eslint-plugin-greasemonkey 1.8.3 → 1.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (33) hide show
  1. package/README.md +400 -76
  2. package/docs/LICENSE.md +1 -1
  3. package/package.json +49 -45
  4. package/src/data/headers.js +24 -0
  5. package/src/index.d.ts +33 -3
  6. package/src/index.js +5 -80
  7. package/src/rules/meta-order.js +3 -4
  8. package/src/rules/meta-spacing.js +2 -2
  9. package/src/rules/no-duplicate-keys.js +2 -2
  10. package/src/rules/no-insecure-fetch.js +109 -0
  11. package/src/rules/no-insecure-messaging.js +68 -0
  12. package/src/rules/no-invalid-grants.js +3 -3
  13. package/src/rules/no-invalid-headers.js +3 -3
  14. package/src/rules/no-missing-grants.js +3 -3
  15. package/src/rules/no-missing-resources.js +4 -3
  16. package/src/rules/no-unused-grants.js +2 -2
  17. package/src/rules/no-unused-resources.js +6 -5
  18. package/src/rules/prefer-gm-add-style.js +66 -0
  19. package/src/rules/prefer-match.js +4 -3
  20. package/src/rules/require-homepage-pair.js +3 -4
  21. package/src/rules/require-matching-localized-fields.js +2 -2
  22. package/src/rules/require-required-fields.js +2 -2
  23. package/src/rules/require-space-before-meta-key.js +2 -2
  24. package/src/rules/require-sri-hashing.js +3 -3
  25. package/src/rules/require-update-download-pair.js +3 -4
  26. package/src/rules/require-user-js-filename.js +2 -2
  27. package/src/rules/valid-field-values.js +2 -2
  28. package/src/utils/deprecations.js +76 -0
  29. package/src/utils/init.js +91 -0
  30. package/src/utils/metadata.js +31 -0
  31. package/src/utils/rules.js +7 -0
  32. package/src/utils/template.js +21 -0
  33. package/src/utils.js +0 -119
package/README.md CHANGED
@@ -4,9 +4,9 @@
4
4
 
5
5
  <a target="_blank" href="https://www.npmjs.com/package/eslint-plugin-greasemonkey">
6
6
  <img alt="[Latest Build]" src="https://img.shields.io/npm/v/eslint-plugin-greasemonkey?logo=icinga&style=for-the-badge&label=Latest%20Build&color=32fcee"></a>
7
- <a href="#license">
7
+ <a href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/src/branch/main/docs/LICENSE.md">
8
8
  <img alt="[License: MIT]" src="https://img.shields.io/badge/License-MIT-f1f20a.svg?logo=internetarchive&logoColor=white&labelColor=464646&style=for-the-badge"></a>
9
- <a>
9
+ <a target="_blank" href="https://getnpmstats.com/?package=eslint-plugin-greasemonkey&range=last-year&interval=monthly">
10
10
  <img src="https://img.shields.io/npm/dm/eslint-plugin-greasemonkey?style=for-the-badge&logo=npm&color=black"></a>
11
11
  <a target="_blank" href="https://eslint.org/">
12
12
  <img alt="[Requires ESLint >=9.0.0]" src="https://img.shields.io/badge/Requires-ESLint_%3E%3D9.0.0-4B32C3?style=for-the-badge&logo=eslint"></a>
@@ -52,7 +52,7 @@ export default [
52
52
  ]
53
53
  ```
54
54
 
55
- Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `tampermonkey`, `violentmonkey`, `greasemonkey`, `scriptcat`, `adguard`
55
+ Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `security`, `tampermonkey`, `violentmonkey`, `greasemonkey`, `scriptcat`, `adguard`
56
56
 
57
57
  **Note:** Rule config is either a severity string (`'off'`, `'warn'`, `'error'`) or an array `[severity, options]` when the rule accepts options.
58
58
 
@@ -73,7 +73,7 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
73
73
  <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
74
74
  <a title="Accepts array w/ options" href="#usage">
75
75
  <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
76
- <a title="Copy rule URL" target="_blank"
76
+ <a title="Copy rule URL" target="_blank"
77
77
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23meta-order">
78
78
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
79
79
  </h3>
@@ -82,9 +82,9 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
82
82
 
83
83
  <summary>Enforces a preferred order for metadata keys.</summary>
84
84
 
85
- #### Options
85
+ <h4 id="meta-order-options">Options</h4>
86
86
 
87
- - `order` (default `[]`) – metadata keys in custom order (e.g. `['license', 'namespace']`) to selectively override built-in order with
87
+ - `order` (default `[]`) – metadata keys in custom order (e.g. `['license', 'namespace']`) to selectively override built-in order with – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.5.0">v1.5.0</a>]
88
88
 
89
89
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
90
90
 
@@ -125,7 +125,18 @@ If you don't care about the order of metadata fields.
125
125
  #### See also
126
126
 
127
127
  - [`meta-spacing`](#meta-spacing)
128
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
129
+ <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
130
+ <a title="Doesn't prevent bugs" href="#meta-spacing"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
131
+ <a title="Accepts array w/ options" href="#meta-spacing-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
128
132
  - [`no-invalid-headers`](#no-invalid-headers)
133
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
134
+ <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
135
+ <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
136
+ <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
137
+ <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
138
+ <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
139
+ <a title="Accepts array w/ options" href="#no-invalid-headers-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
129
140
 
130
141
  <div align="center">
131
142
 
@@ -139,6 +150,8 @@ If you don't care about the order of metadata fields.
139
150
 
140
151
  <h3 id="meta-spacing">
141
152
  <code>meta-spacing</code>
153
+ <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
154
+ <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
142
155
  <a title="Included in recommended config" href="#usage">
143
156
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
144
157
  <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
@@ -147,7 +160,7 @@ If you don't care about the order of metadata fields.
147
160
  <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
148
161
  <a title="Accepts array w/ options" href="#usage">
149
162
  <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
150
- <a title="Copy rule URL" target="_blank"
163
+ <a title="Copy rule URL" target="_blank"
151
164
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23meta-spacing">
152
165
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
153
166
  </h3>
@@ -156,15 +169,15 @@ If you don't care about the order of metadata fields.
156
169
 
157
170
  <summary>Aligns metadata values to the column after the longest key.</summary>
158
171
 
159
- #### Options
172
+ <h4 id="meta-spacing-options">Options</h4>
160
173
 
161
- - `spaces` (default `3`) – minimum spaces after the longest key
174
+ - `spaces` (default `3`) – minimum spaces after the longest key – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
162
175
 
163
176
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
164
177
 
165
178
  ```diff
166
179
  /* eslint greasemonkey/meta-spacing: ['error', { spaces: 1 }] */
167
-
180
+
168
181
  // ==UserScript==
169
182
  ! // @name My Script
170
183
  // @namespace example.com
@@ -176,7 +189,7 @@ If you don't care about the order of metadata fields.
176
189
 
177
190
  ```diff
178
191
  /* eslint greasemonkey/meta-spacing: ['error', { spaces: 1 }] */
179
-
192
+
180
193
  // ==UserScript==
181
194
  - // @name My Script
182
195
  + // @name My Script
@@ -197,7 +210,13 @@ If you don't care about visual alignment in metadata blocks.
197
210
  #### See also
198
211
 
199
212
  - [`require-blank-line-after-meta-block`](#require-blank-line-after-meta-block)
213
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
214
+ <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
215
+ <a title="Doesn't prevent bugs" href="#require-blank-line-after-meta-block"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
200
216
  - [`require-space-before-meta-key`](#require-space-before-meta-key)
217
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
218
+ <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
219
+ <a title="Doesn't prevent bugs" href="#require-space-before-meta-key"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
201
220
 
202
221
  <div align="center">
203
222
 
@@ -213,7 +232,7 @@ If you don't care about visual alignment in metadata blocks.
213
232
  <code>no-duplicate-keys</code>
214
233
  <a title="Included in recommended config" href="#usage">
215
234
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
216
- <a title="Copy rule URL" target="_blank"
235
+ <a title="Copy rule URL" target="_blank"
217
236
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-duplicate-keys">
218
237
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
219
238
  </h3>
@@ -261,7 +280,175 @@ If you intentionally repeat single-value keys.
261
280
  #### See also
262
281
 
263
282
  - [`require-matching-localized-fields`](#require-matching-localized-fields)
283
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
284
+ <a title="Accepts array w/ options" href="#require-matching-localized-fields-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
264
285
  - [`require-required-fields`](#require-required-fields)
286
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
287
+ <a title="Accepts array w/ options" href="#require-required-fields-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
288
+
289
+ <div align="center">
290
+
291
+ [Back to index ↑][epg-rules]
292
+
293
+ </div>
294
+
295
+ ---
296
+
297
+ </details>
298
+
299
+ <h3 id="no-insecure-fetch">
300
+ <code>no-insecure-fetch</code>
301
+ <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">
302
+ <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
303
+ <a title="Included in recommended config" href="#usage">
304
+ <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
305
+ <a title="Included in security config" href="#usage">
306
+ <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
307
+ <a title="Copy rule URL" target="_blank"
308
+ href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-insecure-fetch">
309
+ <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
310
+ </h3>
311
+
312
+ <details>
313
+
314
+ <summary>Flags <code>fetch()</code>, <code>XMLHttpRequest.open()</code>, <code>GM_xmlhttpRequest()</code>, <code>GM.xmlHttpRequest()</code> calls and URL fields that use <code>http://</code>.</summary>
315
+
316
+ #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
317
+
318
+ ```diff
319
+ // ==UserScript==
320
+ ! // @require http://cdn.example.com/lib.js
321
+ ! // @resource myCSS http://cdn.example.com/style.css
322
+ // ==/UserScript==
323
+
324
+ ! fetch('http://api.example.com/data')
325
+ ! GM_xmlhttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
326
+ ! GM.xmlHttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
327
+ ```
328
+
329
+ #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
330
+
331
+ ```diff
332
+ // ==UserScript==
333
+ - // @require http://cdn.example.com/lib.js
334
+ + // @require https://cdn.example.com/lib.js
335
+ - // @resource myCSS http://cdn.example.com/style.css
336
+ + // @resource myCSS https://cdn.example.com/style.css
337
+ // ==/UserScript==
338
+
339
+ - fetch('http://api.example.com/data')
340
+ + fetch('https://api.example.com/data')
341
+ - GM_xmlhttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
342
+ + GM_xmlhttpRequest({ method: 'GET', url: 'https://api.example.com/data' })
343
+ - GM.xmlHttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
344
+ + GM.xmlHttpRequest({ method: 'GET', url: 'https://api.example.com/data' })
345
+ ```
346
+
347
+ #### When not to use it
348
+
349
+ If you intentionally target HTTP endpoints.
350
+
351
+ #### Introduced in
352
+
353
+ <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">v1.9.0</a> (October 18, 2026)
354
+
355
+ #### See also
356
+
357
+ - [`prefer-match`](#prefer-match)
358
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
359
+ <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
360
+ - [`require-sri-hashing`](#require-sri-hashing)
361
+ <a title="Included in strict config" href="#usage"><img height=14 alt="[Strict]" src="https://img.shields.io/badge/Strict-ff8c42?style=flat-square" align="middle"></a>
362
+ <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
363
+ <a title="Accepts array w/ options" href="#require-sri-hashing-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
364
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=rfc-editor.org&sz=64">&ensp;<a target="_blank" href="https://www.rfc-editor.org/info/rfc9110/">RFC 9110 — HTTP Semantics</a>
365
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=GM_xmlhttpRequest">Tampermonkey — `GM_xmlhttpRequest`</a>
366
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=violentmonkey.github.io&sz=64">&ensp;<a target="_blank" href="https://violentmonkey.github.io/api/gm/#gm_xmlhttprequest">Violentmonkey — `GM.xmlHttpRequest`</a>
367
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/open">MDN — `XMLHttpRequest.open()`</a>
368
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch">MDN — `fetch()`</a>
369
+
370
+ <div align="center">
371
+
372
+ [Back to index ↑][epg-rules]
373
+
374
+ </div>
375
+
376
+ ---
377
+
378
+ </details>
379
+
380
+ <h3 id="no-insecure-messaging">
381
+ <code>no-insecure-messaging</code>
382
+ <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">
383
+ <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
384
+ <a title="Included in recommended config" href="#usage">
385
+ <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
386
+ <a title="Included in security config" href="#usage">
387
+ <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
388
+ <a title="Accepts array w/ options" href="#usage">
389
+ <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
390
+ <a title="Copy rule URL" target="_blank"
391
+ href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-insecure-messaging">
392
+ <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
393
+ </h3>
394
+
395
+ <details>
396
+
397
+ <summary>Requires origin/source validation + explicit <code>postMessage()</code> target.</summary>
398
+
399
+ <h4 id="no-insecure-messaging-options">Options</h4>
400
+
401
+ - `disallowWildcardTarget` (default `true`) – flag <code>postMessage()</code> calls that use <code>'*'</code> as <code>targetOrigin</code>
402
+
403
+ #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
404
+
405
+ ```diff
406
+ window.addEventListener('message', event => {
407
+ ! handle(event.data)
408
+ })
409
+
410
+ unsafeWindow.addEventListener('message', event => {
411
+ ! handle(event.data)
412
+ })
413
+
414
+ ! window.postMessage(payload, '*')
415
+ ! unsafeWindow.postMessage(payload, '*')
416
+ ```
417
+
418
+ #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
419
+
420
+ ```diff
421
+ window.addEventListener('message', event => {
422
+ + if (event.origin !== 'https://allowed-origin.com') return
423
+ handle(event.data)
424
+ })
425
+
426
+ unsafeWindow.addEventListener('message', event => {
427
+ + if (event.origin !== 'https://allowed-origin.com') return
428
+ handle(event.data)
429
+ })
430
+
431
+ - window.postMessage(payload, '*')
432
+ + window.postMessage(payload, 'https://allowed-origin.com')
433
+ - unsafeWindow.postMessage(payload, '*')
434
+ + unsafeWindow.postMessage(payload, 'https://allowed-origin.com')
435
+ ```
436
+
437
+ #### When not to use it
438
+
439
+ If you intentionally handle messages from any origin, or broadcast to any frame on the page.
440
+
441
+ #### Introduced in
442
+
443
+ <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">v1.9.0</a> (October 18, 2026)
444
+
445
+ #### See also
446
+
447
+ - [`no-insecure-fetch`](#no-insecure-fetch)
448
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
449
+ <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
450
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns">MDN — `window.postMessage()` security concerns</a>
451
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/message_event">MDN — `message` event</a>
265
452
 
266
453
  <div align="center">
267
454
 
@@ -280,7 +467,7 @@ If you intentionally repeat single-value keys.
280
467
  <a title="Optimized in tampermonkey config" href="#usage">
281
468
  <img height=18 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
282
469
  <a title="Optimized in violentmonkey config" href="#usage">
283
- <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
470
+ <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
284
471
  <a title="Optimized in greasemonkey config" href="#usage">
285
472
  <img height=18 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
286
473
  <a title="Optimized in scriptcat config" href="#usage">
@@ -289,7 +476,7 @@ If you intentionally repeat single-value keys.
289
476
  <img height=18 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
290
477
  <a title="Accepts array w/ options" href="#usage">
291
478
  <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
292
- <a title="Copy rule URL" target="_blank"
479
+ <a title="Copy rule URL" target="_blank"
293
480
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-invalid-grants">
294
481
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
295
482
  </h3>
@@ -298,23 +485,23 @@ If you intentionally repeat single-value keys.
298
485
 
299
486
  <summary>Disallows invalid or unsupported <code>@grant</code> values.</summary>
300
487
 
301
- #### Options
488
+ <h4 id="no-invalid-grants-options">Options</h4>
302
489
 
303
- - `target` (default `'all'`) – manager(s) whose grants to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array
304
- - `allowedGrants` (default `[]`) – additional `@grant` values to allow beyond the built-in list (covering Tampermonkey, Violentmonkey, Greasemonkey, ScriptCat and AdGuard), as a single string or array
490
+ - `target` (default `'all'`) – manager(s) whose grants to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.2.0">v1.2.0</a>]
491
+ - `allowedGrants` (default `[]`) – additional `@grant` values to allow beyond the built-in list (covering Tampermonkey, Violentmonkey, Greasemonkey, ScriptCat and AdGuard), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.2.0">v1.2.0</a>]
305
492
 
306
493
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
307
494
 
308
495
  ```diff
309
496
  /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'tampermonkey' }] */
310
-
497
+
311
498
  // ==UserScript==
312
499
  // @grant GM_getTab
313
500
  ! // @grant CAT.agent.dom
314
501
  // ==/UserScript==
315
502
 
316
503
  /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'scriptcat' }] */
317
-
504
+
318
505
  // ==UserScript==
319
506
  ! // @grant GM_getTab
320
507
  // @grant CAT.agent.dom
@@ -325,14 +512,14 @@ If you intentionally repeat single-value keys.
325
512
 
326
513
  ```diff
327
514
  /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'tampermonkey' }] */
328
-
515
+
329
516
  // ==UserScript==
330
517
  // @grant GM_getTab
331
518
  - // @grant CAT.agent.dom
332
519
  // ==/UserScript==
333
520
 
334
521
  /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'scriptcat' }] */
335
-
522
+
336
523
  // ==UserScript==
337
524
  - // @grant GM_getTab
338
525
  // @grant CAT.agent.dom
@@ -354,7 +541,9 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
354
541
  #### See also
355
542
 
356
543
  - [`no-missing-grants`](#no-missing-grants)
544
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
357
545
  - [`no-unused-grants`](#no-unused-grants)
546
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
358
547
 
359
548
  <div align="center">
360
549
 
@@ -368,12 +557,14 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
368
557
 
369
558
  <h3 id="no-invalid-headers">
370
559
  <code>no-invalid-headers</code>
560
+ <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
561
+ <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
371
562
  <a title="Included in recommended config" href="#usage">
372
563
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
373
564
  <a title="Optimized in tampermonkey config" href="#usage">
374
565
  <img height=18 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
375
566
  <a title="Optimized in violentmonkey config" href="#usage">
376
- <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
567
+ <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
377
568
  <a title="Optimized in greasemonkey config" href="#usage">
378
569
  <img height=18 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
379
570
  <a title="Optimized in scriptcat config" href="#usage">
@@ -382,7 +573,7 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
382
573
  <img height=18 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
383
574
  <a title="Accepts array w/ options" href="#usage">
384
575
  <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
385
- <a title="Copy rule URL" target="_blank"
576
+ <a title="Copy rule URL" target="_blank"
386
577
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-invalid-headers">
387
578
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
388
579
  </h3>
@@ -391,16 +582,16 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
391
582
 
392
583
  <summary>Disallows invalid or unsupported metadata headers.</summary>
393
584
 
394
- #### Options
585
+ <h4 id="no-invalid-headers-options">Options</h4>
395
586
 
396
- - `target` (default `'all'`) – manager(s) whose headers to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array
397
- - `allowedHeaders` (default `[]`) – additional headers to allow (strings or regexes), as a single value or array
587
+ - `target` (default `'all'`) – manager(s) whose headers to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
588
+ - `allowedHeaders` (default `[]`) – additional headers to allow (strings or regexes), as a single value or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
398
589
 
399
590
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
400
591
 
401
592
  ```diff
402
593
  /* eslint greasemonkey/no-invalid-headers: ['error', { target: 'tampermonkey', allowedHeaders: /^\w*url$/i }] */
403
-
594
+
404
595
  // ==UserScript==
405
596
  // @name My Script
406
597
  ! // @runin normal-tabs
@@ -413,7 +604,7 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
413
604
 
414
605
  ```diff
415
606
  /* eslint greasemonkey/no-invalid-headers: ['error', { target: 'tampermonkey', allowedHeaders: /^\w*url$/i }] */
416
-
607
+
417
608
  // ==UserScript==
418
609
  // @name My Script
419
610
  - // @runin normal-tabs
@@ -435,7 +626,16 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
435
626
  #### See also
436
627
 
437
628
  - [`no-invalid-grants`](#no-invalid-grants)
629
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
630
+ <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
631
+ <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
632
+ <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
633
+ <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
634
+ <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
635
+ <a title="Accepts array w/ options" href="#no-invalid-grants-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
438
636
  - [`valid-field-values`](#valid-field-values)
637
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
638
+ <a title="Accepts array w/ options" href="#valid-field-values-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
439
639
 
440
640
  <div align="center">
441
641
 
@@ -451,7 +651,7 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
451
651
  <code>no-missing-grants</code>
452
652
  <a title="Included in recommended config" href="#usage">
453
653
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
454
- <a title="Copy rule URL" target="_blank"
654
+ <a title="Copy rule URL" target="_blank"
455
655
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-missing-grants">
456
656
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
457
657
  </h3>
@@ -466,7 +666,7 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
466
666
  // ==UserScript==
467
667
  // @name My Script
468
668
  // ==/UserScript==
469
-
669
+
470
670
  ! GM_setValue('key', 'value')
471
671
  ```
472
672
 
@@ -477,7 +677,7 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
477
677
  // @name My Script
478
678
  + // @grant GM_setValue
479
679
  // ==/UserScript==
480
-
680
+
481
681
  GM_setValue('key', 'value')
482
682
  ```
483
683
 
@@ -492,7 +692,15 @@ If you use APIs through aliases or wrappers that obscure the original call site.
492
692
  #### See also
493
693
 
494
694
  - [`no-invalid-grants`](#no-invalid-grants)
695
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
696
+ <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
697
+ <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
698
+ <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
699
+ <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
700
+ <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
701
+ <a title="Accepts array w/ options" href="#no-invalid-grants-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
495
702
  - [`no-unused-grants`](#no-unused-grants)
703
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
496
704
 
497
705
  <div align="center">
498
706
 
@@ -508,7 +716,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
508
716
  <code>no-missing-resources</code>
509
717
  <a title="Included in recommended config" href="#usage">
510
718
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
511
- <a title="Copy rule URL" target="_blank"
719
+ <a title="Copy rule URL" target="_blank"
512
720
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-missing-resources">
513
721
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
514
722
  </h3>
@@ -523,7 +731,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
523
731
  // ==UserScript==
524
732
  // @name My Script
525
733
  // ==/UserScript==
526
-
734
+
527
735
  ! const css = GM_getResourceText('myCSS')
528
736
  ```
529
737
 
@@ -534,7 +742,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
534
742
  // @name My Script
535
743
  + // @resource myCSS https://example.com/style.css
536
744
  // ==/UserScript==
537
-
745
+
538
746
  const css = GM_getResourceText('myCSS')
539
747
  ```
540
748
 
@@ -549,6 +757,7 @@ If you reference resources through an alias or computed pattern that obscures th
549
757
  #### See also
550
758
 
551
759
  - [`no-unused-resources`](#no-unused-resources)
760
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
552
761
 
553
762
  <div align="center">
554
763
 
@@ -562,9 +771,11 @@ If you reference resources through an alias or computed pattern that obscures th
562
771
 
563
772
  <h3 id="no-unused-grants">
564
773
  <code>no-unused-grants</code>
774
+ <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
775
+ <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
565
776
  <a title="Included in recommended config" href="#usage">
566
777
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
567
- <a title="Copy rule URL" target="_blank"
778
+ <a title="Copy rule URL" target="_blank"
568
779
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-unused-grants">
569
780
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
570
781
  </h3>
@@ -587,7 +798,7 @@ If you reference resources through an alias or computed pattern that obscures th
587
798
  // ==UserScript==
588
799
  // @grant GM_setValue
589
800
  // ==/UserScript==
590
-
801
+
591
802
  + GM_setValue('key', 'value')
592
803
  ```
593
804
 
@@ -602,7 +813,15 @@ If you access the granted API through an alias or computed property rather than
602
813
  #### See also
603
814
 
604
815
  - [`no-invalid-grants`](#no-invalid-grants)
816
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
817
+ <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
818
+ <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
819
+ <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
820
+ <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
821
+ <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
822
+ <a title="Accepts array w/ options" href="#no-invalid-grants-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
605
823
  - [`no-missing-grants`](#no-missing-grants)
824
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
606
825
 
607
826
  <div align="center">
608
827
 
@@ -616,9 +835,11 @@ If you access the granted API through an alias or computed property rather than
616
835
 
617
836
  <h3 id="no-unused-resources">
618
837
  <code>no-unused-resources</code>
838
+ <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
839
+ <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
619
840
  <a title="Included in recommended config" href="#usage">
620
841
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
621
- <a title="Copy rule URL" target="_blank"
842
+ <a title="Copy rule URL" target="_blank"
622
843
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-unused-resources">
623
844
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
624
845
  </h3>
@@ -641,7 +862,7 @@ If you access the granted API through an alias or computed property rather than
641
862
  // ==UserScript==
642
863
  // @resource myCSS https://example.com/style.css
643
864
  // ==/UserScript==
644
-
865
+
645
866
  + const css = GM_getResourceText('myCSS')
646
867
  ```
647
868
 
@@ -656,6 +877,62 @@ If you pass resource names through variables or aliases rather than use them lit
656
877
  #### See also
657
878
 
658
879
  - [`no-missing-resources`](#no-missing-resources)
880
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
881
+
882
+ <div align="center">
883
+
884
+ [Back to index ↑][epg-rules]
885
+
886
+ </div>
887
+
888
+ ---
889
+
890
+ </details>
891
+
892
+ <h3 id="prefer-gm-add-style">
893
+ <code>prefer-gm-add-style</code>
894
+ <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">
895
+ <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
896
+ <a title="Only included in strict config" href="#usage">
897
+ <img height=18 alt="[Strict only]" src="https://img.shields.io/badge/Strict_only-ff8c42?style=flat-square" align="middle"></a>
898
+ <a title="Copy rule URL" target="_blank"
899
+ href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23prefer-gm-add-style">
900
+ <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
901
+ </h3>
902
+
903
+ <details>
904
+
905
+ <summary>Prefers <code>GM_addStyle()</code> or a shadow root over manual <code>&lt;style&gt;</code> injection.</summary>
906
+
907
+ #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
908
+
909
+ ```diff
910
+ ! const style = document.createElement('style')
911
+ ! style.textContent = 'body { color: red }'
912
+ ! document.head.append(style)
913
+ ```
914
+
915
+ #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
916
+
917
+ ```diff
918
+ - const style = document.createElement('style')
919
+ - style.textContent = 'body { color: red }'
920
+ - document.head.append(style)
921
+ + GM_addStyle('body { color: red }')
922
+ ```
923
+
924
+ #### When not to use it
925
+
926
+ If you deliberately need manual control over the injected `<style>`.
927
+
928
+ #### Introduced in
929
+
930
+ <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">v1.9.0</a> (October 18, 2026)
931
+
932
+ #### See also
933
+
934
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=GM_addStyle">Tampermonkey — `GM_addStyle`</a>
935
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=docs.scriptcat.org&sz=64">&ensp;<a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/api/#gm_addstyle">ScriptCat — `GM_addStyle`</a>
659
936
 
660
937
  <div align="center">
661
938
 
@@ -671,7 +948,9 @@ If you pass resource names through variables or aliases rather than use them lit
671
948
  <code>prefer-match</code>
672
949
  <a title="Included in recommended config" href="#usage">
673
950
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
674
- <a title="Copy rule URL" target="_blank"
951
+ <a title="Included in security config" href="#usage">
952
+ <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
953
+ <a title="Copy rule URL" target="_blank"
675
954
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23prefer-match">
676
955
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
677
956
  </h3>
@@ -707,8 +986,8 @@ If you rely on `@include` patterns that cannot be expressed using `@match`.
707
986
 
708
987
  #### See also
709
988
 
710
- - <a target="_blank" href="https://www.tampermonkey.net/documentation.php?locale=en&q=include#meta:match">Tampermonkey — `@match`</a>
711
- - <a target="_blank" href="https://www.tampermonkey.net/documentation.php?locale=en&q=include#meta:include">Tampermonkey — `@include`</a>
989
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?locale=en&q=include#meta:match">Tampermonkey — `@match`</a>
990
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?locale=en&q=include#meta:include">Tampermonkey — `@include`</a>
712
991
 
713
992
  <div align="center">
714
993
 
@@ -728,7 +1007,7 @@ If you rely on `@include` patterns that cannot be expressed using `@match`.
728
1007
  <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
729
1008
  <a title="Doesn't prevent bugs" href="#require-blank-line-after-meta-block">
730
1009
  <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
731
- <a title="Copy rule URL" target="_blank"
1010
+ <a title="Copy rule URL" target="_blank"
732
1011
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-blank-line-after-meta-block">
733
1012
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
734
1013
  </h3>
@@ -771,7 +1050,15 @@ If you don't care about visual separation between metadata and code.
771
1050
  #### See also
772
1051
 
773
1052
  - [`meta-order`](#meta-order)
1053
+ <a title="Only included in strict config" href="#usage"><img height=14 alt="[Strict only]" src="https://img.shields.io/badge/Strict_only-ff8c42?style=flat-square" align="middle"></a>
1054
+ <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
1055
+ <a title="Doesn't prevent bugs" href="#meta-order"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
1056
+ <a title="Accepts array w/ options" href="#meta-order-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
774
1057
  - [`meta-spacing`](#meta-spacing)
1058
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1059
+ <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
1060
+ <a title="Doesn't prevent bugs" href="#meta-spacing"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
1061
+ <a title="Accepts array w/ options" href="#meta-spacing-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
775
1062
 
776
1063
  <div align="center">
777
1064
 
@@ -789,7 +1076,7 @@ If you don't care about visual separation between metadata and code.
789
1076
  <img height=18 alt="[Strict only]" src="https://img.shields.io/badge/Strict_only-ff8c42?style=flat-square" align="middle"></a>
790
1077
  <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
791
1078
  <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
792
- <a title="Copy rule URL" target="_blank"
1079
+ <a title="Copy rule URL" target="_blank"
793
1080
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-homepage-pair">
794
1081
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
795
1082
  </h3>
@@ -825,9 +1112,8 @@ If you don't care about ensuring homepage URL compatibility across different man
825
1112
 
826
1113
  #### See also
827
1114
 
828
- - [`require-update-download-pair`](#require-update-download-pair)
829
- - <a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=homepage#meta:homepage">Tampermonkey `@homepage`, `@homepageURL`, `@website`, `@source`</a>
830
- - <a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/meta/#homepage-homepageurl-website">ScriptCat `@homepage`, `@homepageURL`, `@website`</a>
1115
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=homepage#meta:homepage">Tampermonkey `@homepage`, `@homepageURL`, `@website`, `@source`</a>
1116
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=docs.scriptcat.org&sz=64">&ensp;<a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/meta/#homepage-homepageurl-website">ScriptCat `@homepage`, `@homepageURL`, `@website`</a>
831
1117
 
832
1118
  <div align="center">
833
1119
 
@@ -841,11 +1127,13 @@ If you don't care about ensuring homepage URL compatibility across different man
841
1127
 
842
1128
  <h3 id="require-matching-localized-fields">
843
1129
  <code>require-matching-localized-fields</code>
1130
+ <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
1131
+ <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
844
1132
  <a title="Included in recommended config" href="#usage">
845
1133
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
846
1134
  <a title="Accepts array w/ options" href="#usage">
847
1135
  <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
848
- <a title="Copy rule URL" target="_blank"
1136
+ <a title="Copy rule URL" target="_blank"
849
1137
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-matching-localized-fields">
850
1138
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
851
1139
  </h3>
@@ -854,15 +1142,15 @@ If you don't care about ensuring homepage URL compatibility across different man
854
1142
 
855
1143
  <summary>Requires that every <code>@name:xx</code> has a matching <code>@description:xx</code> (and vice versa).</summary>
856
1144
 
857
- #### Options
1145
+ <h4 id="require-matching-localized-fields-options">Options</h4>
858
1146
 
859
- - `ignoreLanguages` (default `[]`) – language code(s) to skip (e.g. `'de'` or `['es', 'fr']`)
1147
+ - `ignoreLanguages` (default `[]`) – language code(s) to skip (e.g. `'de'` or `['es', 'fr']`) – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
860
1148
 
861
1149
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
862
1150
 
863
1151
  ```diff
864
1152
  /* eslint greasemonkey/require-matching-localized-fields: ['error', { ignoreLanguages: ['fr'] }] */
865
-
1153
+
866
1154
  // ==UserScript==
867
1155
  // @name:en My Script
868
1156
  ! // @name:de Mein Skript
@@ -875,7 +1163,7 @@ If you don't care about ensuring homepage URL compatibility across different man
875
1163
 
876
1164
  ```diff
877
1165
  /* eslint greasemonkey/require-matching-localized-fields: ['error', { ignoreLanguages: ['fr'] }] */
878
-
1166
+
879
1167
  // ==UserScript==
880
1168
  // @name:en My Script
881
1169
  // @name:de Mein Skript
@@ -896,7 +1184,10 @@ If you intentionally provide localized names without descriptions (or vice versa
896
1184
  #### See also
897
1185
 
898
1186
  - [`no-duplicate-keys`](#no-duplicate-keys)
1187
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
899
1188
  - [`require-required-fields`](#require-required-fields)
1189
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1190
+ <a title="Accepts array w/ options" href="#require-required-fields-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
900
1191
 
901
1192
  <div align="center">
902
1193
 
@@ -910,11 +1201,13 @@ If you intentionally provide localized names without descriptions (or vice versa
910
1201
 
911
1202
  <h3 id="require-required-fields">
912
1203
  <code>require-required-fields</code>
1204
+ <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
1205
+ <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
913
1206
  <a title="Included in recommended config" href="#usage">
914
1207
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
915
1208
  <a title="Accepts array w/ options" href="#usage">
916
1209
  <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
917
- <a title="Copy rule URL" target="_blank"
1210
+ <a title="Copy rule URL" target="_blank"
918
1211
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-required-fields">
919
1212
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
920
1213
  </h3>
@@ -923,16 +1216,16 @@ If you intentionally provide localized names without descriptions (or vice versa
923
1216
 
924
1217
  <summary>Requires essential metadata fields (<code>@name</code>, <code>@version</code> and at least one <code>@match</code> or <code>@include</code>).</summary>
925
1218
 
926
- #### Options
1219
+ <h4 id="require-required-fields-options">Options</h4>
927
1220
 
928
- - `fields` (default `['name', 'version']`) – override the required field list
929
- - `requireMatchOrInclude` (default `true`) – require `@match` or `@include`
1221
+ - `fields` (default `['name', 'version']`) – override the required field list – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
1222
+ - `requireMatchOrInclude` (default `true`) – require `@match` or `@include` – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
930
1223
 
931
1224
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
932
1225
 
933
1226
  ```diff
934
1227
  /* eslint greasemonkey/require-required-fields: ['error', { fields: ['name', 'version', 'license'] }] */
935
-
1228
+
936
1229
  // ==UserScript==
937
1230
  // @name My Script
938
1231
  // ==/UserScript==
@@ -942,7 +1235,7 @@ If you intentionally provide localized names without descriptions (or vice versa
942
1235
 
943
1236
  ```diff
944
1237
  /* eslint greasemonkey/require-required-fields: ['error', { fields: ['name', 'version', 'license'] }] */
945
-
1238
+
946
1239
  // ==UserScript==
947
1240
  // @name My Script
948
1241
  + // @version 1.0.0
@@ -962,7 +1255,10 @@ If your script is a work-in-progress, or metadata is injected at build time.
962
1255
  #### See also
963
1256
 
964
1257
  - [`no-duplicate-keys`](#no-duplicate-keys)
1258
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
965
1259
  - [`require-matching-localized-fields`](#require-matching-localized-fields)
1260
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1261
+ <a title="Accepts array w/ options" href="#require-matching-localized-fields-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
966
1262
 
967
1263
  <div align="center">
968
1264
 
@@ -982,7 +1278,7 @@ If your script is a work-in-progress, or metadata is injected at build time.
982
1278
  <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
983
1279
  <a title="Doesn't prevent bugs" href="#require-space-before-meta-key">
984
1280
  <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
985
- <a title="Copy rule URL" target="_blank"
1281
+ <a title="Copy rule URL" target="_blank"
986
1282
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-space-before-meta-key">
987
1283
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
988
1284
  </h3>
@@ -1021,7 +1317,14 @@ If you intentionally use a different prefix style.
1021
1317
  #### See also
1022
1318
 
1023
1319
  - [`meta-spacing`](#meta-spacing)
1320
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1321
+ <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
1322
+ <a title="Doesn't prevent bugs" href="#meta-spacing"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
1323
+ <a title="Accepts array w/ options" href="#meta-spacing-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
1024
1324
  - [`require-blank-line-after-meta-block`](#require-blank-line-after-meta-block)
1325
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1326
+ <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
1327
+ <a title="Doesn't prevent bugs" href="#require-blank-line-after-meta-block"><img height=14 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
1025
1328
 
1026
1329
  <div align="center">
1027
1330
 
@@ -1035,11 +1338,13 @@ If you intentionally use a different prefix style.
1035
1338
 
1036
1339
  <h3 id="require-sri-hashing">
1037
1340
  <code>require-sri-hashing</code>
1038
- <a title="Only included in strict config" href="#usage">
1039
- <img height=18 alt="[Strict only]" src="https://img.shields.io/badge/Strict_only-ff8c42?style=flat-square" align="middle"></a>
1341
+ <a title="Included in strict config" href="#usage">
1342
+ <img height=18 alt="[Strict]" src="https://img.shields.io/badge/Strict-ff8c42?style=flat-square" align="middle"></a>
1343
+ <a title="Included in security config" href="#usage">
1344
+ <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
1040
1345
  <a title="Accepts array w/ options" href="#usage">
1041
1346
  <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
1042
- <a title="Copy rule URL" target="_blank"
1347
+ <a title="Copy rule URL" target="_blank"
1043
1348
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-sri-hashing">
1044
1349
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
1045
1350
  </h3>
@@ -1048,9 +1353,9 @@ If you intentionally use a different prefix style.
1048
1353
 
1049
1354
  <summary>Requires SRI hashes on <code>@require</code> and <code>@resource</code> URLs.</summary>
1050
1355
 
1051
- #### Options
1356
+ <h4 id="require-sri-hashing-options">Options</h4>
1052
1357
 
1053
- - `algorithm` (default `'sha256'`) – SRI hash algorithm(s) to enforce (`'md5'`, `'sha1'`, `'sha256'`, `'sha384'`, `'sha512'`), as a single string or array
1358
+ - `algorithm` (default `'sha256'`) – SRI hash algorithm(s) to enforce (`'md5'`, `'sha1'`, `'sha256'`, `'sha384'`, `'sha512'`), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.5.0">v1.5.0</a>]
1054
1359
 
1055
1360
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
1056
1361
 
@@ -1088,8 +1393,11 @@ If you prefer shorter URLs, or don't support users who strictly enforce subresou
1088
1393
 
1089
1394
  #### See also
1090
1395
 
1091
- - <a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=sri">Tampermonkey — Subresource Integrity</a>
1092
- - <a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/meta/#resource-integrity-verification">ScriptCat — Resource Integrity Verification</a>
1396
+ - [`no-insecure-fetch`](#no-insecure-fetch)
1397
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1398
+ <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
1399
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=sri">Tampermonkey — Subresource Integrity</a>
1400
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=docs.scriptcat.org&sz=64">&ensp;<a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/meta/#resource-integrity-verification">ScriptCat — Resource Integrity Verification</a>
1093
1401
 
1094
1402
  <div align="center">
1095
1403
 
@@ -1111,7 +1419,7 @@ If you prefer shorter URLs, or don't support users who strictly enforce subresou
1111
1419
  <img height=18 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
1112
1420
  <a title="Included in adguard config" href="#usage">
1113
1421
  <img height=18 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
1114
- <a title="Copy rule URL" target="_blank"
1422
+ <a title="Copy rule URL" target="_blank"
1115
1423
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-update-download-pair">
1116
1424
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
1117
1425
  </h3>
@@ -1147,8 +1455,8 @@ If you don't strictly target Tampermonkey, ScriptCat or AdGuard (where `@updateU
1147
1455
 
1148
1456
  #### See also
1149
1457
 
1150
- - <a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=update_url#meta:updateURL">Tampermonkey — `@updateURL`</a>
1151
- - <a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/meta/#updateurl">ScriptCat — `@updateURL`</a>
1458
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=update_url#meta:updateURL">Tampermonkey — `@updateURL`</a>
1459
+ - <img height=12 src="https://www.google.com/s2/favicons?domain=docs.scriptcat.org&sz=64">&ensp;<a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/meta/#updateurl">ScriptCat — `@updateURL`</a>
1152
1460
 
1153
1461
  <div align="center">
1154
1462
 
@@ -1164,7 +1472,7 @@ If you don't strictly target Tampermonkey, ScriptCat or AdGuard (where `@updateU
1164
1472
  <code>require-user-js-filename</code>
1165
1473
  <a title="Included in recommended config" href="#usage">
1166
1474
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1167
- <a title="Copy rule URL" target="_blank"
1475
+ <a title="Copy rule URL" target="_blank"
1168
1476
  href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-user-js-filename">
1169
1477
  <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
1170
1478
  </h3>
@@ -1206,6 +1514,8 @@ If you intentionally name your userscripts something other than `*.user.js`.
1206
1514
 
1207
1515
  <h3 id="valid-field-values">
1208
1516
  <code>valid-field-values</code>
1517
+ <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
1518
+ <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
1209
1519
  <a title="Included in recommended config" href="#usage">
1210
1520
  <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1211
1521
  <a title="Accepts array w/ options" href="#usage">
@@ -1219,17 +1529,17 @@ If you intentionally name your userscripts something other than `*.user.js`.
1219
1529
 
1220
1530
  <summary>Validates <code>@version</code> (semver or date format) and URL fields.</summary>
1221
1531
 
1222
- #### Options
1532
+ <h4 id="valid-field-values-options">Options</h4>
1223
1533
 
1224
- - `versionType` (default `'semver'`) – version format to enforce (`'semver'`, `'date'`)
1225
- - `allowFutureDate` (default `false`) – allow `@version` dates later than the current date
1226
- - `timezone` (default `''`) – <a target="_blank" href="https://data.iana.org/time-zones/tzdb/zone1970.tab">IANA timezone</a> used to determine the current date (when omitted, only year/month are enforced)
1534
+ - `versionType` (default `'semver'`) – version format to enforce (`'semver'`, `'date'`) – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
1535
+ - `allowFutureDate` (default `false`) – allow `@version` dates later than the current date – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
1536
+ - `timezone` (default `''`) – <a target="_blank" href="https://data.iana.org/time-zones/tzdb/zone1970.tab">IANA timezone</a> used to determine the current date (when omitted, only year/month are enforced) – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
1227
1537
 
1228
1538
  #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
1229
1539
 
1230
1540
  ```diff
1231
1541
  /* eslint greasemonkey/valid-field-values: ['error', { versionType: 'semver' }] */
1232
-
1542
+
1233
1543
  // ==UserScript==
1234
1544
  ! // @version abc
1235
1545
  ! // @homepage not-a-url
@@ -1240,7 +1550,7 @@ If you intentionally name your userscripts something other than `*.user.js`.
1240
1550
 
1241
1551
  ```diff
1242
1552
  /* eslint greasemonkey/valid-field-values: ['error', { versionType: 'semver' }] */
1243
-
1553
+
1244
1554
  // ==UserScript==
1245
1555
  - // @version abc
1246
1556
  + // @version 1.0.0
@@ -1260,7 +1570,21 @@ If you use a custom versioning scheme or URLs that aren't standard.
1260
1570
  #### See also
1261
1571
 
1262
1572
  - [`no-invalid-grants`](#no-invalid-grants)
1573
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1574
+ <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
1575
+ <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
1576
+ <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
1577
+ <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
1578
+ <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
1579
+ <a title="Accepts array w/ options" href="#no-invalid-grants-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
1263
1580
  - [`no-invalid-headers`](#no-invalid-headers)
1581
+ <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
1582
+ <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
1583
+ <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
1584
+ <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
1585
+ <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
1586
+ <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
1587
+ <a title="Accepts array w/ options" href="#no-invalid-headers-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
1264
1588
 
1265
1589
  <div align="center">
1266
1590
 
@@ -1295,7 +1619,7 @@ If you use a custom versioning scheme or URLs that aren't standard.
1295
1619
  ## <img height=30 width=27 align="top" src="https://api.iconify.design/ic/baseline-account-balance.svg?color=%232b2b2a"> License
1296
1620
 
1297
1621
  <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/src/branch/main/docs/LICENSE.md">
1298
- <img height=85 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
1622
+ <img height=80 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
1299
1623
  <br><br>
1300
1624
 
1301
1625
  <details>