eslint-plugin-sonarjs 3.0.6 → 4.0.0

package/README.md

@@ -249,8 +249,8 @@ If you have any questions, encounter any bugs, or have feature requests, please
 | [no-globals-shadowing](https://sonarsource.github.io/rspec/#/rspec/S2137/javascript)                 | Special identifiers should not be bound or assigned                                                                            | ✅  |     |     |     |     |
 | [no-gratuitous-expressions](https://sonarsource.github.io/rspec/#/rspec/S2589/javascript)            | Boolean expressions should not be gratuitous                                                                                   | ✅  |     |     |     |     |
 | [no-hardcoded-ip](https://sonarsource.github.io/rspec/#/rspec/S1313/javascript)                      | Using hardcoded IP addresses is security-sensitive                                                                             | ✅  |     |     |     |     |
-| [no-hardcoded-passwords](https://sonarsource.github.io/rspec/#/rspec/S2068/javascript)               | Hard-coded passwords are security-sensitive                                                                                    | ✅  |     |     |     |     |
-| [no-hardcoded-secrets](https://sonarsource.github.io/rspec/#/rspec/S6418/javascript)                 | Hard-coded secrets are security-sensitive                                                                                      | ✅  |     |     |     |     |
+| [no-hardcoded-passwords](https://sonarsource.github.io/rspec/#/rspec/S2068/javascript)               | Credentials should not be hard-coded                                                                                           | ✅  |     |     |     |     |
+| [no-hardcoded-secrets](https://sonarsource.github.io/rspec/#/rspec/S6418/javascript)                 | Secrets should not be hard-coded                                                                                               | ✅  |     |     |     |     |
 | [no-hook-setter-in-body](https://sonarsource.github.io/rspec/#/rspec/S6442/javascript)               | React's useState hook should not be used directly in the render function or body of a component                                | ✅  |     |     |     |     |
 | [no-identical-conditions](https://sonarsource.github.io/rspec/#/rspec/S1862/javascript)              | "if/else if" chains and "switch" cases should not have the same condition                                                      | ✅  |     |     |     |     |
 | [no-identical-expressions](https://sonarsource.github.io/rspec/#/rspec/S1764/javascript)             | Identical expressions should not be used on both sides of a binary operator                                                    | ✅  |     |     |     |     |
@@ -406,7 +406,6 @@ SonarJS uses some rules are not shipped in this ESLint plugin to avoid duplicati
 | [S1090](https://sonarsource.github.io/rspec/#/rspec/S1090/javascript) | [jsx-a11y/iframe-has-title](https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/iframe-has-title.md)                                                                  |
 | [S1117](https://sonarsource.github.io/rspec/#/rspec/S1117/javascript) | [typescript-eslint/no-shadow](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/docs/rules/no-shadow.mdx)                                             |
 | [S1131](https://sonarsource.github.io/rspec/#/rspec/S1131/javascript) | [eslint/no-trailing-spaces](https://eslint.org/docs/latest/rules/no-trailing-spaces)                                                                                                        |
-| [S1143](https://sonarsource.github.io/rspec/#/rspec/S1143/javascript) | [eslint/no-unsafe-finally](https://eslint.org/docs/latest/rules/no-unsafe-finally)                                                                                                          |
 | [S1199](https://sonarsource.github.io/rspec/#/rspec/S1199/javascript) | [eslint/no-lone-blocks](https://eslint.org/docs/latest/rules/no-lone-blocks)                                                                                                                |
 | [S1314](https://sonarsource.github.io/rspec/#/rspec/S1314/javascript) | [eslint/no-octal](https://eslint.org/docs/latest/rules/no-octal)                                                                                                                            |
 | [S1321](https://sonarsource.github.io/rspec/#/rspec/S1321/javascript) | [eslint/no-with](https://eslint.org/docs/latest/rules/no-with)                                                                                                                              |
@@ -557,7 +556,6 @@ SonarJS uses some rules are not shipped in this ESLint plugin to avoid duplicati
 | [S7756](https://sonarsource.github.io/rspec/#/rspec/S7756/javascript) | [unicorn/prefer-blob-reading-methods](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-blob-reading-methods.md)                                            |
 | [S7757](https://sonarsource.github.io/rspec/#/rspec/S7757/javascript) | [unicorn/prefer-class-fields](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-class-fields.md)                                                            |
 | [S7758](https://sonarsource.github.io/rspec/#/rspec/S7758/javascript) | [unicorn/prefer-code-point](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-code-point.md)                                                                |
-| [S7759](https://sonarsource.github.io/rspec/#/rspec/S7759/javascript) | [unicorn/prefer-date-now](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-date-now.md)                                                                    |
 | [S7760](https://sonarsource.github.io/rspec/#/rspec/S7760/javascript) | [unicorn/prefer-default-parameters](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-default-parameters.md)                                                |
 | [S7761](https://sonarsource.github.io/rspec/#/rspec/S7761/javascript) | [unicorn/prefer-dom-node-dataset](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-dom-node-dataset.md)                                                    |
 | [S7762](https://sonarsource.github.io/rspec/#/rspec/S7762/javascript) | [unicorn/prefer-dom-node-remove](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-dom-node-remove.md)                                                      |
@@ -603,6 +601,7 @@ The following rules are used in SonarJS but not available in this ESLint plugin.
 | [S1082](https://sonarsource.github.io/rspec/#/rspec/S1082/javascript) | [jsx-a11y/mouse-events-have-key-events](https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/mouse-events-have-key-events.md)<br>[jsx-a11y/click-events-have-key-events](https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/click-events-have-key-events.md)                                                                                |
 | [S1105](https://sonarsource.github.io/rspec/#/rspec/S1105/javascript) | [eslint/brace-style](https://eslint.org/docs/latest/rules/brace-style)                                                                                                                                                                                                                                                                                                                  |
 | [S1116](https://sonarsource.github.io/rspec/#/rspec/S1116/javascript) | [@stylistic/eslint-plugin/no-extra-semi](https://github.com/eslint-stylistic/eslint-stylistic/blob/main/packages/eslint-plugin/rules/no-extra-semi/README.md)                                                                                                                                                                                                                           |
+| [S1143](https://sonarsource.github.io/rspec/#/rspec/S1143/javascript) | [eslint/no-unsafe-finally](https://eslint.org/docs/latest/rules/no-unsafe-finally)                                                                                                                                                                                                                                                                                                      |
 | [S1186](https://sonarsource.github.io/rspec/#/rspec/S1186/javascript) | [typescript-eslint/no-empty-function](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/docs/rules/no-empty-function.mdx)                                                                                                                                                                                                                         |
 | [S1438](https://sonarsource.github.io/rspec/#/rspec/S1438/javascript) | [@stylistic/eslint-plugin/semi](https://github.com/eslint-stylistic/eslint-stylistic/blob/main/packages/eslint-plugin/rules/semi/README.md)                                                                                                                                                                                                                                             |
 | [S1534](https://sonarsource.github.io/rspec/#/rspec/S1534/javascript) | [eslint/no-dupe-keys](https://eslint.org/docs/latest/rules/no-dupe-keys)<br>[typescript-eslint/no-dupe-class-members](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/docs/rules/no-dupe-class-members.mdx)<br>[react/jsx-no-duplicate-props](https://github.com/jsx-eslint/eslint-plugin-react/blob/HEAD/docs/rules/jsx-no-duplicate-props.md) |
@@ -659,6 +658,7 @@ The following rules are used in SonarJS but not available in this ESLint plugin.
 | [S7727](https://sonarsource.github.io/rspec/#/rspec/S7727/javascript) | [unicorn/no-array-callback-reference](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/no-array-callback-reference.md)                                                                                                                                                                                                                                        |
 | [S7728](https://sonarsource.github.io/rspec/#/rspec/S7728/javascript) | [unicorn/no-array-for-each](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/no-array-for-each.md)                                                                                                                                                                                                                                                            |
 | [S7755](https://sonarsource.github.io/rspec/#/rspec/S7755/javascript) | [unicorn/prefer-at](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-at.md)                                                                                                                                                                                                                                                                            |
+| [S7759](https://sonarsource.github.io/rspec/#/rspec/S7759/javascript) | [unicorn/prefer-date-now](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-date-now.md)                                                                                                                                                                                                                                                                |
 | [S7763](https://sonarsource.github.io/rspec/#/rspec/S7763/javascript) | [unicorn/prefer-export-from](https://github.com/sindresorhus/eslint-plugin-unicorn/blob/HEAD/docs/rules/prefer-export-from.md)                                                                                                                                                                                                                                                          |
 
 <!--- end decorated rules -->

package/cjs/S125/rule.js

@@ -54,12 +54,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const eslint_1 = require("eslint");
 const index_js_1 = require("../helpers/index.js");
 const meta = __importStar(require("./generated-meta.js"));
 const index_js_2 = require("../helpers/recognizers/index.js");
 const node_path_1 = __importDefault(require("node:path"));
 const EXCLUDED_STATEMENTS = new Set(['BreakStatement', 'LabeledStatement', 'ContinueStatement']);
+// Cheap prefilter: any meaningful JS statement must contain at least one of these characters,
+// or be an import/export with a string literal (side-effect imports have no punctuation)
+const CODE_CHAR_PATTERN = /[;{}()=<>]|\bimport\s+['"]|\bexport\s/;
 const recognizer = new index_js_2.CodeRecognizer(0.9, new index_js_2.JavaScriptFootPrint());
 exports.rule = {
     meta: (0, index_js_1.generateMeta)(meta, {
@@ -132,30 +134,34 @@ exports.rule = {
         };
     },
 };
-function isExpressionExclusion(statement, code) {
+function isExpressionExclusion(statement, value, program, context) {
     if (statement.type === 'ExpressionStatement') {
         const expression = statement.expression;
         if (expression.type === 'Identifier' ||
             expression.type === 'SequenceExpression' ||
             isUnaryPlusOrMinus(expression) ||
-            isExcludedLiteral(expression) ||
-            !code.getLastToken(statement, token => token.value === ';')) {
+            isExcludedLiteral(expression)) {
             return true;
         }
+        // Only construct SourceCode when we need getLastToken.
+        // Access the constructor from context to avoid a static runtime import of 'eslint'.
+        const SourceCodeClass = context.sourceCode.constructor;
+        const code = new SourceCodeClass(value, program);
+        return !code.getLastToken(statement, token => token.value === ';');
     }
     return false;
 }
-function isExclusion(parsedBody, code) {
+function isExclusion(parsedBody, value, program, context) {
     if (parsedBody.length === 1) {
         const singleStatement = parsedBody[0];
         return (EXCLUDED_STATEMENTS.has(singleStatement.type) ||
             isReturnThrowExclusion(singleStatement) ||
-            isExpressionExclusion(singleStatement, code));
+            isExpressionExclusion(singleStatement, value, program, context));
     }
     return false;
 }
 function containsCode(value, context) {
-    if (!couldBeJsCode(value) || !context.languageOptions.parser) {
+    if (!CODE_CHAR_PATTERN.test(value) || !couldBeJsCode(value) || !context.languageOptions.parser) {
         return false;
     }
     try {
@@ -168,29 +174,36 @@ function containsCode(value, context) {
         //In case of Vue parser: we will use the JS/TS parser instead of the Vue parser
         const parser = context.languageOptions?.parserOptions?.parser ?? context.languageOptions?.parser;
         const result = 'parse' in parser ? parser.parse(value, options) : parser.parseForESLint(value, options).ast;
-        const parseResult = new eslint_1.SourceCode(value, result);
-        return parseResult.ast.body.length > 0 && !isExclusion(parseResult.ast.body, parseResult);
+        const program = result;
+        return program.body.length > 0 && !isExclusion(program.body, value, program, context);
     }
     catch {
         return false;
     }
 }
 function couldBeJsCode(input) {
-    return recognizer.extractCodeLines(input.split('\n')).length > 0;
+    return input.split('\n').some(line => recognizer.recognition(line) >= recognizer.threshold);
 }
 function injectMissingBraces(value) {
-    const openCurlyBraceNum = (value.match(/{/g) ?? []).length;
-    const closeCurlyBraceNum = (value.match(/}/g) ?? []).length;
-    const missingBraces = openCurlyBraceNum - closeCurlyBraceNum;
-    if (missingBraces > 0) {
-        return value + '}'.repeat(missingBraces);
-    }
-    else if (missingBraces < 0) {
-        return '{'.repeat(-missingBraces) + value;
+    let balance = 0;
+    let minBalance = 0;
+    for (let i = 0; i < value.length; i++) {
+        if (value[i] === '{') {
+            balance++;
+        }
+        else if (value[i] === '}') {
+            balance--;
+            if (balance < minBalance) {
+                minBalance = balance;
+            }
+        }
     }
-    else {
-        return value;
+    const openToAdd = -minBalance;
+    const closeToAdd = balance - minBalance;
+    if (openToAdd > 0 || closeToAdd > 0) {
+        return '{'.repeat(openToAdd) + value + '}'.repeat(closeToAdd);
     }
+    return value;
 }
 function getCommentLocation(nodes) {
     return {

package/cjs/S1607/rule.js

@@ -53,7 +53,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 const index_js_1 = require("../helpers/index.js");
 const meta = __importStar(require("./generated-meta.js"));
-const node_path_1 = require("node:path");
 const dependencies_js_1 = require("../helpers/package-jsons/dependencies.js");
 const all_in_parent_dirs_js_1 = require("../helpers/package-jsons/all-in-parent-dirs.js");
 exports.rule = {
@@ -63,7 +62,7 @@ exports.rule = {
         },
     }),
     create(context) {
-        const dependencies = (0, dependencies_js_1.getDependencies)((0, node_path_1.dirname)(context.filename), context.cwd);
+        const dependencies = (0, dependencies_js_1.getDependenciesSanitizePaths)(context);
         switch (true) {
             case dependencies.has('jasmine'):
                 return jasmineListener();
@@ -71,7 +70,7 @@ exports.rule = {
                 return jestListener();
             case dependencies.has('mocha'):
                 return mochaListener();
-            case (0, all_in_parent_dirs_js_1.getManifests)((0, node_path_1.dirname)((0, index_js_1.toUnixPath)(context.filename)), context.cwd).length > 0:
+            case (0, all_in_parent_dirs_js_1.getManifestsSanitizePaths)(context).length > 0:
                 return nodejsListener();
             default:
                 return {};

package/cjs/S2068/generated-meta.js

@@ -36,7 +36,7 @@ __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Hard-coded passwords are security-sensitive',
+        description: 'Credentials should not be hard-coded',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S2068/javascript',
         requiresTypeChecking: false,

package/cjs/S2077/rule.js

@@ -53,7 +53,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 const index_js_1 = require("../helpers/index.js");
 const meta = __importStar(require("./generated-meta.js"));
-const dbModules = ['pg', 'mysql', 'mysql2', 'sequelize'];
+const sqlQuerySignatures = new Set([
+    'pg.Client.query',
+    'pg.Pool.query',
+    'mysql.createConnection.query',
+    'mysql.createPool.query',
+    'mysql.createPoolCluster.query',
+    'mysql2.createConnection.query',
+    'mysql2.createPool.query',
+    'mysql2.createPoolCluster.query',
+    'sequelize.Sequelize.query', // Sequelize is typically destructured: const { Sequelize } = require('sequelize')
+    'sqlite3.Database.run',
+    'sqlite3.Database.get',
+    'sqlite3.Database.all',
+    'sqlite3.Database.each',
+    'sqlite3.Database.exec',
+    'better-sqlite3.exec',
+    'better-sqlite3.prepare',
+]);
 exports.rule = {
     meta: (0, index_js_1.generateMeta)(meta, {
         messages: {
@@ -61,31 +78,22 @@ exports.rule = {
         },
     }),
     create(context) {
-        let isDbModuleImported = false;
+        const services = context.sourceCode.parserServices;
+        const hasTypeInformation = (0, index_js_1.isRequiredParserServices)(services);
         return {
-            Program() {
-                // init flag for each file
-                isDbModuleImported = false;
-            },
-            ImportDeclaration(node) {
-                const { source } = node;
-                if (dbModules.includes(String(source.value))) {
-                    isDbModuleImported = true;
-                }
-            },
             CallExpression(node) {
-                const call = node;
-                const { callee, arguments: args } = call;
-                if ((0, index_js_1.isRequireModule)(call, ...dbModules)) {
-                    isDbModuleImported = true;
-                    return;
+                let fqn = null;
+                if (hasTypeInformation) {
+                    const tsNode = services.esTreeNodeToTSNodeMap.get(node);
+                    fqn = (0, index_js_1.getFullyQualifiedNameTS)(services, tsNode);
+                }
+                else {
+                    fqn = (0, index_js_1.getFullyQualifiedName)(context, node.callee);
                 }
-                if (isDbModuleImported &&
-                    (0, index_js_1.isMemberWithProperty)(callee, 'query') &&
-                    isQuestionable(args[0])) {
+                if (fqn && sqlQuerySignatures.has(fqn) && isQuestionable(node.arguments[0])) {
                     context.report({
                         messageId: 'safeQuery',
-                        node: callee,
+                        node: node.callee,
                     });
                 }
             },

package/cjs/S2234/rule.js

@@ -59,15 +59,24 @@ exports.rule = {
         const services = context.sourceCode.parserServices;
         const canResolveType = (0, index_js_1.isRequiredParserServices)(services);
         function checkArguments(functionCall) {
+            // Extract argument names first (cheap operation)
+            const argumentNames = functionCall.arguments.map(arg => {
+                const argument = arg;
+                return argument.type === 'Identifier' ? argument.name : undefined;
+            });
+            // Early exit: detecting swapped arguments requires at least 2 identifier arguments.
+            // Skip expensive type resolution if there aren't enough identifiers to check.
+            // This avoids a TypeScript performance issue where type inference for complex
+            // destructuring patterns with nested defaults can have exponential complexity.
+            const identifierCount = argumentNames.filter(name => name !== undefined).length;
+            if (identifierCount < 2) {
+                return;
+            }
             const resolvedFunction = resolveFunctionDeclaration(functionCall);
             if (!resolvedFunction) {
                 return;
             }
             const { params: functionParameters, declaration: functionDeclaration } = resolvedFunction;
-            const argumentNames = functionCall.arguments.map(arg => {
-                const argument = arg;
-                return argument.type === 'Identifier' ? argument.name : undefined;
-            });
             for (let argumentIndex = 0; argumentIndex < argumentNames.length; argumentIndex++) {
                 const argumentName = argumentNames[argumentIndex];
                 if (argumentName) {

package/cjs/S2301/rule.js

@@ -173,7 +173,8 @@ exports.rule = {
     },
 };
 function isCallbackArgument(node) {
-    return node.parent.type === 'CallExpression' && node.parent.arguments.includes(node);
+    return ((node.parent.type === 'CallExpression' && node.parent.arguments.includes(node)) ||
+        node.parent.type === 'JSXExpressionContainer');
 }
 /**
  * Checks if an expression has side effects (function calls, new expressions, assignments).

package/cjs/S2310/rule.js

@@ -70,6 +70,9 @@ exports.rule = {
             }
             for (const ref of variable.references) {
                 if (ref.isWrite() && isUsedInsideBody(ref.identifier, block)) {
+                    if (isIntentionalSkipAhead(ref.identifier, block)) {
+                        continue;
+                    }
                     (0, index_js_1.report)(context, {
                         node: ref.identifier,
                         message: `Remove this assignment of "${counter.name}".`,
@@ -84,25 +87,12 @@ exports.rule = {
                     checkLoop(forLoop.update, collectCountersFor, node);
                 }
             },
-            'ForInStatement > BlockStatement, ForOfStatement > BlockStatement': (node) => {
-                const { left } = (0, index_js_1.getParent)(context, node);
-                checkLoop(left, collectCountersForX, node);
-            },
+            // Note: for-of and for-in loops are not checked because reassigning
+            // the iterator variable does not affect loop iteration (the iterator
+            // protocol controls progression, not the variable value)
         };
     },
 };
-function collectCountersForX(updateExpression, counters) {
-    if (updateExpression.type === 'VariableDeclaration') {
-        for (const decl of updateExpression.declarations) {
-            collectCountersForX(decl.id, counters);
-        }
-    }
-    else {
-        for (const id of (0, index_js_1.resolveIdentifiers)(updateExpression, true)) {
-            counters.push(id);
-        }
-    }
-}
 function collectCountersFor(updateExpression, counters) {
     let counter = undefined;
     if (updateExpression.type === 'AssignmentExpression') {
@@ -120,7 +110,48 @@ function collectCountersFor(updateExpression, counters) {
         counters.push(counter);
     }
 }
+/**
+ * Checks if a loop counter modification is an intentional skip-ahead pattern
+ * (UpdateExpression or compound assignment) rather than a simple assignment.
+ * Modifications in nested for-loop update clauses are not considered skip-ahead.
+ */
+function isIntentionalSkipAhead(id, outerLoopBody) {
+    if (isInNestedForLoopUpdate(id, outerLoopBody)) {
+        return false;
+    }
+    const parent = (0, index_js_1.getNodeParent)(id);
+    if (parent?.type === 'UpdateExpression') {
+        return true;
+    }
+    if (parent?.type === 'AssignmentExpression' && parent.operator !== '=') {
+        return true;
+    }
+    return false;
+}
 function isUsedInsideBody(id, loopBody) {
     const bodyRange = loopBody.range;
     return id.range && bodyRange && id.range[0] > bodyRange[0] && id.range[1] < bodyRange[1];
 }
+function isInNestedForLoopUpdate(id, outerLoopBody) {
+    let node = id;
+    let parent = (0, index_js_1.getNodeParent)(node);
+    while (parent) {
+        // Stop if we've reached the outer loop body
+        if (parent === outerLoopBody) {
+            return false;
+        }
+        // Check if we're in a nested for-loop's update clause
+        if (parent.type === 'ForStatement' && parent.update) {
+            const updateRange = parent.update.range;
+            if (updateRange &&
+                id.range &&
+                id.range[0] >= updateRange[0] &&
+                id.range[1] <= updateRange[1]) {
+                return true;
+            }
+        }
+        node = parent;
+        parent = (0, index_js_1.getNodeParent)(node);
+    }
+    return false;
+}

package/cjs/S4328/rule.js

@@ -58,7 +58,6 @@ const builtin_modules_1 = __importDefault(require("builtin-modules"));
 const typescript_1 = __importDefault(require("typescript"));
 const index_js_1 = require("../helpers/index.js");
 const meta = __importStar(require("./generated-meta.js"));
-const node_path_1 = require("node:path");
 const dependencies_js_1 = require("../helpers/package-jsons/dependencies.js");
 const messages = {
     removeOrAddDependency: 'Either remove this import or add it as a dependency.',
@@ -67,7 +66,7 @@ exports.rule = {
     meta: (0, index_js_1.generateMeta)(meta, { messages }),
     create(context) {
         // we need to find all the npm manifests from the directory of the analyzed file to the context working directory
-        const dependencies = (0, dependencies_js_1.getDependencies)((0, node_path_1.dirname)(context.filename), context.cwd);
+        const dependencies = (0, dependencies_js_1.getDependenciesSanitizePaths)(context);
         const whitelist = context.options[0]?.whitelist || [];
         const program = context.sourceCode.parserServices?.program;
         let options, host;

package/cjs/S4335/rule.js

@@ -66,37 +66,47 @@ exports.rule = {
     }),
     create(context) {
         const services = context.sourceCode.parserServices;
-        if ((0, index_js_1.isRequiredParserServices)(services)) {
-            return {
-                TSIntersectionType: (node) => {
-                    const intersection = node;
-                    const anyOrNever = intersection.types.find(typeNode => ['TSAnyKeyword', 'TSNeverKeyword'].includes(typeNode.type));
-                    if (anyOrNever) {
-                        context.report({
-                            messageId: 'simplifyIntersection',
-                            data: {
-                                type: anyOrNever.type === 'TSAnyKeyword' ? 'any' : 'never',
-                            },
-                            node,
-                        });
-                    }
-                    else {
-                        for (const typeNode of intersection.types) {
-                            const tp = services.program
-                                .getTypeChecker()
-                                .getTypeAtLocation(services.esTreeNodeToTSNodeMap.get(typeNode));
-                            if (isTypeWithoutMembers(tp)) {
-                                context.report({
-                                    messageId: 'removeIntersection',
-                                    node: typeNode,
-                                });
-                            }
-                        }
-                    }
-                },
-            };
+        if (!(0, index_js_1.isRequiredParserServices)(services)) {
+            return {};
         }
-        return {};
+        function checkIntersectionType(node) {
+            const intersection = node;
+            const anyOrNever = intersection.types.find(typeNode => ['TSAnyKeyword', 'TSNeverKeyword'].includes(typeNode.type));
+            if (anyOrNever) {
+                context.report({
+                    messageId: 'simplifyIntersection',
+                    data: {
+                        type: anyOrNever.type === 'TSAnyKeyword' ? 'any' : 'never',
+                    },
+                    node,
+                });
+                return;
+            }
+            checkTypesWithoutMembers(intersection, services);
+        }
+        function checkTypesWithoutMembers(intersection, parserServices) {
+            for (const typeNode of intersection.types) {
+                const tp = parserServices.program
+                    .getTypeChecker()
+                    .getTypeAtLocation(parserServices.esTreeNodeToTSNodeMap.get(typeNode));
+                if (!isTypeWithoutMembers(tp)) {
+                    continue;
+                }
+                if (isLiteralUnionPattern(intersection)) {
+                    continue;
+                }
+                if (isGenericTypePattern(intersection, typeNode, parserServices)) {
+                    continue;
+                }
+                context.report({
+                    messageId: 'removeIntersection',
+                    node: typeNode,
+                });
+            }
+        }
+        return {
+            TSIntersectionType: checkIntersectionType,
+        };
     },
 };
 function isTypeWithoutMembers(tp) {
@@ -127,3 +137,55 @@ function isStandaloneInterface(typeSymbol) {
 function isInterfaceDeclaration(declaration) {
     return declaration.kind === typescript_1.default.SyntaxKind.InterfaceDeclaration;
 }
+/**
+ * Detects the LiteralUnion pattern: `(X & {})` used within a union type to preserve
+ * IDE autocomplete for literal types while accepting any primitive value.
+ * Example: `'small' | 'medium' | 'large' | (string & {})`
+ */
+function isLiteralUnionPattern(intersection) {
+    if (intersection.types.length !== 2) {
+        return false;
+    }
+    const parent = (0, index_js_1.getNodeParent)(intersection);
+    if (!parent || parent.type !== 'TSUnionType') {
+        return false;
+    }
+    const otherType = intersection.types.find(t => t.type !== 'TSTypeLiteral' || (t.members && t.members.length > 0));
+    if (!otherType) {
+        return false;
+    }
+    return (otherType.type === 'TSStringKeyword' ||
+        otherType.type === 'TSNumberKeyword' ||
+        otherType.type === 'TSTypeReference');
+}
+/**
+ * Detects generic type patterns where `& {}` serves a legitimate purpose:
+ * 1. Mapped type pattern: `{ [K in keyof T]: T[K] } & {}` - forces type flattening (Simplify/Prettify)
+ * 2. Generic type reference: `GenericType<T> & {}` where GenericType has type arguments
+ * 3. Type parameter reference: `T & {}` where T is a type parameter
+ *
+ * These patterns are used for type normalization and non-nullability constraints.
+ */
+function isGenericTypePattern(intersection, emptyTypeNode, parserServices) {
+    const siblingTypes = intersection.types.filter(t => t !== emptyTypeNode);
+    return siblingTypes.some(siblingType => {
+        // Pattern 1: Mapped type (Simplify/Prettify pattern)
+        if (siblingType.type === 'TSMappedType') {
+            return true;
+        }
+        // Pattern 2: Generic type reference with type arguments
+        if (siblingType.type === 'TSTypeReference' && siblingType.typeArguments) {
+            return true;
+        }
+        // Pattern 3: Type parameter reference (e.g., T & {})
+        if (siblingType.type === 'TSTypeReference') {
+            const tp = parserServices.program
+                .getTypeChecker()
+                .getTypeAtLocation(parserServices.esTreeNodeToTSNodeMap.get(siblingType));
+            if (tp.isTypeParameter()) {
+                return true;
+            }
+        }
+        return false;
+    });
+}

package/cjs/S4423/rule.aws.js

@@ -23,16 +23,26 @@ exports.rule = (0, cdk_js_1.AwsCdkTemplate)({
     'aws_cdk_lib.aws_apigateway.CfnDomainName': (0, cdk_js_1.AwsCdkCheckArguments)('AWSApiGateway', true, 'securityPolicy', { primitives: { valid: ['TLS_1_2'] } }),
     'aws_cdk_lib.aws_apigateway.DomainName': (0, cdk_js_1.AwsCdkCheckArguments)('AWSApiGateway', false, 'securityPolicy', { fqns: { valid: ['aws_cdk_lib.aws_apigateway.SecurityPolicy.TLS_1_2'] } }),
     'aws_cdk_lib.aws_elasticsearch.CfnDomain': (0, cdk_js_1.AwsCdkCheckArguments)(['AWSOpenElasticSearch', 'enforceTLS12'], true, ['domainEndpointOptions', 'tlsSecurityPolicy'], {
-        primitives: { valid: ['Policy-Min-TLS-1-2-2019-07'] },
+        primitives: { valid: ['Policy-Min-TLS-1-2-2019-07', 'Policy-Min-TLS-1-2-PFS-2023-10'] },
     }),
     'aws_cdk_lib.aws_opensearchservice.Domain': (0, cdk_js_1.AwsCdkCheckArguments)(['AWSOpenElasticSearch', 'enforceTLS12'], true, 'tlsSecurityPolicy', {
-        fqns: { valid: ['aws_cdk_lib.aws_opensearchservice.TLSSecurityPolicy.TLS_1_2'] },
+        fqns: {
+            valid: [
+                'aws_cdk_lib.aws_opensearchservice.TLSSecurityPolicy.TLS_1_2',
+                'aws_cdk_lib.aws_opensearchservice.TLSSecurityPolicy.TLS_1_2_PFS',
+            ],
+        },
     }),
     'aws_cdk_lib.aws_opensearchservice.CfnDomain': (0, cdk_js_1.AwsCdkCheckArguments)(['AWSOpenElasticSearch', 'enforceTLS12'], true, ['domainEndpointOptions', 'tlsSecurityPolicy'], {
-        primitives: { valid: ['Policy-Min-TLS-1-2-2019-07'] },
+        primitives: { valid: ['Policy-Min-TLS-1-2-2019-07', 'Policy-Min-TLS-1-2-PFS-2023-10'] },
     }),
     'aws_cdk_lib.aws_elasticsearch.Domain': (0, cdk_js_1.AwsCdkCheckArguments)(['AWSOpenElasticSearch', 'enforceTLS12'], true, 'tlsSecurityPolicy', {
-        fqns: { valid: ['aws_cdk_lib.aws_elasticsearch.TLSSecurityPolicy.TLS_1_2'] },
+        fqns: {
+            valid: [
+                'aws_cdk_lib.aws_elasticsearch.TLSSecurityPolicy.TLS_1_2',
+                'aws_cdk_lib.aws_elasticsearch.TLSSecurityPolicy.TLS_1_2_PFS',
+            ],
+        },
     }),
 }, {
     messages: {

package/cjs/S5247/rule.js

@@ -82,6 +82,9 @@ exports.rule = {
                 if (fqn === 'markdown-it') {
                     (0, index_js_1.checkSensitiveCall)(context, callExpression, 0, 'html', true, MESSAGE);
                 }
+                if (fqn === 'swig.setDefaults') {
+                    (0, index_js_1.checkSensitiveCall)(context, callExpression, 0, 'autoescape', false, MESSAGE);
+                }
             },
             NewExpression: (node) => {
                 const newExpression = node;

package/cjs/S5256/rule.js

@@ -59,6 +59,15 @@ const { getLiteralPropValue, getProp } = jsx_ast_utils_x_1.default;
 const table_js_1 = require("../helpers/table.js");
 const index_js_1 = require("../helpers/index.js");
 const meta = __importStar(require("./generated-meta.js"));
+/**
+ * Detects reusable table wrapper components that receive children via props spread.
+ * Returns true if the table has no JSX children AND has a JSXSpreadAttribute.
+ */
+function isReusableWrapperComponent(tree) {
+    const hasNoChildren = tree.children.length === 0;
+    const hasSpreadAttribute = tree.openingElement.attributes.some(attr => attr.type === 'JSXSpreadAttribute');
+    return hasNoChildren && hasSpreadAttribute;
+}
 exports.rule = {
     meta: (0, index_js_1.generateMeta)(meta),
     create(context) {
@@ -95,6 +104,11 @@ exports.rule = {
                     if (ariaHidden && getLiteralPropValue(ariaHidden) === true) {
                         return;
                     }
+                    // Skip reusable wrapper components: tables with no children and spread props
+                    // where table structure is provided via props.children at usage sites
+                    if (isReusableWrapperComponent(tree)) {
+                        return;
+                    }
                     if (!checkValidTable(tree)) {
                         context.report({
                             node,