eslint-plugin-reliability 3.1.3 → 3.1.4

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 ## [3.1.3] - 2026-05-03
 
+## 3.1.4
+
+### Patch Changes
+
+- [#141](https://github.com/ofri-peretz/eslint/pull/141) [`38ab670`](https://github.com/ofri-peretz/eslint/commit/38ab670a0221684f4fd3d5dc3c05ddec7458ca2b) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix: remove false `meta.fixable: 'code'` declarations from 21 rules that had no `fix()` function
+
+  Rules that declared `fixable: 'code'` in their ESLint meta without an actual `fix()` implementation would show the ⚡ auto-fix icon in editors and CI formatters but apply no change when `--fix` was run. This patch removes the misleading declaration from:
+  - `browser-security/no-clickjacking`
+  - `import-next/first`, `named`, `no-barrel-import`, `no-import-module-exports`, `no-namespace`
+  - `node-security/no-buffer-overread`, `no-unsafe-dynamic-require`, `no-zip-slip`
+  - `react-features/react-no-inline-functions`
+  - `reliability/no-jsdoc-terminator-in-example` (uses `suggest`, not auto-fix; corrected to `hasSuggestions: true` only)
+  - `secure-coding/no-directive-injection`, `no-electron-security-issues`, `no-graphql-injection`, `no-improper-sanitization`, `no-improper-type-validation`, `no-ldap-injection`, `no-unchecked-loop-condition`, `no-unlimited-resource-allocation`, `no-weak-password-recovery`, `no-xpath-injection`
+
+- [#143](https://github.com/ofri-peretz/eslint/pull/143) [`213cde1`](https://github.com/ofri-peretz/eslint/commit/213cde190ff2aea49ca7c1b533170940f879d9b4) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - fix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns
+
+  Rules that were recognized as null guards are now correctly identified as safe:
+  1. **Truthy if guard** — `if (obj) { obj.prop }` — direct truthy check proves non-null. Also covers chains: `if (response)` protects `response.data.items`.
+  2. **Short-circuit AND** — `obj && obj.prop` — right side of `&&` only runs when left is truthy.
+  3. **Ternary consequent** — `obj ? obj.prop : fallback` — truthy test guards the consequent.
+
+  Also: bumped `beforeAll` timeout to 30 seconds in 7 compatibility test files (`__compatibility__/*.spec.ts`). Native-addon packages routinely exceed the previous 10-second default on a cold ESM load.
+
+- Updated dependencies [[`736a5fe`](https://github.com/ofri-peretz/eslint/commit/736a5fed47e673f6157ea900b29fe2a54e4bc7df)]:
+  - @interlace/eslint-devkit@1.4.1
+
 ### Bug Fixes
 
 - `no-missing-null-checks`: exempt provably-non-null identifiers (built-in singletons like `Math`, `JSON`, `console`, error classes; catch-clause params; constructor results; top-level imports) from the null-check requirement. Eliminates a large class of false positives without weakening real coverage.

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <a href="https://eslint.interlace.tools" target="blank"><img src="https://eslint.interlace.tools/eslint-interlace-logo-light.svg" alt="ESLint Interlace Logo" width="120" /></a>
+  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability" target="blank"><img src="https://eslint.interlace.tools/eslint-interlace-logo-light.svg" alt="ESLint Interlace Logo" width="120" /></a>
 </p>
 
 <p align="center">
@@ -14,6 +14,8 @@
   <a href="https://github.com/ofri-peretz/eslint" target="_blank"><img src="https://img.shields.io/badge/Since-Dec_2025-blue?logo=rocket&logoColor=white" alt="Since Dec 2025" /></a>
 </p>
 
+> ⭐ If this plugin caught a real bug for you, [**star the repo**](https://github.com/ofri-peretz/eslint) — it's the signal that keeps these rules maintained.
+
 ## Description
 
 This plugin provides Reliability rules for defensive programming, error handling, and async correctness.
@@ -24,12 +26,12 @@ This plugin provides Reliability rules for defensive programming, error handling
 
 ## Getting Started
 
-- To check out the [guide](https://eslint.interlace.tools/docs/quality/plugin-reliability), visit [eslint.interlace.tools](https://eslint.interlace.tools). 📚
-- 要查看中文 [指南](https://eslint.interlace.tools/docs/quality/plugin-reliability), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools). 📚
-- [가이드](https://eslint.interlace.tools/docs/quality/plugin-reliability) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools)에서 확인하실 수 있습니다. 📚
-- [ガイド](https://eslint.interlace.tools/docs/quality/plugin-reliability)は [eslint.interlace.tools](https://eslint.interlace.tools)でご確認ください。 📚
-- Para ver la [guía](https://eslint.interlace.tools/docs/quality/plugin-reliability), visita [eslint.interlace.tools](https://eslint.interlace.tools). 📚
-- للاطلاع على [الدليل](https://eslint.interlace.tools/docs/quality/plugin-reliability)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools). 📚
+- To check out the [guide](https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability). 📚
+- 要查看中文 [指南](https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability). 📚
+- [가이드](https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability)에서 확인하실 수 있습니다. 📚
+- [ガイド](https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability)は [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability)でご確認ください。 📚
+- Para ver la [guía](https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability), visita [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability). 📚
+- للاطلاع على [الدليل](https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability). 📚
 
 ```bash
 npm install eslint-plugin-reliability --save-dev
@@ -151,15 +153,15 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md)
 <!-- AUTO-GENERATED:RULES_TABLE:START - Do not edit manually -->
 | Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
 | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: |
-| [error-message](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/error-message) |  |  |  | Enforce providing a message when creating built-in Error objects for better debugging. This rule is part of… | 🟢 |  |  |  | 💡 |  |
-| [no-await-in-loop](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-await-in-loop) |  |  |  | Disallow await inside loops without considering concurrency implications | 🟢 |  |  |  | 💡 |  |
-| [no-jsdoc-terminator-in-example](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-jsdoc-terminator-in-example) |  |  |  | Detect `*/` sequences inside JSDoc `@example` blocks that prematurely close the JSDoc comment. | 🟢 |  |  |  | 💡 |  |
-| [no-missing-error-context](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-missing-error-context) |  |  |  | ESLint Rule: no-missing-error-context with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  |  |  | 💡 |  |
-| [no-missing-null-checks](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-missing-null-checks) | CWE-476 |  |  | ESLint Rule: no-missing-null-checks with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  | ⚠️ |  | 💡 |  |
-| [no-silent-errors](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-silent-errors) |  |  |  | ESLint Rule: no-silent-errors with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  | ⚠️ |  | 💡 |  |
-| [no-unhandled-promise](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-unhandled-promise) | CWE-1024 |  |  | Disallow unhandled Promise rejections with LLM-optimized suggestions for proper async error handling. This… | 🟢 |  |  |  | 💡 |  |
-| [no-unsafe-type-narrowing](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-unsafe-type-narrowing) |  |  |  | ESLint Rule: no-unsafe-type-narrowing with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  |  |  | 💡 |  |
-| [require-network-timeout](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/require-network-timeout) |  |  |  | Require timeout configuration for network requests. This rule is part of eslint-plugin-reliability and prov… | 🟢 | 💼 |  |  | 💡 |  |
+| [error-message](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/error-message?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) |  |  |  | Enforce providing a message when creating built-in Error objects for better debugging. This rule is part of… | 🟢 |  |  |  | 💡 |  |
+| [no-await-in-loop](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-await-in-loop?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) |  |  |  | Disallow await inside loops without considering concurrency implications | 🟢 |  |  |  | 💡 |  |
+| [no-jsdoc-terminator-in-example](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-jsdoc-terminator-in-example?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) |  |  |  | Detect `*/` sequences inside JSDoc `@example` blocks that prematurely close the JSDoc comment. | 🟢 |  |  |  | 💡 |  |
+| [no-missing-error-context](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-missing-error-context?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) |  |  |  | ESLint Rule: no-missing-error-context with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  |  |  | 💡 |  |
+| [no-missing-null-checks](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-missing-null-checks?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) | CWE-476 |  |  | ESLint Rule: no-missing-null-checks with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  | ⚠️ |  | 💡 |  |
+| [no-silent-errors](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-silent-errors?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) |  |  |  | ESLint Rule: no-silent-errors with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  | ⚠️ |  | 💡 |  |
+| [no-unhandled-promise](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-unhandled-promise?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) | CWE-1024 |  |  | Disallow unhandled Promise rejections with LLM-optimized suggestions for proper async error handling. This… | 🟢 |  |  |  | 💡 |  |
+| [no-unsafe-type-narrowing](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/no-unsafe-type-narrowing?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) |  |  |  | ESLint Rule: no-unsafe-type-narrowing with LLM-optimized suggestions and auto-fix capabilities. | 🟢 |  |  |  | 💡 |  |
+| [require-network-timeout](https://eslint.interlace.tools/docs/quality/plugin-reliability/rules/require-network-timeout?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability) |  |  |  | Require timeout configuration for network requests. This rule is part of eslint-plugin-reliability and prov… | 🟢 | 💼 |  |  | 💡 |  |
 <!-- AUTO-GENERATED:RULES_TABLE:END -->
 ## 🔗 Related ESLint Plugins
 
@@ -179,10 +181,19 @@ Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with L
 | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
 | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
 
+<!-- INTERLACE:STAR_CTA:START -->
+## ⭐ Support & follow
+
+If this plugin caught a real bug for you, **[star the repo](https://github.com/ofri-peretz/eslint)** — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and **[follow the writeups on Dev.to](https://dev.to/ofri-peretz)** for the benchmarks and security research behind these rules.
+
+[![GitHub stars](https://img.shields.io/github/stars/ofri-peretz/eslint?style=social)](https://github.com/ofri-peretz/eslint)
+
+<!-- INTERLACE:STAR_CTA:END -->
+
 ## 📄 License
 
 MIT © [Ofri Peretz](https://github.com/ofri-peretz)
 
 <p align="center">
-  <a href="https://eslint.interlace.tools/docs/quality/plugin-reliability"><img src="https://eslint.interlace.tools/images/og-reliability.png" alt="ESLint Interlace Plugin" width="100%" /></a>
+  <a href="https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-reliability"><img src="https://eslint.interlace.tools/images/og-reliability.png" alt="ESLint Interlace Plugin" width="100%" /></a>
 </p>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-reliability",
-  "version": "3.1.3",
+  "version": "3.1.4",
   "description": "ESLint rules for runtime stability, fault tolerance, and type safety.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -52,7 +52,7 @@
     "url": "https://github.com/ofri-peretz/eslint",
     "directory": "packages/eslint-plugin-reliability"
   },
-  "homepage": "https://github.com/ofri-peretz/eslint/tree/main/packages/eslint-plugin-reliability#readme",
+  "homepage": "https://eslint.interlace.tools/docs/quality/plugin-reliability?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-reliability",
   "bugs": {
     "url": "https://github.com/ofri-peretz/eslint/issues"
   },
@@ -64,5 +64,9 @@
   },
   "peerDependencies": {
     "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/ofri-peretz/eslint"
   }
 }

package/src/index.d.ts

@@ -189,7 +189,7 @@ export declare const configs: {
             };
         };
         rules: {
-            'reliability/no-silent-errors': "warn";
+            'reliability/no-silent-errors': "error";
             'reliability/no-missing-null-checks': "warn";
             'reliability/require-network-timeout': "error";
         };

package/src/index.js

@@ -41,7 +41,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-reliability',
-        version: '3.1.3',
+        version: '3.1.4',
     },
     rules: exports.rules,
 };
@@ -51,7 +51,7 @@ exports.configs = {
             reliability: exports.plugin,
         },
         rules: {
-            'reliability/no-silent-errors': 'warn',
+            'reliability/no-silent-errors': 'error',
             'reliability/no-missing-null-checks': 'warn',
             'reliability/require-network-timeout': 'error',
         },

package/src/rules/reliability/no-jsdoc-terminator-in-example.js

@@ -63,7 +63,6 @@ exports.noJsdocTerminatorInExample = (0, eslint_devkit_1.createRule)({
             url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-reliability/docs/rules/no-jsdoc-terminator-in-example.md',
             description: 'Detects `*/` sequences inside JSDoc @example blocks that prematurely close the comment',
         },
-        fixable: 'code',
         hasSuggestions: true,
         messages: {
             jsdocTerminatorInExample: (0, eslint_devkit_1.formatLLMMessage)({

package/src/rules/reliability/no-missing-null-checks.js

@@ -137,20 +137,49 @@ function hasNullCheck(node, sourceCode) {
     // Check if parent is optional chaining
     const parent = node.parent;
     if (parent && parent.type === 'ChainExpression') {
-        return true; // Optional chaining handles null/undefined
+        return true;
     }
     // Check if used with nullish coalescing
     if (usesNullishCoalescing(node)) {
         return true;
     }
-    // Check for basic explicit null checks in if statements
-    // This is a simplified check that looks for patterns like:
-    // if (obj !== null) { obj.property; }
+    const objectText = sourceCode.getText(node.object);
+    // Short-circuit AND: `obj && obj.prop` — the right side of && runs only
+    // when the left side is truthy, so obj is guaranteed non-null here.
+    // Walk up one level (CallExpression wraps MemberExpression for `obj && obj.method()`)
+    const immediateParent = parent;
+    const nodeOrCall = immediateParent?.type === 'CallExpression' &&
+        immediateParent.callee === node
+        ? immediateParent
+        : node;
+    const andParent = nodeOrCall
+        .parent;
+    if (andParent?.type === 'LogicalExpression' &&
+        andParent.operator === '&&' &&
+        andParent.right === nodeOrCall) {
+        const leftText = sourceCode.getText(andParent.left);
+        if (leftText === objectText || leftText.endsWith(objectText))
+            return true;
+    }
+    // Ternary consequent: `obj ? obj.prop : fallback` — the test being truthy
+    // guarantees obj is non-null before the consequent evaluates.
+    let cur = node;
+    for (let depth = 0; depth < 8; depth++) {
+        const p = cur.parent;
+        if (!p)
+            break;
+        if (p.type === 'ConditionalExpression' &&
+            p.consequent === cur) {
+            if (sourceCode.getText(p.test) === objectText) {
+                return true;
+            }
+        }
+        cur = p;
+    }
+    // Explicit null/truthy check in enclosing if statement
     if (hasExplicitNullCheck(node, sourceCode)) {
         return true;
     }
-    // For more sophisticated null checking, we'd need control flow analysis
-    // This is a simplified implementation that checks for basic patterns
     return false;
 }
 /**
@@ -180,7 +209,17 @@ function hasExplicitNullCheck(node, sourceCode) {
  * Check if a test expression is a null check for a specific object
  */
 function isNullCheckForObject(test, object, sourceCode) {
-    // Handle binary expressions like obj !== null
+    const objectText = sourceCode.getText(object);
+    // Truthy check: `if (obj)` or `if (obj.prop)` — direct truthy guard proves
+    // non-null. Also covers nested chains: `if (response) { response.data.items }`
+    // because checking the root (response) implicitly protects the full chain.
+    if (test.type === 'Identifier' || test.type === 'MemberExpression') {
+        const testText = sourceCode.getText(test);
+        if (testText === objectText || objectText.startsWith(testText + '.')) {
+            return true;
+        }
+    }
+    // Handle binary expressions like obj !== null, obj != undefined
     if (test.type === 'BinaryExpression') {
         const { left, right, operator } = test;
         if (operator === '!==' ||
@@ -189,8 +228,6 @@ function isNullCheckForObject(test, object, sourceCode) {
             operator === '==') {
             const leftText = sourceCode.getText(left);
             const rightText = sourceCode.getText(right);
-            const objectText = sourceCode.getText(object);
-            // Check if one side matches our object and the other is null/undefined
             if ((leftText === objectText &&
                 (rightText === 'null' || rightText === 'undefined')) ||
                 (rightText === objectText &&
@@ -204,6 +241,8 @@ function isNullCheckForObject(test, object, sourceCode) {
         return (isNullCheckForObject(test.left, object, sourceCode) ||
             isNullCheckForObject(test.right, object, sourceCode));
     }
+    // Unary negation: `if (!obj)` is a FALSY guard — only safe when paired
+    // with early return, which requires control-flow analysis. Skip for now.
     return false;
 }
 /**