eslint-plugin-import-next 2.3.5 → 2.3.7

package/src/rules/no-cycle.js

@@ -27,6 +27,7 @@ exports.clearCircularDependencyCache = clearCircularDependencyCache;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const eslint_devkit_2 = require("@interlace/eslint-devkit");
 const eslint_devkit_3 = require("@interlace/eslint-devkit");
+const node_fs_1 = require("node:fs");
 const eslint_devkit_4 = require("@interlace/eslint-devkit");
 /**
  * Module-level shared cache for performance optimization
@@ -57,7 +58,11 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-cycle.md',
             description: 'Detect circular dependencies that cause bundle memory bloat and initialization issues',
+            cwe: 'CWE-407',
+            cvss: 9.5,
+            confidence: 'high',
         },
         messages: {
             // 🎯 Token optimization: 45% reduction (~70→38 tokens per message) for architecture clarity
@@ -104,8 +109,8 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
                 properties: {
                     maxDepth: {
                         type: 'number',
-                        default: 5,
-                        description: 'Maximum depth to traverse when detecting cycles (performance optimization)',
+                        default: Number.MAX_SAFE_INTEGER,
+                        description: 'Maximum depth to traverse when detecting cycles. Default: unlimited (matches eslint-plugin-import and oxlint). Lower values are a performance escape hatch — but with our nonCyclicFiles cache, traversal cost is amortized, and a low cap silently misses cycles deeper than the limit. Set to a finite number only on huge graphs where the bench latency hurts you.',
                     },
                     ignorePatterns: {
                         type: 'array',
@@ -168,7 +173,12 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
     },
     defaultOptions: [
         {
-            maxDepth: 10,
+            // Unlimited: matches eslint-plugin-import (Infinity) and oxlint
+            // (u32::MAX). The earlier default of 10 silently missed any cycle
+            // deeper than 10 hops — verified on next.js's webpack-config.ts
+            // (~12 hops). The nonCyclicFiles cache + the depth-limit-truncation
+            // fix in eslint-devkit's dependency-analysis make unlimited safe.
+            maxDepth: Infinity,
             ignorePatterns: [],
             barrelExports: ['index.ts', 'index.tsx', 'index.js', 'index.jsx'],
             reportAllCycles: true,
@@ -180,7 +190,7 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
     ],
     create(context) {
         const options = context.options[0] || {};
-        const maxDepth = options.maxDepth ?? 10;
+        const maxDepth = options.maxDepth ?? Infinity;
         const ignorePatterns = options.ignorePatterns ?? [
             '**/*.test.ts',
             '**/*.test.tsx',
@@ -196,22 +206,45 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
             'index.js',
             'index.jsx',
         ];
-        const reportAllCycles = options.reportAllCycles ?? true;
+        const _reportAllCycles = options.reportAllCycles ?? true;
         const fixStrategy = options.fixStrategy ?? 'auto';
         const moduleNamingConvention = options.moduleNamingConvention ?? 'semantic';
         const coreModuleSuffix = options.coreModuleSuffix ?? 'core';
         const extendedModuleSuffix = options.extendedModuleSuffix ?? 'extended';
-        const filename = context.getFilename();
-        const workspaceRoot = context.getCwd();
+        const filename = context.filename;
+        // Normalize once per file — on macOS /tmp is a symlink to /private/tmp.
+        // ESLint provides the symlink path; the resolver returns real paths.
+        // Without normalization, path comparisons always fail on macOS.
+        const normalizedFilename = (() => {
+            try {
+                return (0, node_fs_1.realpathSync)(filename);
+            }
+            catch {
+                return filename;
+            }
+        })();
+        const workspaceRoot = context.cwd;
         // Get resolver settings from ESLint settings (compatible with eslint-plugin-import)
-        // eslint-plugin-import uses settings['import/resolver']
+        // eslint-plugin-import uses settings['import/resolver']; allow either the
+        // upstream key or our drop-in `import-next/resolver` form for users
+        // migrating off eslint-plugin-import.
         const settings = context.settings;
         const resolverSettings = settings?.['import/resolver'] ||
-            settings?.['eslint-plugin-llm-optimized/resolver'];
+            settings?.['import-next/resolver'];
         // Skip ignored files early
         if ((0, eslint_devkit_3.shouldIgnoreFile)(filename, ignorePatterns, sharedCache.compiledPatterns)) {
             return {};
         }
+        // Do NOT clear sharedCache.nonCyclicFiles — it is now populated directly
+        // from SCC results (singleton SCCs → provably non-cyclic) and persists
+        // across all files for the entire lint run. Clearing it per-file would
+        // destroy the O(1) fast path for known non-cyclic files.
+        sharedCache.pendingCycleReports.clear();
+        // sharedCache.sccComputed, sccIndex, sccs, nonCyclicFiles — NOT reset.
+        // Per-file dedup set — keyed by import node to ensure each import
+        // statement produces at most one error, even when multiple cycle paths
+        // exist through the same import.
+        const reportedImportNodes = new Set();
         /**
          * Select fix strategy based on cycle characteristics
          */
@@ -257,9 +290,9 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
          * Generate DIRECT IMPORT message
          */
         function generateDirectImportMessage(cycle, sourceImport) {
-            const currentFile = (0, eslint_devkit_3.getBasename)(context.getFilename());
+            const currentFile = (0, eslint_devkit_3.getBasename)(context.filename);
             const targetFile = cycle[1];
-            const relativeImport = (0, eslint_devkit_3.getRelativeImportPath)(context.getFilename(), targetFile);
+            const relativeImport = (0, eslint_devkit_3.getRelativeImportPath)(context.filename, targetFile);
             return {
                 cycle: (0, eslint_devkit_3.formatCycleDisplay)(cycle, workspaceRoot),
                 currentFile,
@@ -333,61 +366,126 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
                     };
             }
         }
-        // Store found cycles to report on specific imports
-        let detectedCycles = [];
         return {
-            Program() {
-                // Clear per-file state
-                detectedCycles = [];
-                // Find ALL circular dependencies starting from current file
-                const cycles = (0, eslint_devkit_4.findAllCircularDependencies)(filename, {
-                    maxDepth,
-                    reportAllCycles,
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            'Program'() {
+                // Program() is now a no-op for SCC — fully lazy SCC extension.
+                // SCC is computed on-demand in ImportDeclaration when source or target
+                // is not yet covered. This matches eslint-plugin-import's lazy
+                // ExportMap approach: no upfront file reads, defer to actual imports.
+                // The global SCC persists across files so each file's SCC is computed
+                // at most once per connected component across the whole lint run.
+            },
+            ImportDeclaration(node) {
+                // Type-only imports are erased at compile time — no runtime cycle risk.
+                if (node.importKind === 'type')
+                    return;
+                // Each import node should produce at most ONE error regardless of how
+                // many distinct cycle paths pass through this import.
+                if (reportedImportNodes.has(node))
+                    return;
+                const importSource = node.source.value;
+                // Resolve using normalizedFilename so resolver output paths match.
+                const resolved = (0, eslint_devkit_4.resolveImportPath)(importSource, {
+                    fromFile: normalizedFilename,
                     workspaceRoot,
                     barrelExports,
                     cache: sharedCache,
                     resolverSettings,
                 });
-                if (cycles.length > 0) {
-                    for (const cycle of cycles) {
-                        // Extract the minimal cycle (the actual loop)
-                        const minimalCycle = (0, eslint_devkit_4.getMinimalCycle)(cycle);
-                        // Only report if current file is part of the minimal cycle
-                        // (not just a file that imports into the cycle)
-                        if (!minimalCycle.includes(filename)) {
-                            continue;
-                        }
-                        const cycleStart = minimalCycle.indexOf(filename);
-                        if (cycleStart === -1)
-                            continue;
-                        const relevantCycle = [
-                            ...minimalCycle.slice(cycleStart),
-                            ...minimalCycle.slice(0, cycleStart),
-                        ];
-                        const cycleHash = (0, eslint_devkit_4.getCycleHash)(relevantCycle);
-                        // Skip if we've already reported this cycle (shared across all files)
-                        if (sharedCache.reportedCycles.has(cycleHash)) {
-                            continue;
-                        }
-                        sharedCache.reportedCycles.add(cycleHash);
-                        // Select the appropriate fix strategy
-                        const strategy = selectFixStrategy(relevantCycle, fixStrategy);
-                        // Find the target of the first import that causes the cycle
-                        const cycleTarget = relevantCycle[1] || relevantCycle[0]; // The next file in the cycle
-                        detectedCycles.push({
-                            cycleTarget,
-                            strategy,
-                            relevantCycle,
-                            cycleHash,
-                        });
-                    }
+                if (!resolved)
+                    return;
+                // =====================================================================
+                // FAST PATH 1: nonCyclicFiles O(1) lookup
+                //
+                // Files in singleton SCCs are added to nonCyclicFiles during SCC
+                // computation. This check is slightly faster than the sccIndex lookup
+                // because it short-circuits before any SCC arithmetic.
+                // =====================================================================
+                if (sharedCache.nonCyclicFiles.has(resolved))
+                    return;
+                // =====================================================================
+                // SCC PRE-CHECK (O(1)) — the proven eslint-plugin-import approach
+                //
+                // If source and target are in DIFFERENT SCCs, no cycle can exist
+                // between them — skip immediately without any graph traversal.
+                // Eliminates ~99% of imports without reading a single file.
+                //
+                // If the target file isn't in the SCC yet, extend the SCC from it
+                // lazily so we can make the correct determination.
+                // =====================================================================
+                // Fully lazy SCC: extend on-demand when source or target not yet covered.
+                // Extending from the TARGET is preferred — if target → source (cycle),
+                // extending from target will discover source and assign both to the same SCC.
+                // Only extend from source as a fallback when target extension doesn't cover it.
+                let tgtSCC = sharedCache.sccIndex.get(resolved);
+                if (tgtSCC === undefined) {
+                    (0, eslint_devkit_4.computeSCCsFromFile)(resolved, {
+                        maxDepth: Infinity,
+                        workspaceRoot,
+                        barrelExports,
+                        cache: sharedCache,
+                        resolverSettings,
+                    });
+                    tgtSCC = sharedCache.sccIndex.get(resolved);
+                }
+                let srcSCC = sharedCache.sccIndex.get(normalizedFilename);
+                if (srcSCC === undefined) {
+                    // Source still not covered after extending from target — source is in a
+                    // different connected component. Extend from source to cover it.
+                    (0, eslint_devkit_4.computeSCCsFromFile)(normalizedFilename, {
+                        maxDepth: Infinity,
+                        workspaceRoot,
+                        barrelExports,
+                        cache: sharedCache,
+                        resolverSettings,
+                    });
+                    srcSCC = sharedCache.sccIndex.get(normalizedFilename);
                 }
+                if (srcSCC === undefined || tgtSCC === undefined || srcSCC !== tgtSCC) {
+                    return;
+                }
+                // =====================================================================
+                // BFS PATH-FINDING — only runs when SCC guarantees a cycle exists.
+                //
+                // findShortestCyclePath does BFS from `resolved` back to
+                // `normalizedFilename`, only traversing files within the same SCC.
+                // This is bounded by the SCC size, not the entire codebase.
+                // =====================================================================
+                const cyclePath = (0, eslint_devkit_4.findShortestCyclePath)(normalizedFilename, resolved, {
+                    maxDepth,
+                    workspaceRoot,
+                    barrelExports,
+                    cache: sharedCache,
+                    resolverSettings,
+                });
+                if (!cyclePath)
+                    return;
+                // Deduplicate: this import node produces exactly one error.
+                reportedImportNodes.add(node);
+                // Build the relevant cycle starting from normalizedFilename.
+                const cycleStart = cyclePath.indexOf(normalizedFilename);
+                const relevantCycle = cycleStart >= 0
+                    ? [...cyclePath.slice(cycleStart), ...cyclePath.slice(0, cycleStart)]
+                    : cyclePath;
+                const strategy = selectFixStrategy(relevantCycle, fixStrategy);
+                const sourceImport = { path: resolved, source: importSource };
+                const { messageId, data } = generateMessageData(relevantCycle, strategy, sourceImport);
+                context.report({ node, messageId, data });
             },
-            ImportDeclaration(node) {
-                // Check if this import is part of any detected circular dependency
+            // Re-export statements (`export { X } from '...'`) create import edges
+            // just like `import { X } from '...'`. Without this handler, cycles
+            // that close through a re-export are invisible to the rule.
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            ExportNamedDeclaration(node) {
+                if (!node.source)
+                    return; // no 'from' clause → not a re-export
+                // Reuse the same logic as ImportDeclaration
+                if (reportedImportNodes.has(node))
+                    return;
                 const importSource = node.source.value;
                 const resolved = (0, eslint_devkit_4.resolveImportPath)(importSource, {
-                    fromFile: filename,
+                    fromFile: normalizedFilename,
                     workspaceRoot,
                     barrelExports,
                     cache: sharedCache,
@@ -395,22 +493,40 @@ exports.noCycle = (0, eslint_devkit_1.createRule)({
                 });
                 if (!resolved)
                     return;
-                for (const cycle of detectedCycles) {
-                    if (resolved === cycle.cycleTarget) {
-                        // This is an import that causes a circular dependency
-                        const sourceImport = {
-                            path: resolved,
-                            source: importSource,
-                        };
-                        // Generate the appropriate message based on strategy
-                        const { messageId, data } = generateMessageData(cycle.relevantCycle, cycle.strategy, sourceImport);
-                        context.report({
-                            node,
-                            messageId,
-                            data,
-                        });
-                    }
+                if (sharedCache.nonCyclicFiles.has(resolved))
+                    return;
+                let tgtSCC = sharedCache.sccIndex.get(resolved);
+                if (tgtSCC === undefined) {
+                    (0, eslint_devkit_4.computeSCCsFromFile)(resolved, {
+                        maxDepth: Infinity,
+                        workspaceRoot,
+                        barrelExports,
+                        cache: sharedCache,
+                        resolverSettings,
+                    });
+                    tgtSCC = sharedCache.sccIndex.get(resolved);
                 }
+                const srcSCC = sharedCache.sccIndex.get(normalizedFilename);
+                if (srcSCC === undefined || tgtSCC === undefined || srcSCC !== tgtSCC)
+                    return;
+                const cyclePath = (0, eslint_devkit_4.findShortestCyclePath)(normalizedFilename, resolved, {
+                    maxDepth,
+                    workspaceRoot,
+                    barrelExports,
+                    cache: sharedCache,
+                    resolverSettings,
+                });
+                if (!cyclePath)
+                    return;
+                reportedImportNodes.add(node);
+                const cycleStart = cyclePath.indexOf(normalizedFilename);
+                const relevantCycle = cycleStart >= 0
+                    ? [...cyclePath.slice(cycleStart), ...cyclePath.slice(0, cycleStart)]
+                    : cyclePath;
+                const strategy = selectFixStrategy(relevantCycle, fixStrategy);
+                const sourceImport = { path: resolved, source: importSource };
+                const { messageId, data } = generateMessageData(relevantCycle, strategy, sourceImport);
+                context.report({ node, messageId, data });
             },
         };
     },

package/src/rules/no-default-export.js

@@ -13,6 +13,7 @@ exports.noDefaultExport = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-default-export.md',
             description: 'Prevents default exports',
         },
         fixable: 'code',
@@ -80,7 +81,7 @@ exports.noDefaultExport = (0, eslint_devkit_1.createRule)({
     create(context) {
         const [options] = context.options;
         const { allowInFiles = [], allowPatterns = [], suggestNamed = true, } = options || {};
-        const filename = context.getFilename();
+        const filename = context.filename;
         function shouldAllow() {
             if (!filename) {
                 return false;

package/src/rules/no-deprecated.js

@@ -13,6 +13,7 @@ exports.noDeprecated = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-deprecated.md',
             description: 'Forbid imported names marked with @deprecated documentation tag',
         },
         hasSuggestions: true,
@@ -83,7 +84,7 @@ exports.noDeprecated = (0, eslint_devkit_1.createRule)({
     create(context) {
         const [options] = context.options;
         const { allow = [], deprecationMarkers = ['@deprecated'], checkJSDoc = true, checkDecorators = true, } = options || {};
-        const filename = context.getFilename();
+        const filename = context.filename;
         if (!filename) {
             return {};
         }

package/src/rules/no-duplicates.js

@@ -13,6 +13,7 @@ exports.noDuplicates = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-duplicates.md',
             description: 'Reports duplicate imports',
         },
         fixable: 'code',

package/src/rules/no-dynamic-require.js

@@ -12,7 +12,10 @@ exports.noDynamicRequire = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-dynamic-require.md',
             description: 'Forbid require() calls with expressions',
+            cwe: 'CWE-829',
+            cvss: 5,
         },
         messages: {
             dynamicRequire: (0, eslint_devkit_1.formatLLMMessage)({

package/src/rules/no-empty-named-blocks.js

@@ -12,7 +12,10 @@ exports.noEmptyNamedBlocks = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-empty-named-blocks.md',
             description: 'Forbid empty named import blocks',
+            cwe: 'CWE-561',
+            cvss: 2.5,
         },
         fixable: 'code',
         hasSuggestions: true,
@@ -40,7 +43,7 @@ exports.noEmptyNamedBlocks = (0, eslint_devkit_1.createRule)({
                 const hasNamespaceImport = node.specifiers.some((spec) => spec.type === 'ImportNamespaceSpecifier');
                 const namedImports = node.specifiers.filter((spec) => spec.type === 'ImportSpecifier');
                 // Get the source code
-                const sourceCode = context.getSourceCode();
+                const sourceCode = context.sourceCode;
                 const importText = sourceCode.getText(node);
                 // Check for empty braces pattern: {}
                 const hasEmptyBraces = /\{\s*\}/.test(importText);

package/src/rules/no-extraneous-dependencies.js

@@ -15,6 +15,7 @@ exports.noExtraneousDependencies = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-extraneous-dependencies.md',
             description: 'Forbid the use of extraneous packages not listed in package.json',
         },
         hasSuggestions: true,
@@ -134,7 +135,7 @@ exports.noExtraneousDependencies = (0, eslint_devkit_1.createRule)({
     create(context) {
         const [options] = context.options;
         const { devDependencies = true, optionalDependencies = true, peerDependencies = true, bundledDependencies = true, packageJsonPath, packageJson, resolutionStrategy = 'strict', allowPatterns = [], } = options || {};
-        const filename = context.getFilename();
+        const filename = context.filename;
         if (!filename) {
             return {};
         }
@@ -188,6 +189,7 @@ exports.noExtraneousDependencies = (0, eslint_devkit_1.createRule)({
         if (bundledDependencies && resolvedPackageJson?.bundledDependencies) {
             resolvedPackageJson.bundledDependencies.forEach((pkg) => allowedPackages.add(pkg));
         }
+        // oxlint-disable-next-line consistent-function-scoping
         function isExternalPackage(importPath) {
             // Skip relative imports
             if (importPath.startsWith('./') || importPath.startsWith('../')) {
@@ -265,6 +267,7 @@ exports.noExtraneousDependencies = (0, eslint_devkit_1.createRule)({
                 : importPath.split('/')[0];
             return packageName;
         }
+        // oxlint-disable-next-line consistent-function-scoping
         function isWorkspacePackage(packageName) {
             // For testing purposes, consider packages with @workspace/ or @company/ as workspace packages
             return (packageName.startsWith('@workspace/') ||

package/src/rules/no-full-package-import.js

@@ -79,6 +79,7 @@ exports.noFullPackageImport = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-full-package-import.md',
             description: 'Disallow full package imports from known large packages that prevent tree-shaking',
         },
         hasSuggestions: true,

package/src/rules/no-import-module-exports.js

@@ -12,9 +12,11 @@ exports.noImportModuleExports = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-import-module-exports.md',
             description: 'Forbid import statements with CommonJS module.exports',
+            cwe: 'CWE-1078',
+            cvss: 7.5,
         },
-        fixable: 'code',
         messages: {
             importModuleExports: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: eslint_devkit_1.MessageIcons.ARCHITECTURE,

package/src/rules/no-internal-modules.js

@@ -87,6 +87,7 @@ exports.noInternalModules = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-internal-modules.md',
             description: 'Forbid importing the submodules of other modules',
         },
         fixable: 'code',

package/src/rules/no-legacy-imports.js

@@ -25,6 +25,7 @@ exports.noLegacyImports = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-legacy-imports.md',
             description: 'Detect imports from deprecated internal paths and suggest alternatives',
         },
         fixable: 'code',

package/src/rules/no-mutable-exports.js

@@ -13,6 +13,7 @@ exports.noMutableExports = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-mutable-exports.md',
             description: 'Forbid the use of mutable exports with `var` or `let`',
         },
         hasSuggestions: false,
@@ -70,7 +71,7 @@ exports.noMutableExports = (0, eslint_devkit_1.createRule)({
     create(context) {
         const [options] = context.options;
         const { allowInFiles = [], ignoreExports = [] } = options || {};
-        const filename = context.getFilename();
+        const filename = context.filename;
         if (!filename) {
             return {};
         }

package/src/rules/no-named-as-default-member.js

@@ -12,7 +12,10 @@ exports.noNamedAsDefaultMember = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-named-as-default-member.md',
             description: 'Forbid use of exported name as property of default export',
+            cwe: 'CWE-1078',
+            cvss: 2.5,
         },
         messages: {
             namedAsDefaultMember: (0, eslint_devkit_1.formatLLMMessage)({

package/src/rules/no-named-as-default.js

@@ -12,7 +12,10 @@ exports.noNamedAsDefault = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-named-as-default.md',
             description: 'Forbid use of exported name as identifier of default export',
+            cwe: 'CWE-1078',
+            cvss: 5,
         },
         messages: {
             namedAsDefault: (0, eslint_devkit_1.formatLLMMessage)({

package/src/rules/no-named-default.js

@@ -12,7 +12,10 @@ exports.noNamedDefault = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-named-default.md',
             description: 'Forbid named default exports',
+            cwe: 'CWE-1078',
+            cvss: 2.5,
         },
         messages: {
             namedDefault: (0, eslint_devkit_1.formatLLMMessage)({

package/src/rules/no-named-export.js

@@ -13,6 +13,7 @@ exports.noNamedExport = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-named-export.md',
             description: 'Prevents named exports',
         },
         hasSuggestions: false,
@@ -82,7 +83,7 @@ exports.noNamedExport = (0, eslint_devkit_1.createRule)({
         const { allowInFiles = [], allowNames = [], allowPatterns = [],
         // suggestDefault // unused option
          } = options || {};
-        const filename = context.getFilename();
+        const filename = context.filename;
         function shouldAllow(specifier) {
             if (!filename) {
                 return false;

package/src/rules/no-namespace.js

@@ -12,9 +12,11 @@ exports.noNamespace = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'suggestion',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-namespace.md',
             description: 'Forbid namespace (a.k.a. "wildcard" *) imports',
+            cwe: 'CWE-1078',
+            cvss: 2.5,
         },
-        fixable: 'code',
         messages: {
             noNamespace: (0, eslint_devkit_1.formatLLMMessage)({
                 icon: eslint_devkit_1.MessageIcons.ARCHITECTURE,
@@ -45,12 +47,16 @@ exports.noNamespace = (0, eslint_devkit_1.createRule)({
         const ignorePatterns = options.ignore || [];
         function isIgnored(source) {
             return ignorePatterns.some((pattern) => {
-                // Simple glob matching
+                // Escape ALL regex metacharacters — including `*`, `?`, and `\` — so
+                // the subsequent replaces can find the now-escaped `\*` and `\?` and
+                // translate them back to glob meanings. Without escaping `*` and `?`,
+                // the inner replaces don't match anything and raw `*` / `?` reach
+                // `new RegExp()` (CodeQL: `js/incomplete-sanitization`).
+                const escaped = pattern.replace(/[.+^${}()|[\]\\*?]/g, '\\$&');
                 const regex = new RegExp('^' +
-                    pattern
-                        .replace(/\*/g, '.*')
-                        .replace(/\?/g, '.')
-                        .replace(/\//g, '\\/') +
+                    escaped
+                        .replace(/\\\*/g, '.*')
+                        .replace(/\\\?/g, '.') +
                     '$');
                 return regex.test(source);
             });

package/src/rules/no-nodejs-modules.js

@@ -64,6 +64,7 @@ exports.noNodejsModules = (0, eslint_devkit_1.createRule)({
     meta: {
         type: 'problem',
         docs: {
+            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/docs/rules/no-nodejs-modules.md',
             description: 'Prevents Node.js builtin imports',
         },
         messages: {
@@ -146,6 +147,7 @@ exports.noNodejsModules = (0, eslint_devkit_1.createRule)({
             }
             return false;
         }
+        // oxlint-disable-next-line consistent-function-scoping
         function getBuiltinName(moduleName) {
             if (moduleName.startsWith('node:')) {
                 return moduleName.slice(5);
@@ -189,7 +191,7 @@ exports.noNodejsModules = (0, eslint_devkit_1.createRule)({
                 data: {
                     moduleName,
                     builtinName,
-                    currentFile: context.getFilename(),
+                    currentFile: context.filename,
                     alternative,
                     suggestion: fixSuggestion,
                 },