eslint-plugin-no-mistakes 0.92.0 → 0.94.0

package/README.md

@@ -47,6 +47,13 @@ See [options and examples](../../docs/eslint-rules/no-comment-phrases.md).
 `forbidden-member-chains` is an opt-in rule for configured static member-access chains.
 See [options and examples](../../docs/eslint-rules/forbidden-member-chains.md).
 
+`no-object-mutation` is an opt-in rule for shared object writes and mutating calls.
+See [options and examples](../../docs/eslint-rules/no-object-mutation.md).
+
+`postgres-no-async-sql-builder` is an opt-in rule for async SQL builders that never wait.
+It suggests removing `async` only when the visible contract allows a synchronous return, and it never autofixes.
+See [options and examples](../../docs/eslint-rules/postgres-no-async-sql-builder.md).
+
 `require-options-on-imported-call` requires a static options object on configured
 imports, globals with no local binding, and terminal methods with a matching receiver shape.
 See [options and examples](../../docs/eslint-rules/require-options-on-imported-call.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-no-mistakes",
-  "version": "0.92.0",
+  "version": "0.94.0",
   "description": "ESLint and Oxlint rules that keep code static enough for no-mistakes analyzers and coding agents",
   "license": "MIT",
   "repository": {
@@ -22,10 +22,10 @@
   },
   "devDependencies": {
     "@typescript-eslint/parser": "^8.71.1",
-    "@vitest/coverage-v8": "^5.0.3",
+    "@vitest/coverage-v8": "^5.0.4",
     "eslint": "^10.12.0",
     "oxlint": "^1.87.0",
-    "vitest": "^5.0.3"
+    "vitest": "^5.0.4"
   },
   "peerDependencies": {
     "eslint": ">=9"

package/src/index.js

@@ -17,6 +17,7 @@ const rules = {
   "no-banned-import-outside-allowed-paths": require("./rules/no-banned-import-outside-allowed-paths"),
   "no-global-fetch-outside-helper": require("./rules/no-global-fetch-outside-helper"),
   "no-delete-property": require("./rules/no-delete-property"),
+  "no-object-mutation": require("./rules/no-object-mutation"),
   "no-import-only-test-files": require("./rules/no-import-only-test-files"),
   "no-inline-noop-promise-catch": require("./rules/no-inline-noop-promise-catch"),
   "no-placeholder-never-type-exports": require("./rules/no-placeholder-never-type-exports"),
@@ -37,6 +38,8 @@ const rules = {
   "react-no-iife-in-jsx": require("./rules/react-no-iife-in-jsx"),
   "playwright-unique": require("./rules/playwright-unique"),
   "postgres-cursor-call-contract": require("./rules/postgres-cursor-call-contract"),
+  "postgres-no-async-sql-builder": require("./rules/postgres-no-async-sql-builder"),
+  "postgres-no-executor-adapter": require("./rules/postgres-no-executor-adapter"),
   "postgres-no-manual-transaction": require("./rules/postgres-no-manual-transaction"),
   "postgres-no-unbounded-query-fanout": require("./rules/postgres-no-unbounded-query-fanout"),
   "react-no-nullish-react-node": require("./rules/react-no-nullish-react-node"),

package/src/rules/forbidden-member-chains-destructure.js

@@ -2,12 +2,6 @@
 
 const { matches, expressionInfo } = require("./forbidden-member-chains-match");
 
-const PARAM_PARENTS = new Set([
-  "FunctionDeclaration",
-  "FunctionExpression",
-  "ArrowFunctionExpression",
-]);
-
 function patternKey(prop) {
   const key = prop.key;
   if (key.type === "Identifier") return key.name;
@@ -24,8 +18,19 @@ function objectPattern(node) {
 }
 
 function destructureVisitors({ compiled, context, suppressed, info }) {
+  // The outer pattern and a default can reach the same property and chain.
+  // `const { panel: { open } = other.panel } = other` reports that pair once.
+  const reported = new WeakMap();
+
   function report(node, chain) {
     if (suppressed(node)) return;
+    let seen = reported.get(node);
+    if (seen?.has(chain)) return;
+    if (!seen) {
+      seen = new Set();
+      reported.set(node, seen);
+    }
+    seen.add(chain);
     context.report({ node, messageId: "forbiddenChain", data: { message: chain.message } });
   }
 
@@ -63,8 +68,11 @@ function destructureVisitors({ compiled, context, suppressed, info }) {
       const pattern = objectPattern(node.left);
       if (pattern) check(pattern, node.right);
     },
+    // A default is a receiver at any depth, not only on a function parameter.
+    // The parser only allows one in a parameter, property, or array element.
+    // `const { x: { open } = other.panel } = {}` reports `*.panel.open`.
+    // An array element is too: `const [{ open } = other.panel] = []`.
     AssignmentPattern(node) {
-      if (!PARAM_PARENTS.has(node.parent?.type)) return;
       const pattern = objectPattern(node.left);
       if (pattern) check(pattern, node.right);
     },

package/src/rules/forbidden-member-chains-schema.js

@@ -17,29 +17,19 @@ function nonStar() {
   return text(128, "^(?!\\*$)[\\s\\S]+$");
 }
 
-function pathString(pattern) {
-  return text(256, pattern);
-}
-
-function segments(maxItems) {
-  return { type: "array", minItems: 1, maxItems, items: nonStar() };
-}
-
-function starThen(minItems, maxItems) {
-  return {
-    type: "array",
-    minItems,
-    maxItems,
-    items: [{ enum: ["*"] }],
-    additionalItems: nonStar(),
-  };
-}
-
-function pathSchema(pattern, starMin, plainMax, starMax) {
-  return {
-    anyOf: [pathString(pattern), segments(plainMax), starThen(starMin, starMax)],
-  };
-}
+// Segment rules run in assertPath so a bad path names the segment. A JSON Schema
+// anyOf only says the value matched none of the alternatives.
+const pathValue = {
+  anyOf: [
+    { type: "string", minLength: 1, maxLength: 256 },
+    {
+      type: "array",
+      minItems: 1,
+      maxItems: 32,
+      items: { type: "string", minLength: 1, maxLength: 128 },
+    },
+  ],
+};
 
 function chain(properties, required) {
   return {
@@ -60,20 +50,17 @@ const schema = [
         maxItems: 64,
         items: {
           anyOf: [
-            chain({ path: pathSchema(OPEN_PATH, 2, MAX_SEGMENTS, MAX_SEGMENTS) }, [
-              "path",
-              "message",
-            ]),
+            chain({ path: pathValue }, ["path", "message"]),
             chain(
               {
-                path: pathSchema(OPEN_PATH, 2, MAX_SEGMENTS, MAX_SEGMENTS),
+                path: pathValue,
                 receiver: { type: "string", enum: ["*"] },
               },
               ["path", "message", "receiver"],
             ),
             chain(
               {
-                path: pathSchema(NAMED_PATH, 1, MAX_SEGMENTS - 1, MAX_SEGMENTS),
+                path: pathValue,
                 receiver: nonStar(),
               },
               ["path", "message", "receiver"],
@@ -85,7 +72,48 @@ const schema = [
   },
 ];
 
+function shownPath(path) {
+  return Array.isArray(path) ? path.join(".") : String(path);
+}
+
+function assertPath(path, named) {
+  const parts = Array.isArray(path) ? path : String(path).split(".");
+  const shown = shownPath(path);
+  const empty = parts.findIndex((part) => part === "");
+  if (empty !== -1) throw new Error(`empty segment at index ${empty} in '${shown}'`);
+  const star = parts.findIndex((part, index) => part === "*" && index !== 0);
+  if (star !== -1) {
+    throw new Error(`'*' segment at index ${star} in '${shown}'; '*' is only a leading segment`);
+  }
+  if (typeof path === "string") {
+    const pattern = new RegExp(named ? NAMED_PATH : OPEN_PATH);
+    if (pattern.test(path)) return;
+    const limit = named && parts[0] !== "*" ? MAX_SEGMENTS - 1 : MAX_SEGMENTS;
+    if (parts.length > limit) {
+      throw new Error(`path '${shown}' has ${parts.length} segments; the maximum is ${limit}`);
+    }
+    throw new Error(`malformed path '${shown}'`);
+  }
+  const leadingStar = parts[0] === "*";
+  const limit = leadingStar ? MAX_SEGMENTS : named ? MAX_SEGMENTS - 1 : MAX_SEGMENTS;
+  const min = leadingStar ? (named ? 1 : 2) : 1;
+  if (parts.length < min) {
+    throw new Error(`path '${shown}' has ${parts.length} segments; at least ${min} are required`);
+  }
+  if (parts.length > limit) {
+    throw new Error(`path '${shown}' has ${parts.length} segments; the maximum is ${limit}`);
+  }
+}
+
+function assertChains(entries) {
+  if (!Array.isArray(entries)) return;
+  for (const entry of entries) {
+    assertPath(entry.path, typeof entry.receiver === "string" && entry.receiver !== "*");
+  }
+}
+
 function compile(entry) {
+  assertPath(entry.path, typeof entry.receiver === "string" && entry.receiver !== "*");
   const parts = Array.isArray(entry.path) ? entry.path.slice() : entry.path.split(".");
   let wildcard = false;
   let body = parts;
@@ -101,4 +129,4 @@ function compile(entry) {
   return { wildcard, parts: body, message: entry.message };
 }
 
-module.exports = { schema, compile };
+module.exports = { schema, compile, assertChains };

package/src/rules/forbidden-member-chains.js

@@ -1,7 +1,7 @@
 "use strict";
 
 const { ruleSuppression } = require("../rule-suppression");
-const { schema, compile } = require("./forbidden-member-chains-schema");
+const { schema, compile, assertChains } = require("./forbidden-member-chains-schema");
 const {
   matches,
   computeChain,
@@ -20,6 +20,7 @@ module.exports = {
   create(context) {
     const compiled = [];
     const entries = context.options[0]?.chains;
+    assertChains(entries);
     if (Array.isArray(entries)) {
       for (const entry of entries) compiled.push(compile(entry));
     }

package/src/rules/imported-call-options.js

@@ -6,8 +6,12 @@ const { isDefinitelyUndefinedValue } = require("./imported-call-undefined");
 const { propertyName, literalString } = require("./module-mock-helpers");
 
 const pathPatternList = { type: "array", items: { type: "string" } };
-// Slash-wrapped values are regexes. An unclosed class such as `/[/` must fail
-// here, before the rule can drop the target and match nothing.
+// A leading `/` is a wrapped regex, not a glob. The body cannot contain an
+// unescaped `/`, so `/^@acme/http$/` and `/abs/**` fail here instead of
+// matching a package path or an absolute glob. Escape slashes
+// (`/^@acme\/http$/`) or write a glob that does not start with `/`.
+// An unclosed class such as `/[/` must also fail before the rule can drop
+// the target and match nothing.
 const selectorPattern = {
   type: "string",
   minLength: 1,

package/src/rules/no-object-mutation-bind.js

@@ -0,0 +1,167 @@
+"use strict";
+
+const api = require("./no-object-mutation-runtime");
+const { considerWrite } = require("./no-object-mutation-write");
+const { literalKey, memberKey, staticKey } = require("./no-object-mutation-syntax");
+const { elementTag, freshCopy, readMember, shared } = require("./no-object-mutation-values");
+
+function bindName(name, tag, scope, kind) {
+  const target = kind === "var" ? scope.functionEnv : scope;
+  if (target.isModule) {
+    target.cells.set(name, {
+      kind: "module",
+      tag: tag?.type === "mapset" ? tag : shared("module"),
+    });
+    return;
+  }
+  target.cells.set(name, { kind, tag });
+}
+
+function bindingScope(scope, name) {
+  for (let cursor = scope; cursor; cursor = cursor.outer) {
+    if (cursor.cells.has(name)) {
+      return cursor;
+    }
+  }
+  return null;
+}
+
+function bindingEscapes(scope, name) {
+  const owner = bindingScope(scope, name);
+  if (!owner) {
+    return false;
+  }
+  const cell = owner.cells.get(name);
+  if (cell.kind === "import") {
+    return false;
+  }
+  // A local `let` in this function can still be a builder. A cell in the
+  // module or another function can be read after this write.
+  return owner.isModule || owner.functionEnv !== scope.functionEnv;
+}
+
+function assignBinding(state, name, tag, scope) {
+  const owner = bindingScope(scope, name);
+  const cell = owner?.cells.get(name);
+  if (!cell || cell.kind === "import") {
+    return;
+  }
+  if (bindingEscapes(scope, name)) {
+    api.releaseEscaping(state, tag);
+  }
+  if (cell.kind === "module") {
+    cell.tag = tag?.type === "mapset" ? tag : shared("module");
+    return;
+  }
+  cell.tag = tag;
+}
+
+function assignPattern(state, pattern, tag, scope) {
+  if (pattern.type === "MemberExpression") {
+    considerWrite(state, api.visit(state, pattern.object, scope, "read"), pattern, {
+      viaCall: false,
+      objectNode: pattern,
+      key: memberKey(pattern),
+      rhs: tag,
+      scope,
+    });
+    return;
+  }
+  if (pattern.type === "Identifier") {
+    assignBinding(state, pattern.name, tag, scope);
+    return;
+  }
+  if (pattern.type === "AssignmentPattern") {
+    api.visit(state, pattern.right, scope, "read");
+    assignPattern(state, pattern.left, tag, scope);
+    return;
+  }
+  if (pattern.type === "RestElement") {
+    assignPattern(state, pattern.argument, freshCopy(tag, scope), scope);
+    return;
+  }
+  if (pattern.type === "ObjectPattern") {
+    for (const property of pattern.properties) {
+      if (property.type === "RestElement") {
+        assignPattern(state, property.argument, freshCopy(tag, scope), scope);
+        continue;
+      }
+      const key = property.computed ? literalKey(property.key) : staticKey(property.key);
+      if (property.computed) {
+        api.visit(state, property.key, scope, "read");
+      }
+      assignPattern(state, property.value, key ? readMember(tag, key) : tag, scope);
+    }
+    return;
+  }
+  if (pattern.type === "ArrayPattern") {
+    for (const element of pattern.elements) {
+      if (element === null) {
+        continue;
+      }
+      assignPattern(state, element, elementTag(tag), scope);
+    }
+  }
+}
+
+function bindPattern(state, pattern, tag, scope, kind) {
+  if (pattern.type === "TSParameterProperty") {
+    bindPattern(
+      state,
+      pattern.parameter,
+      kind === "param" ? shared("parameter") : tag,
+      scope,
+      kind,
+    );
+    return;
+  }
+  if (pattern.type === "Identifier") {
+    bindName(pattern.name, kind === "param" ? shared("parameter") : tag, scope, kind);
+    return;
+  }
+  if (pattern.type === "AssignmentPattern") {
+    api.visit(state, pattern.right, scope, "read");
+    bindPattern(state, pattern.left, kind === "param" ? shared("parameter") : tag, scope, kind);
+    return;
+  }
+  if (pattern.type === "RestElement") {
+    const next = kind === "param" ? shared("parameter") : freshCopy(tag, scope);
+    bindPattern(state, pattern.argument, next, scope, kind);
+    return;
+  }
+  if (pattern.type === "ObjectPattern") {
+    for (const property of pattern.properties) {
+      if (property.type === "RestElement") {
+        const next = kind === "param" ? shared("parameter") : freshCopy(tag, scope);
+        bindPattern(state, property.argument, next, scope, kind);
+        continue;
+      }
+      let key = null;
+      if (property.computed) {
+        api.visit(state, property.key, scope, "read");
+        key = literalKey(property.key);
+      } else {
+        key = staticKey(property.key);
+      }
+      const field = kind === "param" ? shared("parameter") : key ? readMember(tag, key) : tag;
+      bindPattern(state, property.value, field, scope, kind);
+    }
+    return;
+  }
+  for (const element of pattern.elements) {
+    // The else is required. An if/continue here makes v8 record a negative branch.
+    if (element === null) {
+      continue;
+    } else {
+      const next = kind === "param" ? shared("parameter") : elementTag(tag);
+      bindPattern(state, element, next, scope, kind);
+    }
+  }
+}
+
+module.exports = {
+  assignPattern,
+  bindingEscapes,
+  bindName,
+  bindPattern,
+};

package/src/rules/no-object-mutation-build.js

@@ -0,0 +1,113 @@
+"use strict";
+
+const api = require("./no-object-mutation-runtime");
+const { assignPattern, bindingEscapes } = require("./no-object-mutation-bind");
+const { readOnlyFresh } = require("./no-object-mutation-join");
+const { considerWrite, markEscaped } = require("./no-object-mutation-write");
+const { literalKey, memberKey, staticKey } = require("./no-object-mutation-syntax");
+const { createFresh, remember, unknown } = require("./no-object-mutation-values");
+
+const SKIP_KEYS = new Set([
+  "decorators",
+  "end",
+  "loc",
+  "parent",
+  "range",
+  "returnType",
+  "start",
+  "tokens",
+  "typeAnnotation",
+  "typeParameters",
+]);
+
+function visitAssignment(state, node, scope) {
+  if (node.left.type === "MemberExpression") {
+    const target = api.visit(state, node.left.object, scope, "read");
+    const rhs = api.visit(state, node.right, scope, readOnlyFresh(target) ? "read" : "escape");
+    considerWrite(state, target, node, {
+      viaCall: false,
+      objectNode: node.left,
+      key: memberKey(node.left),
+      rhs,
+      scope,
+    });
+    return rhs;
+  }
+  const escapes = node.left.type === "Identifier" && bindingEscapes(scope, node.left.name);
+  const rhs = api.visit(state, node.right, scope, escapes ? "escape" : "read");
+  assignPattern(state, node.left, rhs, scope);
+  return rhs;
+}
+
+function visitObject(state, node, scope, role) {
+  const fresh = createFresh(scope);
+  for (const property of node.properties) {
+    if (property.type === "SpreadElement") {
+      remember(fresh, api.visit(state, property.argument, scope, "read"));
+      continue;
+    }
+    if (property.computed) {
+      api.visit(state, property.key, scope, "read");
+    }
+    const value = api.visit(state, property.value, scope, "read");
+    if (property.kind !== "init" || property.method) {
+      // Methods are not data fields, but they escape with the object.
+      fresh.items.push(value);
+      remember(fresh, unknown());
+      continue;
+    }
+    const key = property.computed ? literalKey(property.key) : staticKey(property.key);
+    if (key) {
+      fresh.fields.set(key, value);
+    } else {
+      remember(fresh, value);
+    }
+  }
+  if (role === "escape") {
+    markEscaped(state, fresh);
+  }
+  return fresh;
+}
+
+function visitArray(state, node, scope, role) {
+  const fresh = createFresh(scope);
+  for (const element of node.elements) {
+    if (!element) {
+      continue;
+    }
+    remember(
+      fresh,
+      element.type === "SpreadElement"
+        ? api.visit(state, element.argument, scope, "read")
+        : api.visit(state, element, scope, "read"),
+    );
+  }
+  if (role === "escape") {
+    markEscaped(state, fresh);
+  }
+  return fresh;
+}
+
+function walkChildren(state, node, scope) {
+  for (const key of Object.keys(node)) {
+    if (SKIP_KEYS.has(key)) {
+      continue;
+    }
+    const value = node[key];
+    if (Array.isArray(value)) {
+      // visit ignores a hole and a value that is not a syntax node.
+      for (const childNode of value) {
+        api.visit(state, childNode, scope, "read");
+      }
+    } else if (value && typeof value.type === "string") {
+      api.visit(state, value, scope, "read");
+    }
+  }
+}
+
+module.exports = {
+  visitArray,
+  visitAssignment,
+  visitObject,
+  walkChildren,
+};

package/src/rules/no-object-mutation-call.js

@@ -0,0 +1,121 @@
+"use strict";
+
+const api = require("./no-object-mutation-runtime");
+const { callFunction, escapeFunction } = require("./no-object-mutation-fn");
+const { mutationCall } = require("./no-object-mutation-syntax");
+const { readOnlyFresh } = require("./no-object-mutation-join");
+const { callable, lookup, unknown, unwrap } = require("./no-object-mutation-model");
+const { considerWrite } = require("./no-object-mutation-write");
+
+function visitArgument(state, argument, scope, role) {
+  if (argument.type === "SpreadElement") {
+    return api.visit(state, argument.argument, scope, role);
+  }
+  return api.visit(state, argument, scope, role);
+}
+
+function visitNew(state, node, scope) {
+  const callee = unwrap(node.callee);
+  let tag = unknown();
+  if (
+    callee?.type === "Identifier" &&
+    (callee.name === "Map" || callee.name === "Set") &&
+    !lookup(scope, callee.name)
+  ) {
+    tag = { type: "mapset" };
+  } else {
+    api.visit(state, node.callee, scope, "read");
+  }
+  for (const argument of node.arguments) {
+    visitArgument(state, argument, scope, "escape");
+  }
+  return tag;
+}
+
+function visitCall(state, node, scope) {
+  const mutation = mutationCall(node, scope);
+  if (mutation) {
+    const target = api.visit(state, mutation.targetNode, scope, "read");
+    const argRole = readOnlyFresh(target) ? "read" : "escape";
+    const remembered = [];
+    for (const argument of mutation.otherArgs) {
+      remembered.push(visitArgument(state, argument, scope, argRole));
+    }
+    considerWrite(state, target, node, {
+      viaCall: true,
+      objectNode: mutation.targetNode,
+      scope,
+      remembered,
+    });
+    if (readOnlyFresh(target)) {
+      return target;
+    }
+    return unknown();
+  }
+  const calleeTag = api.visit(state, node.callee, scope, "read");
+  for (const argument of node.arguments) {
+    visitArgument(state, argument, scope, "escape");
+  }
+  invokeCallable(state, calleeTag);
+  return unknown();
+}
+
+function invokeCallable(state, tag) {
+  if (tag.type === "union") {
+    for (const member of tag.members) {
+      invokeCallable(state, member);
+    }
+    return;
+  }
+  const fn = callable(tag);
+  if (fn) {
+    callFunction(state, fn);
+  } else {
+    return;
+  }
+}
+
+function captureOuter(scope, tag, seen) {
+  if (!tag || !scope.fnTag) {
+    return;
+  }
+  const local = seen || new Set();
+  if (local.has(tag)) {
+    return;
+  }
+  local.add(tag);
+  if (tag.type === "union") {
+    for (const member of tag.members) {
+      captureOuter(scope, member, local);
+    }
+    return;
+  }
+  if (tag.type === "fresh" && tag.ownerEnv !== scope.ownerEnv) {
+    scope.fnTag.captured.push(tag);
+  }
+}
+
+function visitIdentifier(state, node, scope, role) {
+  const tag = lookup(scope, node.name)?.tag;
+  if (role === "escape") {
+    api.releaseEscaping(state, tag);
+  }
+  captureOuter(scope, tag);
+  return tag || unknown();
+}
+
+function escapeExport(state, local, scope) {
+  const fn = callable(lookup(scope, local.name)?.tag);
+  if (fn) {
+    escapeFunction(state, fn);
+  } else {
+    return;
+  }
+}
+
+module.exports = {
+  escapeExport,
+  visitCall,
+  visitIdentifier,
+  visitNew,
+};