'layout',
+        docs: {
+            description: 'Enforce an order for metadata keys',
+            category: 'Stylistic Issues',
+            recommended: false
+        },
+        fixable: 'code',
+        schema: [{
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Metadata keys in preferred order; unspecified keys are ignored'
+        }],
+        defaultOptions: [[]],
+        messages: { wrongOrder: '@{{first}} should appear before @{{second}}' }
+    },
+
+    create(context) {
+        const custom = context.options[0] ?? [],
+              master = custom.length ? defaultOrder.filter(key => !custom.includes(key)) : defaultOrder
+        return {
+            Program() {
+                const sourceCode = context.sourceCode,
+                      entries = extractMetadata(sourceCode),
+                      violation = findViolation(entries, master) ?? (custom.length && findViolation(entries, custom))
+                if (!violation) return
+                const [first, second] = violation
+                const sorted = sortEntries(sortEntries(entries, master), custom)
+                const replacements = // eslint-disable-next-line security/detect-object-injection
+                    new Map(sorted.map((entry, idx) => [entries[idx], sourceCode.getText(entry.comment)]))
+                const start = entries[0].comment.range[0]
+                const end = entries.at(-1).comment.range[1]
+                let output = '', position = start
+                for (const entry of entries) {
+                    output += sourceCode.text.slice(position, entry.comment.range[0])
+                    output += replacements.get(entry)
+                    position = entry.comment.range[1]
+                }
+                output += sourceCode.text.slice(position, end)
+                context.report({
+                    node: second.entry.comment, messageId: 'wrongOrder',
+                    data: { first: second.key, second: first.key },
+                    fix(fixer) { return fixer.replaceTextRange([start, end], output) }
+                })
+            }
+        }
+    }
+}

package/src/rules/no-duplicate-keys.js

@@ -21,13 +21,13 @@ export default {
         return {
             Program() {
                 const metaEntries = extractMetadata(context.sourceCode),
-                      seen = new Set()
+                      seenEntries = new Set()
                 for (const entry of metaEntries) {
                     const baseKey = entry.key.split(':')[0]
                     if (!entry.key.includes(':') && multiValKeys.has(baseKey)) continue
-                    if (seen.has(entry.key))
+                    if (seenEntries.has(entry.key))
                         context.report({ node: entry.comment, messageId: 'dupeKey', data: { key: entry.key }})
-                    else seen.add(entry.key)
+                    else seenEntries.add(entry.key)
                 }
             }
         }

package/src/rules/no-invalid-headers.js

@@ -0,0 +1,79 @@
+import { extractMetadata } from '../utils.js'
+import { managerHeaders, managers, localizedHeaders, validHeaders } from '../data/headers.js'
+
+function parseAllowedPattern(entry) {
+    if (typeof entry != 'string' || !entry.startsWith('/')) return null
+    const lastSlash = entry.lastIndexOf('/')
+    if (lastSlash == 0) return null
+    try { /* eslint-disable-next-line security/detect-non-literal-regexp */
+        return new RegExp(entry.slice(1, lastSlash), entry.slice(lastSlash +1))
+    } catch { return null }
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow invalid metadata headers',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                target: {
+                    anyOf: [
+                        { type: 'string', enum: ['all', ...managers] },
+                        { type: 'array', items: { type: 'string', enum: managers }, minItems: 1, uniqueItems: true }
+                    ],
+                    description: 'Manager(s) whose headers to validate against (default: all)'
+                },
+                allowedHeaders: {
+                    anyOf: [{ type: 'string' }, { type: 'array' }, {}],
+                    description: 'Additional headers: string, RegExp, or array mixing both'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ allowedHeaders: [] }],
+        messages: {
+            invalidHeader: 'Invalid header: "@{{header}}"',
+            unsupportedHeader: '"@{{header}}" is not supported by {{target}} (only by {{supporting}})'
+        }
+    },
+
+    create(context) {
+        const options = context.options[0] || {},
+              rawTarget = options.target ?? 'all',
+              targets = Array.isArray(rawTarget) ? rawTarget : [rawTarget],
+              allowedList = [options.allowedHeaders ?? []].flat(),
+              allowedExact = new Set(),
+              allowedRegexes = [],
+              validSet = targets.includes('all') ? validHeaders.get('all')
+                       : new Set(targets.flatMap(target => [...validHeaders.get(target)]))
+        for (const entry of allowedList) {
+            if (entry instanceof RegExp) allowedRegexes.push(entry)
+            else if (typeof entry == 'string') {
+                const parsed = parseAllowedPattern(entry)
+                if (parsed) allowedRegexes.push(parsed)
+                else allowedExact.add(entry)
+            }
+        }
+        return {
+            Program() {
+                const metaEntries = extractMetadata(context.sourceCode)
+                for (const entry of metaEntries) {
+                    if (allowedExact.has(entry.key)) continue
+                    if (allowedRegexes.some(re => re.test(entry.key))) continue
+                    if (localizedHeaders.includes(entry.key.split(':')[0])) continue
+                    if (validSet.has(entry.key)) continue
+                    const supporting = managerHeaders.get(entry.key)
+                    if (supporting)
+                        context.report({ node: entry.comment, messageId: 'unsupportedHeader',
+                            data: { header: entry.key, target: targets.join(', '), supporting: supporting.join(', ') }})
+                    else context.report({ node: entry.comment, messageId: 'invalidHeader', data: { header: entry.key }})
+                }
+            }
+        }
+    }
+}

package/src/rules/no-missing-grants.js

@@ -1,5 +1,5 @@
 import { extractMetadata } from '../utils.js'
-import { gmLegacyAPIs, gmModernAPIs, scAPIs } from '../apis.js'
+import { gmLegacyAPIs, gmModernAPIs, scAPIs } from '../data/apis.js'
 
 const apis = new Set([...gmLegacyAPIs, ...gmModernAPIs, ...scAPIs]),
       grantlessAPIs = new Set(['GM_info', 'GM.info']) // always available, no grant required
@@ -22,8 +22,7 @@ export default {
         return {
             Identifier(node) { record(node.name, node) },
             MemberExpression(node) {
-                const path = []
-                let current = node
+                const path = [] ; let current = node
                 while (current.type == 'MemberExpression') {
                     if (current.property.type != 'Identifier') return
                     path.unshift(current.property.name)

package/src/rules/no-missing-resources.js

@@ -0,0 +1,61 @@
+import { extractMetadata, resolveTemplate } from '../utils.js'
+
+const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL']),
+      re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow @resource references without a matching declaration',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        schema: [],
+        messages: {
+            missingResource: 'Missing @resource: "{{name}}"',
+            noMatchingResource: 'No declared @resource matches `{{pattern}}`'
+        }
+    },
+
+    create(context) {
+        const usedRefs = []
+        function record(node, arg) {
+            if (arg?.type == 'Literal' && typeof arg.value == 'string')
+                usedRefs.push({ names: [arg.value], pattern: null, node })
+            else if (arg?.type == 'TemplateLiteral') {
+                const resolved = resolveTemplate(arg)
+                if (resolved) usedRefs.push({ names: resolved, pattern: null, node })
+                else usedRefs.push({
+                    names: null,
+                    pattern: new RegExp( // eslint-disable-line security/detect-non-literal-regexp
+                        `^${arg.quasis.map(q => q.value.raw.replace(re.specialChars, '\\$&')).join('.*')}$`),
+                    node
+                })
+            }
+        }
+        return {
+            CallExpression(node) {
+                if (!resourceGetterNames.has(node.callee.name)) return
+                record(node, node.arguments[0])
+            },
+            'Program:exit'() {
+                if (!usedRefs.length) return
+                const declared = new Set(
+                    extractMetadata(context.sourceCode)
+                        .filter(entry => entry.key == 'resource')
+                        .map(entry => entry.value.trim().split(re.whitespace)[0])
+                )
+                for (const ref of usedRefs) {
+                    if (ref.names) {
+                        for (const name of ref.names)
+                            if (!declared.has(name))
+                                context.report({ node: ref.node, messageId: 'missingResource', data: { name }})
+                    } else if (![...declared].some(name => ref.pattern.test(name)))
+                        context.report({ node: ref.node, messageId: 'noMatchingResource',
+                            data: { pattern: ref.pattern.source }})
+                }
+            }
+        }
+    }
+}

package/src/rules/{require-meta-newline.js → require-blank-line-after-meta-block.js}

@@ -1,16 +1,14 @@
-import { extractMetadata } from '../utils.js'
-
 export default {
     meta: {
         type: 'layout',
         docs: {
-            description: 'Require a newline between the metadata and code',
+            description: 'Require a blank line between the metadata and code',
             category: 'Stylistic Issues',
             recommended: true
         },
         fixable: 'whitespace',
         schema: [],
-        messages: { missingNewline: 'Missing blank line after metadata block' }
+        messages: { missingBlankLine: 'Missing blank line after metadata block' }
     },
 
     create(context) {
@@ -18,16 +16,14 @@ export default {
             Program() {
                 const sourceCode = context.sourceCode,
                       comments = sourceCode.getAllComments(),
-                      metaEntries = extractMetadata(sourceCode)
-                if (!metaEntries.length) return
-                const closingComment = comments.find(comment => comment.value.trim() == '==/UserScript==')
-                if (!closingComment) return
+                      hasOpening = comments.some(comment => comment.value.trim() == '==UserScript=='),
+                      closingComment = comments.find(comment => comment.value.trim() == '==/UserScript==')
+                if (!hasOpening || !closingComment) return
                 const tokenAfter = sourceCode.getTokenAfter(closingComment)
                 if (!tokenAfter) return
                 if (tokenAfter.loc.start.line - closingComment.loc.end.line < 2)
                     context.report({
-                        node: closingComment,
-                        messageId: 'missingNewline',
+                        node: closingComment, messageId: 'missingBlankLine',
                         fix(fixer) { return fixer.insertTextAfter(closingComment, '\n') }
                     })
             }

package/src/rules/require-homepage-pair.js

@@ -18,8 +18,8 @@ export default {
             Program() {
                 const metaEntries = extractMetadata(context.sourceCode),
                       homepageEntry = metaEntries.find(entry => entry.key == 'homepage'),
-                      homepageURLEntry = metaEntries.find(entry => entry.key == 'homepageURL')
-                if (homepageEntry && !homepageURLEntry)
+                      homepageURLentry = metaEntries.find(entry => entry.key == 'homepageURL')
+                if (homepageEntry && !homepageURLentry)
                     context.report({
                         node: homepageEntry.comment, messageId: 'missingPair',
                         data: { missing: 'homepageURL', present: 'homepage' },
@@ -28,13 +28,13 @@ export default {
                                 `\n// @homepageURL ${homepageEntry.value}`)
                         }
                     })
-                else if (homepageURLEntry && !homepageEntry)
+                else if (homepageURLentry && !homepageEntry)
                     context.report({
-                        node: homepageURLEntry.comment, messageId: 'missingPair',
+                        node: homepageURLentry.comment, messageId: 'missingPair',
                         data: { missing: 'homepage', present: 'homepageURL' },
                         fix(fixer) {
-                            return fixer.insertTextAfter(homepageURLEntry.comment,
-                                `\n// @homepage ${homepageURLEntry.value}`)
+                            return fixer.insertTextBefore(homepageURLentry.comment,
+                                `// @homepage ${homepageURLentry.value}\n`)
                         }
                     })
             }

package/src/rules/require-matching-localized-fields.js

@@ -12,9 +12,11 @@ export default {
             type: 'object',
             properties: {
                 ignoreLanguages: {
-                    type: 'array',
-                    items: { type: 'string' },
-                    description: 'Language codes to ignore (e.g. ["fr", "de"])'
+                    anyOf: [
+                        { type: 'string' },
+                        { type: 'array', items: { type: 'string' }, minItems: 1, uniqueItems: true }
+                    ],
+                    description: 'Language code(s) to ignore'
                 }
             },
             additionalProperties: false
@@ -25,7 +27,7 @@ export default {
 
     create(context) {
         const options = context.options[0] || {},
-              ignoreLanguages = options.ignoreLanguages || []
+              ignoreLanguages = [options.ignoreLanguages ?? []].flat()
         return {
             Program() {
                 const metaEntries = extractMetadata(context.sourceCode),

package/src/rules/require-sri-hashing.js

@@ -0,0 +1,57 @@
+import { extractMetadata } from '../utils.js'
+
+const re = { hashFragment: /#([^#]+)$/, sriHash: /^(sha1|sha256|sha384|sha512|md5)-([a-z0-9+/]+={0,2})$/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require SRI hashes on @require and @resource URLs',
+            category: 'Possible Errors',
+            recommended: false
+        },
+        schema: [{
+            type: 'object',
+            description: 'SRI hashing options',
+            properties: {
+                algorithm: {
+                    type: 'string',
+                    description: 'SRI hash algorithm to require',
+                    enum: ['md5', 'sha1', 'sha256', 'sha384', 'sha512']
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ algorithm: 'sha256' }],
+        messages: {
+            missingHash: 'Missing SRI hash for @{{key}}.',
+            invalidHash: 'Invalid SRI hash for @{{key}}.{{detected}} Expected {{expected}}.'
+        }
+    },
+
+    create(context) {
+        const algorithm = (context.options[0]?.algorithm || 'sha256').toLowerCase()
+        return {
+            'Program:exit'() {
+                for (const entry of extractMetadata(context.sourceCode)) {
+                    if (entry.key != 'require' && entry.key != 'resource') continue
+                    const hash = entry.value.trim().match(re.hashFragment)?.[1]
+                    if (!hash) {
+                        context.report({ node: entry.comment, messageId: 'missingHash', data: { key: entry.key } })
+                        continue
+                    }
+                    const match = hash.match(re.sriHash)
+                    if (!match || match[1].toLowerCase() != algorithm)
+                        context.report({
+                            node: entry.comment, messageId: 'invalidHash',
+                            data: {
+                                key: entry.key,
+                                detected: match ? ` Detected ${match[1].toLowerCase()};` : '',
+                                expected: algorithm
+                            }
+                        })
+                }
+            }
+        }
+    }
+}