eslint-plugin-vercel-ai-security 1.3.6 → 1.3.7

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 1.3.7
+
+### Patch Changes
+
+- [#252](https://github.com/ofri-peretz/eslint/pull/252) [`d67e395`](https://github.com/ofri-peretz/eslint/commit/d67e3953c2748ad36e6aebe0f24b1d04e518b4d0) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Fix Codecov badge showing "unknown" — switch from flag to component URL format
+
 ## 1.3.6
 
 ### Patch Changes

package/README.md

@@ -10,7 +10,7 @@
   <a href="https://www.npmjs.com/package/eslint-plugin-vercel-ai-security" target="_blank"><img src="https://img.shields.io/npm/v/eslint-plugin-vercel-ai-security.svg" alt="NPM Version" /></a>
   <a href="https://www.npmjs.com/package/eslint-plugin-vercel-ai-security" target="_blank"><img src="https://img.shields.io/npm/dm/eslint-plugin-vercel-ai-security.svg" alt="NPM Downloads" /></a>
   <a href="https://opensource.org/licenses/MIT" target="_blank"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="Package License" /></a>
-  <a href="https://app.codecov.io/gh/ofri-peretz/eslint/components?components%5B0%5D=vercel-ai-security" target="_blank"><img src="https://codecov.io/gh/ofri-peretz/eslint/graph/badge.svg?component=vercel-ai-security" alt="Codecov" /></a>
+  <a href="https://app.codecov.io/gh/ofri-peretz/eslint/components?components%5B0%5D=eslint-plugin-vercel-ai-security" target="_blank"><img src="https://codecov.io/gh/ofri-peretz/eslint/graph/badge.svg?component=eslint-plugin-vercel-ai-security" alt="Codecov" /></a>
   <a href="https://github.com/ofri-peretz/eslint" target="_blank"><img src="https://img.shields.io/badge/Since-Dec_2025-blue?logo=rocket&logoColor=white" alt="Since Dec 2025" /></a>
 </p>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-vercel-ai-security",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "Security-focused ESLint plugin for Vercel AI SDK. SDK-aware rules for generateText, streamText, tools, and streaming patterns with full type knowledge.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -81,10 +81,10 @@
     "@interlace/eslint-devkit": "^1.4.1"
   },
   "devDependencies": {
-    "@ai-sdk/openai": "^3.0.67",
+    "@ai-sdk/openai": "^4.0.16",
     "@typescript-eslint/parser": "^8.46.2",
     "@typescript-eslint/rule-tester": "^8.46.2",
-    "ai": "^6.0.193"
+    "ai": "^7.0.31"
   },
   "scripts": {
     "build": "tsx ../../scripts/build-package.ts",

package/src/index.js

@@ -152,7 +152,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-vercel-ai-security',
-        version: '1.3.6',
+        version: '1.3.7',
     },
     rules: exports.rules,
 };

package/src/rules/require-embedding-validation/index.js

@@ -82,8 +82,6 @@ exports.requireEmbeddingValidation = (0, eslint_devkit_1.createRule)({
          * Check if expression is an embedding call
          */
         function isEmbeddingCall(node) {
-            if (node.type !== 'CallExpression')
-                return null;
             const callee = sourceCode.getText(node.callee);
             for (const pattern of embeddingPatterns) {
                 if (callee.toLowerCase().includes(pattern.toLowerCase())) {
@@ -96,8 +94,6 @@ exports.requireEmbeddingValidation = (0, eslint_devkit_1.createRule)({
          * Check if expression is validated
          */
         function isValidated(node) {
-            if (node.type !== 'CallExpression')
-                return false;
             const callee = sourceCode.getText(node.callee);
             return validatorFunctions.some((fn) => callee.toLowerCase().includes(fn.toLowerCase()));
         }
@@ -126,13 +122,15 @@ exports.requireEmbeddingValidation = (0, eslint_devkit_1.createRule)({
                                 if (valueNode.type === 'AwaitExpression') {
                                     valueNode = valueNode.argument;
                                 }
-                                const embeddingSource = isEmbeddingCall(valueNode);
-                                if (embeddingSource && !isValidated(valueNode)) {
-                                    context.report({
-                                        node: prop.value,
-                                        messageId: 'unvalidatedEmbedding',
-                                        data: { source: embeddingSource },
-                                    });
+                                if (valueNode.type === 'CallExpression') {
+                                    const embeddingSource = isEmbeddingCall(valueNode);
+                                    if (embeddingSource && !isValidated(valueNode)) {
+                                        context.report({
+                                            node: prop.value,
+                                            messageId: 'unvalidatedEmbedding',
+                                            data: { source: embeddingSource },
+                                        });
+                                    }
                                 }
                             }
                         }

package/src/rules/require-output-filtering/index.js

@@ -80,8 +80,6 @@ exports.requireOutputFiltering = (0, eslint_devkit_1.createRule)({
          * Check if expression is a data source call
          */
         function isDataSourceCall(node) {
-            if (node.type !== 'CallExpression')
-                return null;
             const callee = sourceCode.getText(node.callee);
             for (const pattern of dataSourcePatterns) {
                 if (callee.toLowerCase().includes(pattern.toLowerCase())) {
@@ -94,8 +92,6 @@ exports.requireOutputFiltering = (0, eslint_devkit_1.createRule)({
          * Check if expression is wrapped in a filter function
          */
         function isFilteredCall(node) {
-            if (node.type !== 'CallExpression')
-                return false;
             const callee = sourceCode.getText(node.callee);
             return filterFunctions.some((filter) => callee.toLowerCase().includes(filter.toLowerCase()));
         }

package/src/rules/require-output-validation/index.js

@@ -72,23 +72,11 @@ exports.requireOutputValidation = (0, eslint_devkit_1.createRule)({
         const displayPatterns = options.displayPatterns ?? [
             'render', 'display', 'show', 'send', 'respond',
         ];
-        const validatorFunctions = options.validatorFunctions ?? [
-            'validate', 'verify', 'check', 'sanitize',
-        ];
         const sourceCode = context.sourceCode;
         // AI output property patterns
         const aiOutputPatterns = ['.text', '.content', '.message', '.response', '.output'];
         // Track variables that hold AI results
         const aiResultVariables = new Set();
-        /**
-         * Check if expression is validated
-         */
-        function isValidated(node) {
-            if (node.type !== 'CallExpression')
-                return false;
-            const callee = sourceCode.getText(node.callee);
-            return validatorFunctions.some((fn) => callee.toLowerCase().includes(fn.toLowerCase()));
-        }
         /**
          * Check if expression accesses AI output
          */
@@ -125,7 +113,10 @@ exports.requireOutputValidation = (0, eslint_devkit_1.createRule)({
                     return;
                 // Check arguments for unvalidated AI output
                 for (const arg of node.arguments) {
-                    if (isAIOutput(arg) && !isValidated(arg)) {
+                    // NOTE: `isAIOutput` only matches MemberExpression/Identifier nodes,
+                    // so a wrapped call like `render(validate(result.text))` never
+                    // reaches here — validated output is inherently not flagged.
+                    if (isAIOutput(arg)) {
                         context.report({
                             node: arg,
                             messageId: 'unvalidatedOutput',
@@ -137,7 +128,7 @@ exports.requireOutputValidation = (0, eslint_devkit_1.createRule)({
                         for (const prop of arg.properties) {
                             if (prop.type !== 'Property')
                                 continue;
-                            if (isAIOutput(prop.value) && !isValidated(prop.value)) {
+                            if (isAIOutput(prop.value)) {
                                 context.report({
                                     node: prop.value,
                                     messageId: 'unvalidatedOutput',

package/src/rules/require-rag-content-validation/index.js

@@ -99,8 +99,6 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
          * Check if expression is wrapped in validation
          */
         function isValidated(node) {
-            if (node.type !== 'CallExpression')
-                return false;
             const callee = sourceCode.getText(node.callee);
             return validatorFunctions.some((fn) => callee.toLowerCase().includes(fn.toLowerCase()));
         }