eslint-plugin-no-mistakes 0.93.0 → 0.94.0

package/README.md

@@ -47,6 +47,13 @@ See [options and examples](../../docs/eslint-rules/no-comment-phrases.md).
 `forbidden-member-chains` is an opt-in rule for configured static member-access chains.
 See [options and examples](../../docs/eslint-rules/forbidden-member-chains.md).
 
+`no-object-mutation` is an opt-in rule for shared object writes and mutating calls.
+See [options and examples](../../docs/eslint-rules/no-object-mutation.md).
+
+`postgres-no-async-sql-builder` is an opt-in rule for async SQL builders that never wait.
+It suggests removing `async` only when the visible contract allows a synchronous return, and it never autofixes.
+See [options and examples](../../docs/eslint-rules/postgres-no-async-sql-builder.md).
+
 `require-options-on-imported-call` requires a static options object on configured
 imports, globals with no local binding, and terminal methods with a matching receiver shape.
 See [options and examples](../../docs/eslint-rules/require-options-on-imported-call.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-no-mistakes",
-  "version": "0.93.0",
+  "version": "0.94.0",
   "description": "ESLint and Oxlint rules that keep code static enough for no-mistakes analyzers and coding agents",
   "license": "MIT",
   "repository": {
@@ -22,10 +22,10 @@
   },
   "devDependencies": {
     "@typescript-eslint/parser": "^8.71.1",
-    "@vitest/coverage-v8": "^5.0.3",
+    "@vitest/coverage-v8": "^5.0.4",
     "eslint": "^10.12.0",
     "oxlint": "^1.87.0",
-    "vitest": "^5.0.3"
+    "vitest": "^5.0.4"
   },
   "peerDependencies": {
     "eslint": ">=9"

package/src/index.js

@@ -17,6 +17,7 @@ const rules = {
   "no-banned-import-outside-allowed-paths": require("./rules/no-banned-import-outside-allowed-paths"),
   "no-global-fetch-outside-helper": require("./rules/no-global-fetch-outside-helper"),
   "no-delete-property": require("./rules/no-delete-property"),
+  "no-object-mutation": require("./rules/no-object-mutation"),
   "no-import-only-test-files": require("./rules/no-import-only-test-files"),
   "no-inline-noop-promise-catch": require("./rules/no-inline-noop-promise-catch"),
   "no-placeholder-never-type-exports": require("./rules/no-placeholder-never-type-exports"),
@@ -37,6 +38,8 @@ const rules = {
   "react-no-iife-in-jsx": require("./rules/react-no-iife-in-jsx"),
   "playwright-unique": require("./rules/playwright-unique"),
   "postgres-cursor-call-contract": require("./rules/postgres-cursor-call-contract"),
+  "postgres-no-async-sql-builder": require("./rules/postgres-no-async-sql-builder"),
+  "postgres-no-executor-adapter": require("./rules/postgres-no-executor-adapter"),
   "postgres-no-manual-transaction": require("./rules/postgres-no-manual-transaction"),
   "postgres-no-unbounded-query-fanout": require("./rules/postgres-no-unbounded-query-fanout"),
   "react-no-nullish-react-node": require("./rules/react-no-nullish-react-node"),

package/src/rules/imported-call-options.js

@@ -6,8 +6,12 @@ const { isDefinitelyUndefinedValue } = require("./imported-call-undefined");
 const { propertyName, literalString } = require("./module-mock-helpers");
 
 const pathPatternList = { type: "array", items: { type: "string" } };
-// Slash-wrapped values are regexes. An unclosed class such as `/[/` must fail
-// here, before the rule can drop the target and match nothing.
+// A leading `/` is a wrapped regex, not a glob. The body cannot contain an
+// unescaped `/`, so `/^@acme/http$/` and `/abs/**` fail here instead of
+// matching a package path or an absolute glob. Escape slashes
+// (`/^@acme\/http$/`) or write a glob that does not start with `/`.
+// An unclosed class such as `/[/` must also fail before the rule can drop
+// the target and match nothing.
 const selectorPattern = {
   type: "string",
   minLength: 1,

package/src/rules/no-object-mutation-bind.js

@@ -0,0 +1,167 @@
+"use strict";
+
+const api = require("./no-object-mutation-runtime");
+const { considerWrite } = require("./no-object-mutation-write");
+const { literalKey, memberKey, staticKey } = require("./no-object-mutation-syntax");
+const { elementTag, freshCopy, readMember, shared } = require("./no-object-mutation-values");
+
+function bindName(name, tag, scope, kind) {
+  const target = kind === "var" ? scope.functionEnv : scope;
+  if (target.isModule) {
+    target.cells.set(name, {
+      kind: "module",
+      tag: tag?.type === "mapset" ? tag : shared("module"),
+    });
+    return;
+  }
+  target.cells.set(name, { kind, tag });
+}
+
+function bindingScope(scope, name) {
+  for (let cursor = scope; cursor; cursor = cursor.outer) {
+    if (cursor.cells.has(name)) {
+      return cursor;
+    }
+  }
+  return null;
+}
+
+function bindingEscapes(scope, name) {
+  const owner = bindingScope(scope, name);
+  if (!owner) {
+    return false;
+  }
+  const cell = owner.cells.get(name);
+  if (cell.kind === "import") {
+    return false;
+  }
+  // A local `let` in this function can still be a builder. A cell in the
+  // module or another function can be read after this write.
+  return owner.isModule || owner.functionEnv !== scope.functionEnv;
+}
+
+function assignBinding(state, name, tag, scope) {
+  const owner = bindingScope(scope, name);
+  const cell = owner?.cells.get(name);
+  if (!cell || cell.kind === "import") {
+    return;
+  }
+  if (bindingEscapes(scope, name)) {
+    api.releaseEscaping(state, tag);
+  }
+  if (cell.kind === "module") {
+    cell.tag = tag?.type === "mapset" ? tag : shared("module");
+    return;
+  }
+  cell.tag = tag;
+}
+
+function assignPattern(state, pattern, tag, scope) {
+  if (pattern.type === "MemberExpression") {
+    considerWrite(state, api.visit(state, pattern.object, scope, "read"), pattern, {
+      viaCall: false,
+      objectNode: pattern,
+      key: memberKey(pattern),
+      rhs: tag,
+      scope,
+    });
+    return;
+  }
+  if (pattern.type === "Identifier") {
+    assignBinding(state, pattern.name, tag, scope);
+    return;
+  }
+  if (pattern.type === "AssignmentPattern") {
+    api.visit(state, pattern.right, scope, "read");
+    assignPattern(state, pattern.left, tag, scope);
+    return;
+  }
+  if (pattern.type === "RestElement") {
+    assignPattern(state, pattern.argument, freshCopy(tag, scope), scope);
+    return;
+  }
+  if (pattern.type === "ObjectPattern") {
+    for (const property of pattern.properties) {
+      if (property.type === "RestElement") {
+        assignPattern(state, property.argument, freshCopy(tag, scope), scope);
+        continue;
+      }
+      const key = property.computed ? literalKey(property.key) : staticKey(property.key);
+      if (property.computed) {
+        api.visit(state, property.key, scope, "read");
+      }
+      assignPattern(state, property.value, key ? readMember(tag, key) : tag, scope);
+    }
+    return;
+  }
+  if (pattern.type === "ArrayPattern") {
+    for (const element of pattern.elements) {
+      if (element === null) {
+        continue;
+      }
+      assignPattern(state, element, elementTag(tag), scope);
+    }
+  }
+}
+
+function bindPattern(state, pattern, tag, scope, kind) {
+  if (pattern.type === "TSParameterProperty") {
+    bindPattern(
+      state,
+      pattern.parameter,
+      kind === "param" ? shared("parameter") : tag,
+      scope,
+      kind,
+    );
+    return;
+  }
+  if (pattern.type === "Identifier") {
+    bindName(pattern.name, kind === "param" ? shared("parameter") : tag, scope, kind);
+    return;
+  }
+  if (pattern.type === "AssignmentPattern") {
+    api.visit(state, pattern.right, scope, "read");
+    bindPattern(state, pattern.left, kind === "param" ? shared("parameter") : tag, scope, kind);
+    return;
+  }
+  if (pattern.type === "RestElement") {
+    const next = kind === "param" ? shared("parameter") : freshCopy(tag, scope);
+    bindPattern(state, pattern.argument, next, scope, kind);
+    return;
+  }
+  if (pattern.type === "ObjectPattern") {
+    for (const property of pattern.properties) {
+      if (property.type === "RestElement") {
+        const next = kind === "param" ? shared("parameter") : freshCopy(tag, scope);
+        bindPattern(state, property.argument, next, scope, kind);
+        continue;
+      }
+      let key = null;
+      if (property.computed) {
+        api.visit(state, property.key, scope, "read");
+        key = literalKey(property.key);
+      } else {
+        key = staticKey(property.key);
+      }
+      const field = kind === "param" ? shared("parameter") : key ? readMember(tag, key) : tag;
+      bindPattern(state, property.value, field, scope, kind);
+    }
+    return;
+  }
+  for (const element of pattern.elements) {
+    // The else is required. An if/continue here makes v8 record a negative branch.
+    if (element === null) {
+      continue;
+    } else {
+      const next = kind === "param" ? shared("parameter") : elementTag(tag);
+      bindPattern(state, element, next, scope, kind);
+    }
+  }
+}
+
+module.exports = {
+  assignPattern,
+  bindingEscapes,
+  bindName,
+  bindPattern,
+};

package/src/rules/no-object-mutation-build.js

@@ -0,0 +1,113 @@
+"use strict";
+
+const api = require("./no-object-mutation-runtime");
+const { assignPattern, bindingEscapes } = require("./no-object-mutation-bind");
+const { readOnlyFresh } = require("./no-object-mutation-join");
+const { considerWrite, markEscaped } = require("./no-object-mutation-write");
+const { literalKey, memberKey, staticKey } = require("./no-object-mutation-syntax");
+const { createFresh, remember, unknown } = require("./no-object-mutation-values");
+
+const SKIP_KEYS = new Set([
+  "decorators",
+  "end",
+  "loc",
+  "parent",
+  "range",
+  "returnType",
+  "start",
+  "tokens",
+  "typeAnnotation",
+  "typeParameters",
+]);
+
+function visitAssignment(state, node, scope) {
+  if (node.left.type === "MemberExpression") {
+    const target = api.visit(state, node.left.object, scope, "read");
+    const rhs = api.visit(state, node.right, scope, readOnlyFresh(target) ? "read" : "escape");
+    considerWrite(state, target, node, {
+      viaCall: false,
+      objectNode: node.left,
+      key: memberKey(node.left),
+      rhs,
+      scope,
+    });
+    return rhs;
+  }
+  const escapes = node.left.type === "Identifier" && bindingEscapes(scope, node.left.name);
+  const rhs = api.visit(state, node.right, scope, escapes ? "escape" : "read");
+  assignPattern(state, node.left, rhs, scope);
+  return rhs;
+}
+
+function visitObject(state, node, scope, role) {
+  const fresh = createFresh(scope);
+  for (const property of node.properties) {
+    if (property.type === "SpreadElement") {
+      remember(fresh, api.visit(state, property.argument, scope, "read"));
+      continue;
+    }
+    if (property.computed) {
+      api.visit(state, property.key, scope, "read");
+    }
+    const value = api.visit(state, property.value, scope, "read");
+    if (property.kind !== "init" || property.method) {
+      // Methods are not data fields, but they escape with the object.
+      fresh.items.push(value);
+      remember(fresh, unknown());
+      continue;
+    }
+    const key = property.computed ? literalKey(property.key) : staticKey(property.key);
+    if (key) {
+      fresh.fields.set(key, value);
+    } else {
+      remember(fresh, value);
+    }
+  }
+  if (role === "escape") {
+    markEscaped(state, fresh);
+  }
+  return fresh;
+}
+
+function visitArray(state, node, scope, role) {
+  const fresh = createFresh(scope);
+  for (const element of node.elements) {
+    if (!element) {
+      continue;
+    }
+    remember(
+      fresh,
+      element.type === "SpreadElement"
+        ? api.visit(state, element.argument, scope, "read")
+        : api.visit(state, element, scope, "read"),
+    );
+  }
+  if (role === "escape") {
+    markEscaped(state, fresh);
+  }
+  return fresh;
+}
+
+function walkChildren(state, node, scope) {
+  for (const key of Object.keys(node)) {
+    if (SKIP_KEYS.has(key)) {
+      continue;
+    }
+    const value = node[key];
+    if (Array.isArray(value)) {
+      // visit ignores a hole and a value that is not a syntax node.
+      for (const childNode of value) {
+        api.visit(state, childNode, scope, "read");
+      }
+    } else if (value && typeof value.type === "string") {
+      api.visit(state, value, scope, "read");
+    }
+  }
+}
+
+module.exports = {
+  visitArray,
+  visitAssignment,
+  visitObject,
+  walkChildren,
+};

package/src/rules/no-object-mutation-call.js

@@ -0,0 +1,121 @@
+"use strict";
+
+const api = require("./no-object-mutation-runtime");
+const { callFunction, escapeFunction } = require("./no-object-mutation-fn");
+const { mutationCall } = require("./no-object-mutation-syntax");
+const { readOnlyFresh } = require("./no-object-mutation-join");
+const { callable, lookup, unknown, unwrap } = require("./no-object-mutation-model");
+const { considerWrite } = require("./no-object-mutation-write");
+
+function visitArgument(state, argument, scope, role) {
+  if (argument.type === "SpreadElement") {
+    return api.visit(state, argument.argument, scope, role);
+  }
+  return api.visit(state, argument, scope, role);
+}
+
+function visitNew(state, node, scope) {
+  const callee = unwrap(node.callee);
+  let tag = unknown();
+  if (
+    callee?.type === "Identifier" &&
+    (callee.name === "Map" || callee.name === "Set") &&
+    !lookup(scope, callee.name)
+  ) {
+    tag = { type: "mapset" };
+  } else {
+    api.visit(state, node.callee, scope, "read");
+  }
+  for (const argument of node.arguments) {
+    visitArgument(state, argument, scope, "escape");
+  }
+  return tag;
+}
+
+function visitCall(state, node, scope) {
+  const mutation = mutationCall(node, scope);
+  if (mutation) {
+    const target = api.visit(state, mutation.targetNode, scope, "read");
+    const argRole = readOnlyFresh(target) ? "read" : "escape";
+    const remembered = [];
+    for (const argument of mutation.otherArgs) {
+      remembered.push(visitArgument(state, argument, scope, argRole));
+    }
+    considerWrite(state, target, node, {
+      viaCall: true,
+      objectNode: mutation.targetNode,
+      scope,
+      remembered,
+    });
+    if (readOnlyFresh(target)) {
+      return target;
+    }
+    return unknown();
+  }
+  const calleeTag = api.visit(state, node.callee, scope, "read");
+  for (const argument of node.arguments) {
+    visitArgument(state, argument, scope, "escape");
+  }
+  invokeCallable(state, calleeTag);
+  return unknown();
+}
+
+function invokeCallable(state, tag) {
+  if (tag.type === "union") {
+    for (const member of tag.members) {
+      invokeCallable(state, member);
+    }
+    return;
+  }
+  const fn = callable(tag);
+  if (fn) {
+    callFunction(state, fn);
+  } else {
+    return;
+  }
+}
+
+function captureOuter(scope, tag, seen) {
+  if (!tag || !scope.fnTag) {
+    return;
+  }
+  const local = seen || new Set();
+  if (local.has(tag)) {
+    return;
+  }
+  local.add(tag);
+  if (tag.type === "union") {
+    for (const member of tag.members) {
+      captureOuter(scope, member, local);
+    }
+    return;
+  }
+  if (tag.type === "fresh" && tag.ownerEnv !== scope.ownerEnv) {
+    scope.fnTag.captured.push(tag);
+  }
+}
+
+function visitIdentifier(state, node, scope, role) {
+  const tag = lookup(scope, node.name)?.tag;
+  if (role === "escape") {
+    api.releaseEscaping(state, tag);
+  }
+  captureOuter(scope, tag);
+  return tag || unknown();
+}
+
+function escapeExport(state, local, scope) {
+  const fn = callable(lookup(scope, local.name)?.tag);
+  if (fn) {
+    escapeFunction(state, fn);
+  } else {
+    return;
+  }
+}
+
+module.exports = {
+  escapeExport,
+  visitCall,
+  visitIdentifier,
+  visitNew,
+};

package/src/rules/no-object-mutation-expr.js

@@ -0,0 +1,134 @@
+"use strict";
+
+const api = require("./no-object-mutation-runtime");
+const {
+  visitArray,
+  visitAssignment,
+  visitObject,
+  walkChildren,
+} = require("./no-object-mutation-build");
+const { visitCall, visitIdentifier, visitNew } = require("./no-object-mutation-call");
+const { memberKey, unwrap } = require("./no-object-mutation-syntax");
+const { joinValues, readMember, shared, unknown } = require("./no-object-mutation-values");
+const { considerWrite } = require("./no-object-mutation-write");
+
+function visitExpression(state, node, scope, role) {
+  switch (node.type) {
+    case "Identifier":
+      return visitIdentifier(state, node, scope, role);
+    case "ThisExpression":
+      return { type: "this", inClass: Boolean(scope.inClass) };
+    case "Super":
+    case "Literal":
+    case "TemplateElement":
+    case "JSXText":
+    case "JSXIdentifier":
+    case "JSXEmptyExpression":
+      return unknown();
+    case "TemplateLiteral":
+      for (const expression of node.expressions) {
+        api.visit(state, expression, scope, "read");
+      }
+      return unknown();
+    case "TaggedTemplateExpression":
+      api.visit(state, node.tag, scope, "read");
+      for (const expression of node.quasi.expressions) {
+        api.visit(state, expression, scope, "escape");
+      }
+      return unknown();
+    case "YieldExpression":
+      if (node.argument) {
+        api.visit(state, node.argument, scope, "escape");
+      }
+      return unknown();
+    case "AwaitExpression":
+      return api.visit(state, node.argument, scope, "read");
+    case "UnaryExpression":
+      if (node.operator === "delete") {
+        api.visit(state, node.argument, scope, "read");
+        return unknown();
+      }
+      return api.visit(state, node.argument, scope, "read");
+    case "UpdateExpression": {
+      const member = unwrap(node.argument);
+      if (member?.type === "MemberExpression") {
+        if (member.computed) {
+          api.visit(state, member.property, scope, "read");
+        }
+        considerWrite(state, api.visit(state, member.object, scope, "read"), node, {
+          viaCall: false,
+          objectNode: member,
+          key: memberKey(member),
+          scope,
+        });
+      } else {
+        api.visit(state, node.argument, scope, "read");
+      }
+      return unknown();
+    }
+    case "BinaryExpression":
+      api.visit(state, node.left, scope, "read");
+      api.visit(state, node.right, scope, "read");
+      return unknown();
+    case "LogicalExpression":
+      // && yields the left only when that side is falsy, so it cannot be the object.
+      if (node.operator === "&&") {
+        api.visit(state, node.left, scope, "read");
+        return api.visit(state, node.right, scope, role);
+      }
+      return joinValues(
+        api.visit(state, node.left, scope, role),
+        api.visit(state, node.right, scope, role),
+      );
+    case "ConditionalExpression":
+      api.visit(state, node.test, scope, "read");
+      return joinValues(
+        api.visit(state, node.consequent, scope, role),
+        api.visit(state, node.alternate, scope, role),
+      );
+    case "SequenceExpression": {
+      let tag = unknown();
+      for (const expression of node.expressions) {
+        tag = api.visit(state, expression, scope, role);
+      }
+      return tag;
+    }
+    case "AssignmentExpression":
+      return visitAssignment(state, node, scope);
+    case "MemberExpression":
+      return readMember(api.visit(state, node.object, scope, "read"), memberKey(node));
+    case "ObjectExpression":
+      return visitObject(state, node, scope, role);
+    case "ArrayExpression":
+      return visitArray(state, node, scope, role);
+    case "NewExpression":
+      return visitNew(state, node, scope);
+    case "CallExpression":
+      return visitCall(state, node, scope);
+    case "ImportExpression":
+      api.visit(state, node.source, scope, "read");
+      return unknown();
+    case "MetaProperty":
+      if (node.meta?.name === "import" && node.property?.name === "meta") {
+        return shared("module");
+      }
+      return unknown();
+    case "JSXElement":
+    case "JSXFragment":
+    case "JSXAttribute":
+    case "JSXOpeningElement":
+    case "JSXClosingElement":
+      walkChildren(state, node, scope);
+      return unknown();
+    case "JSXSpreadAttribute":
+      return api.visit(state, node.argument, scope, "escape");
+    case "JSXSpreadChild":
+      return api.visit(state, node.expression, scope, "escape");
+    case "JSXExpressionContainer":
+      return api.visit(state, node.expression, scope, "escape");
+    default:
+      return undefined;
+  }
+}
+
+module.exports = { visitExpression };