eslint-plugin-greasemonkey 1.8.4 → 1.9.0

package/README.md

@@ -4,7 +4,7 @@
 
 <a target="_blank" href="https://www.npmjs.com/package/eslint-plugin-greasemonkey">
     <img alt="[Latest Build]" src="https://img.shields.io/npm/v/eslint-plugin-greasemonkey?logo=icinga&style=for-the-badge&label=Latest%20Build&color=32fcee"></a>
-<a href="#license">
+<a href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/src/branch/main/docs/LICENSE.md">
     <img alt="[License: MIT]" src="https://img.shields.io/badge/License-MIT-f1f20a.svg?logo=internetarchive&logoColor=white&labelColor=464646&style=for-the-badge"></a>
 <a target="_blank" href="https://getnpmstats.com/?package=eslint-plugin-greasemonkey&range=last-year&interval=monthly">
     <img src="https://img.shields.io/npm/dm/eslint-plugin-greasemonkey?style=for-the-badge&logo=npm&color=black"></a>
@@ -52,7 +52,7 @@ export default [
 ]
 ```
 
-Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `tampermonkey`, `violentmonkey`, `greasemonkey`, `scriptcat`, `adguard`
+Available bundles: `recommended`, `strict` (everything), `problem` (deterministic bugs only), `security`, `tampermonkey`, `violentmonkey`, `greasemonkey`, `scriptcat`, `adguard`
 
 **Note:** Rule config is either a severity string (`'off'`, `'warn'`, `'error'`) or an array `[severity, options]` when the rule accepts options.
 
@@ -73,7 +73,7 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
         <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23meta-order">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -84,7 +84,7 @@ Available bundles: `recommended`, `strict` (everything), `problem` (deterministi
 
 <h4 id="meta-order-options">Options</h4>
 
-- `order` (default `[]`) – metadata keys in custom order (e.g. `['license', 'namespace']`) to selectively override built-in order with
+- `order` (default `[]`) – metadata keys in custom order (e.g. `['license', 'namespace']`) to selectively override built-in order with – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.5.0">v1.5.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
@@ -132,7 +132,7 @@ If you don't care about the order of metadata fields.
 - [`no-invalid-headers`](#no-invalid-headers)
     <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
-    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
     <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
@@ -150,6 +150,8 @@ If you don't care about the order of metadata fields.
 
 <h3 id="meta-spacing">
     <code>meta-spacing</code>
+    <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
+        <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
@@ -158,7 +160,7 @@ If you don't care about the order of metadata fields.
         <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23meta-spacing">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -169,13 +171,13 @@ If you don't care about the order of metadata fields.
 
 <h4 id="meta-spacing-options">Options</h4>
 
-- `spaces` (default `3`) – minimum spaces after the longest key
+- `spaces` (default `3`) – minimum spaces after the longest key – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
   /* eslint greasemonkey/meta-spacing: ['error', { spaces: 1 }] */
-  
+
   // ==UserScript==
 ! // @name My Script
   // @namespace example.com
@@ -187,7 +189,7 @@ If you don't care about the order of metadata fields.
 
 ```diff
   /* eslint greasemonkey/meta-spacing: ['error', { spaces: 1 }] */
-  
+
   // ==UserScript==
 - // @name My Script
 + // @name      My Script
@@ -230,7 +232,7 @@ If you don't care about visual alignment in metadata blocks.
     <code>no-duplicate-keys</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-duplicate-keys">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -294,6 +296,170 @@ If you intentionally repeat single-value keys.
 
 </details>
 
+<h3 id="no-insecure-fetch">
+    <code>no-insecure-fetch</code>
+    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">
+        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-insecure-fetch">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Flags <code>fetch()</code>, <code>XMLHttpRequest.open()</code>, <code>GM_xmlhttpRequest()</code>, <code>GM.xmlHttpRequest()</code> calls and URL fields that use <code>http://</code>.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  // ==UserScript==
+! // @require         http://cdn.example.com/lib.js
+! // @resource myCSS  http://cdn.example.com/style.css
+  // ==/UserScript==
+
+! fetch('http://api.example.com/data')
+! GM_xmlhttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
+! GM.xmlHttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  // ==UserScript==
+- // @require         http://cdn.example.com/lib.js
++ // @require         https://cdn.example.com/lib.js
+- // @resource myCSS  http://cdn.example.com/style.css
++ // @resource myCSS  https://cdn.example.com/style.css
+  // ==/UserScript==
+
+- fetch('http://api.example.com/data')
++ fetch('https://api.example.com/data')
+- GM_xmlhttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
++ GM_xmlhttpRequest({ method: 'GET', url: 'https://api.example.com/data' })
+- GM.xmlHttpRequest({ method: 'GET', url: 'http://api.example.com/data' })
++ GM.xmlHttpRequest({ method: 'GET', url: 'https://api.example.com/data' })
+```
+
+#### When not to use it
+
+If you intentionally target HTTP endpoints.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">v1.9.0</a> (October 18, 2026)
+
+#### See also
+
+- [`prefer-match`](#prefer-match)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+- [`require-sri-hashing`](#require-sri-hashing)
+    <a title="Included in strict config" href="#usage"><img height=14 alt="[Strict]" src="https://img.shields.io/badge/Strict-ff8c42?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#require-sri-hashing-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=rfc-editor.org&sz=64">&ensp;<a target="_blank" href="https://www.rfc-editor.org/info/rfc9110/">RFC 9110 — HTTP Semantics</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=GM_xmlhttpRequest">Tampermonkey — `GM_xmlhttpRequest`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=violentmonkey.github.io&sz=64">&ensp;<a target="_blank" href="https://violentmonkey.github.io/api/gm/#gm_xmlhttprequest">Violentmonkey — `GM.xmlHttpRequest`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/open">MDN — `XMLHttpRequest.open()`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/fetch">MDN — `fetch()`</a>
+
+<div align="center">
+
+[Back to index ↑][epg-rules]
+
+</div>
+
+---
+
+</details>
+
+<h3 id="no-insecure-messaging">
+    <code>no-insecure-messaging</code>
+    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">
+        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-insecure-messaging">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Requires origin/source validation + explicit <code>postMessage()</code> target.</summary>
+
+<h4 id="no-insecure-messaging-options">Options</h4>
+
+- `disallowWildcardTarget` (default `true`) – flag <code>postMessage()</code> calls that use <code>'*'</code> as <code>targetOrigin</code>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  window.addEventListener('message', event => {
+!     handle(event.data)
+  })
+
+  unsafeWindow.addEventListener('message', event => {
+!     handle(event.data)
+  })
+
+! window.postMessage(payload, '*')
+! unsafeWindow.postMessage(payload, '*')
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  window.addEventListener('message', event => {
++     if (event.origin !== 'https://allowed-origin.com') return
+      handle(event.data)
+  })
+
+  unsafeWindow.addEventListener('message', event => {
++     if (event.origin !== 'https://allowed-origin.com') return
+      handle(event.data)
+  })
+
+- window.postMessage(payload, '*')
++ window.postMessage(payload, 'https://allowed-origin.com')
+- unsafeWindow.postMessage(payload, '*')
++ unsafeWindow.postMessage(payload, 'https://allowed-origin.com')
+```
+
+#### When not to use it
+
+If you intentionally handle messages from any origin, or broadcast to any frame on the page.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">v1.9.0</a> (October 18, 2026)
+
+#### See also
+
+- [`no-insecure-fetch`](#no-insecure-fetch)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns">MDN — `window.postMessage()` security concerns</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.mozilla.org&sz=64">&ensp;<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Window/message_event">MDN — `message` event</a>
+
+<div align="center">
+
+[Back to index ↑][epg-rules]
+
+</div>
+
+---
+
+</details>
+
 <h3 id="no-invalid-grants"><a deprecated id="valid-grants"></a>
     <code>no-invalid-grants</code>
     <a title="Included in recommended config" href="#usage">
@@ -301,7 +467,7 @@ If you intentionally repeat single-value keys.
     <a title="Optimized in tampermonkey config" href="#usage">
         <img height=18 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
     <a title="Optimized in violentmonkey config" href="#usage">
-        <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage">
         <img height=18 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage">
@@ -310,7 +476,7 @@ If you intentionally repeat single-value keys.
         <img height=18 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-invalid-grants">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -321,21 +487,21 @@ If you intentionally repeat single-value keys.
 
 <h4 id="no-invalid-grants-options">Options</h4>
 
-- `target` (default `'all'`) – manager(s) whose grants to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array
-- `allowedGrants` (default `[]`) – additional `@grant` values to allow beyond the built-in list (covering Tampermonkey, Violentmonkey, Greasemonkey, ScriptCat and AdGuard), as a single string or array
+- `target` (default `'all'`) – manager(s) whose grants to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.2.0">v1.2.0</a>]
+- `allowedGrants` (default `[]`) – additional `@grant` values to allow beyond the built-in list (covering Tampermonkey, Violentmonkey, Greasemonkey, ScriptCat and AdGuard), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.2.0">v1.2.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
   /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'tampermonkey' }] */
-  
+
   // ==UserScript==
   // @grant   GM_getTab
 ! // @grant   CAT.agent.dom
   // ==/UserScript==
 
   /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'scriptcat' }] */
-  
+
   // ==UserScript==
 ! // @grant   GM_getTab
   // @grant   CAT.agent.dom
@@ -346,14 +512,14 @@ If you intentionally repeat single-value keys.
 
 ```diff
   /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'tampermonkey' }] */
-  
+
   // ==UserScript==
   // @grant   GM_getTab
 - // @grant   CAT.agent.dom
   // ==/UserScript==
 
   /* eslint greasemonkey/no-invalid-grants: ['error', { target: 'scriptcat' }] */
-  
+
   // ==UserScript==
 - // @grant   GM_getTab
   // @grant   CAT.agent.dom
@@ -391,12 +557,14 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
 
 <h3 id="no-invalid-headers">
     <code>no-invalid-headers</code>
+    <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
+        <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Optimized in tampermonkey config" href="#usage">
         <img height=18 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
     <a title="Optimized in violentmonkey config" href="#usage">
-        <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+        <img height=18 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage">
         <img height=18 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage">
@@ -405,7 +573,7 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
         <img height=18 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-invalid-headers">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -416,14 +584,14 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
 
 <h4 id="no-invalid-headers-options">Options</h4>
 
-- `target` (default `'all'`) – manager(s) whose headers to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array
-- `allowedHeaders` (default `[]`) – additional headers to allow (strings or regexes), as a single value or array
+- `target` (default `'all'`) – manager(s) whose headers to validate against (`'all'`, `'tampermonkey'`, `'violentmonkey'`, `'greasemonkey'`, `'scriptcat'`, `'adguard'`), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
+- `allowedHeaders` (default `[]`) – additional headers to allow (strings or regexes), as a single value or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
   /* eslint greasemonkey/no-invalid-headers: ['error', { target: 'tampermonkey', allowedHeaders: /^\w*url$/i }] */
-  
+
   // ==UserScript==
   // @name          My Script
 ! // @runin         normal-tabs
@@ -436,7 +604,7 @@ If you don't want `@grant` validation at all. For individual uncovered grants, p
 
 ```diff
   /* eslint greasemonkey/no-invalid-headers: ['error', { target: 'tampermonkey', allowedHeaders: /^\w*url$/i }] */
-  
+
   // ==UserScript==
   // @name          My Script
 - // @runin         normal-tabs
@@ -460,7 +628,7 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
 - [`no-invalid-grants`](#no-invalid-grants)
     <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
-    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
     <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
@@ -483,7 +651,7 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
     <code>no-missing-grants</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-missing-grants">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -498,7 +666,7 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
   // ==UserScript==
   // @name    My Script
   // ==/UserScript==
-  
+
 ! GM_setValue('key', 'value')
 ```
 
@@ -509,7 +677,7 @@ If your script relies heavily on custom headers and you'd rather not maintain `a
   // @name    My Script
 + // @grant   GM_setValue
   // ==/UserScript==
-  
+
   GM_setValue('key', 'value')
 ```
 
@@ -526,7 +694,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
 - [`no-invalid-grants`](#no-invalid-grants)
     <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
-    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
     <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
@@ -548,7 +716,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
     <code>no-missing-resources</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-missing-resources">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -563,7 +731,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
   // ==UserScript==
   // @name             My Script
   // ==/UserScript==
-  
+
 ! const css = GM_getResourceText('myCSS')
 ```
 
@@ -574,7 +742,7 @@ If you use APIs through aliases or wrappers that obscure the original call site.
   // @name             My Script
 + // @resource myCSS   https://example.com/style.css
   // ==/UserScript==
-  
+
   const css = GM_getResourceText('myCSS')
 ```
 
@@ -603,9 +771,11 @@ If you reference resources through an alias or computed pattern that obscures th
 
 <h3 id="no-unused-grants">
     <code>no-unused-grants</code>
+    <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
+        <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-unused-grants">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -628,7 +798,7 @@ If you reference resources through an alias or computed pattern that obscures th
   // ==UserScript==
   // @grant   GM_setValue
   // ==/UserScript==
-  
+
 + GM_setValue('key', 'value')
 ```
 
@@ -645,7 +815,7 @@ If you access the granted API through an alias or computed property rather than
 - [`no-invalid-grants`](#no-invalid-grants)
     <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
-    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
     <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
@@ -665,9 +835,11 @@ If you access the granted API through an alias or computed property rather than
 
 <h3 id="no-unused-resources">
     <code>no-unused-resources</code>
+    <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
+        <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23no-unused-resources">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -690,7 +862,7 @@ If you access the granted API through an alias or computed property rather than
   // ==UserScript==
   // @resource myCSS   https://example.com/style.css
   // ==/UserScript==
-  
+
 + const css = GM_getResourceText('myCSS')
 ```
 
@@ -717,11 +889,68 @@ If you pass resource names through variables or aliases rather than use them lit
 
 </details>
 
+<h3 id="prefer-gm-add-style">
+    <code>prefer-gm-add-style</code>
+    <a title="Introduced in recent release" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">
+        <img height=16 align="middle" src="https://api.iconify.design/mdi/sprout.svg?color=%234a4a4a"></a>
+    <a title="Only included in strict config" href="#usage">
+        <img height=18 alt="[Strict only]" src="https://img.shields.io/badge/Strict_only-ff8c42?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23prefer-gm-add-style">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Prefers <code>GM_addStyle()</code> or a shadow root over manual <code>&lt;style&gt;</code> injection.</summary>
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+! const style = document.createElement('style')
+! style.textContent = 'body { color: red }'
+! document.head.append(style)
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+- const style = document.createElement('style')
+- style.textContent = 'body { color: red }'
+- document.head.append(style)
++ GM_addStyle('body { color: red }')
+```
+
+#### When not to use it
+
+If you deliberately need manual control over the injected `<style>`.
+
+#### Introduced in
+
+<a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.9.0">v1.9.0</a> (October 18, 2026)
+
+#### See also
+
+- <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=GM_addStyle">Tampermonkey — `GM_addStyle`</a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=docs.scriptcat.org&sz=64">&ensp;<a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/api/#gm_addstyle">ScriptCat — `GM_addStyle`</a>
+
+<div align="center">
+
+[Back to index ↑][epg-rules]
+
+</div>
+
+---
+
+</details>
+
 <h3 id="prefer-match">
     <code>prefer-match</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23prefer-match">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -778,7 +1007,7 @@ If you rely on `@include` patterns that cannot be expressed using `@match`.
         <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Doesn't prevent bugs" href="#require-blank-line-after-meta-block">
         <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-blank-line-after-meta-block">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -847,7 +1076,7 @@ If you don't care about visual separation between metadata and code.
         <img height=18 alt="[Strict only]" src="https://img.shields.io/badge/Strict_only-ff8c42?style=flat-square" align="middle"></a>
     <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
         <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-homepage-pair">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -898,11 +1127,13 @@ If you don't care about ensuring homepage URL compatibility across different man
 
 <h3 id="require-matching-localized-fields">
     <code>require-matching-localized-fields</code>
+    <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
+        <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-matching-localized-fields">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -913,13 +1144,13 @@ If you don't care about ensuring homepage URL compatibility across different man
 
 <h4 id="require-matching-localized-fields-options">Options</h4>
 
-- `ignoreLanguages` (default `[]`) – language code(s) to skip (e.g. `'de'` or `['es', 'fr']`)
+- `ignoreLanguages` (default `[]`) – language code(s) to skip (e.g. `'de'` or `['es', 'fr']`) – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
   /* eslint greasemonkey/require-matching-localized-fields: ['error', { ignoreLanguages: ['fr'] }] */
-  
+
   // ==UserScript==
   // @name:en          My Script
 ! // @name:de          Mein Skript
@@ -932,7 +1163,7 @@ If you don't care about ensuring homepage URL compatibility across different man
 
 ```diff
   /* eslint greasemonkey/require-matching-localized-fields: ['error', { ignoreLanguages: ['fr'] }] */
-  
+
   // ==UserScript==
   // @name:en          My Script
   // @name:de          Mein Skript
@@ -970,11 +1201,13 @@ If you intentionally provide localized names without descriptions (or vice versa
 
 <h3 id="require-required-fields">
     <code>require-required-fields</code>
+    <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
+        <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-required-fields">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -985,14 +1218,14 @@ If you intentionally provide localized names without descriptions (or vice versa
 
 <h4 id="require-required-fields-options">Options</h4>
 
-- `fields` (default `['name', 'version']`) – override the required field list
-- `requireMatchOrInclude` (default `true`) – require `@match` or `@include`
+- `fields` (default `['name', 'version']`) – override the required field list – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
+- `requireMatchOrInclude` (default `true`) – require `@match` or `@include` – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
   /* eslint greasemonkey/require-required-fields: ['error', { fields: ['name', 'version', 'license'] }] */
-  
+
   // ==UserScript==
   // @name      My Script
   // ==/UserScript==
@@ -1002,7 +1235,7 @@ If you intentionally provide localized names without descriptions (or vice versa
 
 ```diff
   /* eslint greasemonkey/require-required-fields: ['error', { fields: ['name', 'version', 'license'] }] */
-  
+
   // ==UserScript==
   // @name      My Script
 + // @version   1.0.0
@@ -1045,7 +1278,7 @@ If your script is a work-in-progress, or metadata is injected at build time.
         <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Doesn't prevent bugs" href="#require-space-before-meta-key">
         <img height=18 alt="[Stylistic]" src="https://img.shields.io/badge/Stylistic-af68ff?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-space-before-meta-key">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -1105,11 +1338,13 @@ If you intentionally use a different prefix style.
 
 <h3 id="require-sri-hashing">
     <code>require-sri-hashing</code>
-    <a title="Only included in strict config" href="#usage">
-        <img height=18 alt="[Strict only]" src="https://img.shields.io/badge/Strict_only-ff8c42?style=flat-square" align="middle"></a>
+    <a title="Included in strict config" href="#usage">
+        <img height=18 alt="[Strict]" src="https://img.shields.io/badge/Strict-ff8c42?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-sri-hashing">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -1120,7 +1355,7 @@ If you intentionally use a different prefix style.
 
 <h4 id="require-sri-hashing-options">Options</h4>
 
-- `algorithm` (default `'sha256'`) – SRI hash algorithm(s) to enforce (`'md5'`, `'sha1'`, `'sha256'`, `'sha384'`, `'sha512'`), as a single string or array
+- `algorithm` (default `'sha256'`) – SRI hash algorithm(s) to enforce (`'md5'`, `'sha1'`, `'sha256'`, `'sha384'`, `'sha512'`), as a single string or array – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.5.0">v1.5.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
@@ -1158,6 +1393,9 @@ If you prefer shorter URLs, or don't support users who strictly enforce subresou
 
 #### See also
 
+- [`no-insecure-fetch`](#no-insecure-fetch)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage"><img height=14 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
 - <img height=12 src="https://www.google.com/s2/favicons?domain=tampermonkey.net&sz=64">&ensp;<a target="_blank" href="https://www.tampermonkey.net/documentation.php?q=sri">Tampermonkey — Subresource Integrity</a>
 - <img height=12 src="https://www.google.com/s2/favicons?domain=docs.scriptcat.org&sz=64">&ensp;<a target="_blank" href="https://docs.scriptcat.org/en/docs/dev/meta/#resource-integrity-verification">ScriptCat — Resource Integrity Verification</a>
 
@@ -1181,7 +1419,7 @@ If you prefer shorter URLs, or don't support users who strictly enforce subresou
         <img height=18 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
     <a title="Included in adguard config" href="#usage">
         <img height=18 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-update-download-pair">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -1234,7 +1472,7 @@ If you don't strictly target Tampermonkey, ScriptCat or AdGuard (where `@updateU
     <code>require-user-js-filename</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
-    <a title="Copy rule URL" target="_blank" 
+    <a title="Copy rule URL" target="_blank"
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-greasemonkey%2F%23require-user-js-filename">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
 </h3>
@@ -1276,6 +1514,8 @@ If you intentionally name your userscripts something other than `*.user.js`.
 
 <h3 id="valid-field-values">
     <code>valid-field-values</code>
+    <a title="Introduced in v1.0.0" target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">
+        <img height=18 align="middle" src="https://api.iconify.design/ph/flag-banner-fold-fill.svg?color=%234a4a4a"></a>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
@@ -1291,15 +1531,15 @@ If you intentionally name your userscripts something other than `*.user.js`.
 
 <h4 id="valid-field-values-options">Options</h4>
 
-- `versionType` (default `'semver'`) – version format to enforce (`'semver'`, `'date'`)
-- `allowFutureDate` (default `false`) – allow `@version` dates later than the current date
-- `timezone` (default `''`) – <a target="_blank" href="https://data.iana.org/time-zones/tzdb/zone1970.tab">IANA timezone</a> used to determine the current date (when omitted, only year/month are enforced)
+- `versionType` (default `'semver'`) – version format to enforce (`'semver'`, `'date'`) – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
+- `allowFutureDate` (default `false`) – allow `@version` dates later than the current date – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
+- `timezone` (default `''`) – <a target="_blank" href="https://data.iana.org/time-zones/tzdb/zone1970.tab">IANA timezone</a> used to determine the current date (when omitted, only year/month are enforced) – [since <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/releases/tag/v1.0.0">v1.0.0</a>]
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
   /* eslint greasemonkey/valid-field-values: ['error', { versionType: 'semver' }] */
-  
+
   // ==UserScript==
 ! // @version    abc
 ! // @homepage   not-a-url
@@ -1310,7 +1550,7 @@ If you intentionally name your userscripts something other than `*.user.js`.
 
 ```diff
   /* eslint greasemonkey/valid-field-values: ['error', { versionType: 'semver' }] */
-  
+
   // ==UserScript==
 - // @version    abc
 + // @version    1.0.0
@@ -1332,7 +1572,7 @@ If you use a custom versioning scheme or URLs that aren't standard.
 - [`no-invalid-grants`](#no-invalid-grants)
     <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
-    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
     <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
@@ -1340,7 +1580,7 @@ If you use a custom versioning scheme or URLs that aren't standard.
 - [`no-invalid-headers`](#no-invalid-headers)
     <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
     <a title="Optimized in tampermonkey config" href="#usage"><img height=14 alt="[Tampermonkey]" src="https://img.shields.io/badge/Tampermonkey-00485b?style=flat-square" align="middle"></a>
-    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-f01e07?style=flat-square" align="middle"></a>
+    <a title="Optimized in violentmonkey config" href="#usage"><img height=14 alt="[Violentmonkey]" src="https://img.shields.io/badge/Violentmonkey-c68a3c?style=flat-square" align="middle"></a>
     <a title="Optimized in greasemonkey config" href="#usage"><img height=14 alt="[Greasemonkey]" src="https://img.shields.io/badge/Greasemonkey-6c4d8c?style=flat-square" align="middle"></a>
     <a title="Optimized in scriptcat config" href="#usage"><img height=14 alt="[ScriptCat]" src="https://img.shields.io/badge/ScriptCat-1296dc?style=flat-square" align="middle"></a>
     <a title="Optimized in adguard config" href="#usage"><img height=14 alt="[AdGuard]" src="https://img.shields.io/badge/AdGuard-68bd72?style=flat-square" align="middle"></a>
@@ -1379,7 +1619,7 @@ If you use a custom versioning scheme or URLs that aren't standard.
 ## <img height=30 width=27 align="top" src="https://api.iconify.design/ic/baseline-account-balance.svg?color=%232b2b2a"> License
 
 <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-greasemonkey/src/branch/main/docs/LICENSE.md">
-    <img height=85 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
+    <img height=80 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
 <br><br>
 
 <details>