eslint-plugin-vercel-ai-security 1.3.8 → 1.3.9

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 1.3.9
+
+### Patch Changes
+
+- [#277](https://github.com/ofri-peretz/eslint/pull/277) [`d1ad332`](https://github.com/ofri-peretz/eslint/commit/d1ad332cc7366887482b288bcf65098d425501d0) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Accept AI SDK v5+ idioms: `stopWhen` (e.g. `stopWhen: stepCountIs(5)`) now satisfies require-max-steps, and `maxOutputTokens` (v5 rename of `maxTokens`) satisfies require-max-tokens — fixing false positives on v5/v7 code.
+
 ## 1.3.8
 
 ### Patch Changes

package/README.md

@@ -136,8 +136,8 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md) fo
 | [require-audit-logging](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-audit-logging?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-778 |  |  | This rule identifies AI SDK calls that aren't preceded by logging statements | 🟢 |  |  |  |  |  |
 | [require-embedding-validation](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-embedding-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-20 |  |  | This rule identifies code patterns where embeddings are stored in vector databases without validation. | 🟢 |  |  |  |  |  |
 | [require-error-handling](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-error-handling?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-755 |  |  | This rule identifies AI SDK calls that aren't wrapped in try-catch blocks | 🟢 |  |  |  |  |  |
-| [require-max-steps](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-max-steps?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-834 |  |  | This rule identifies AI SDK calls that use tools but don't specify a maxSteps limit | 🟢 |  |  |  |  |  |
-| [require-max-tokens](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-max-tokens?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-770 |  |  | This rule identifies AI SDK calls that don't specify a maxTokens limit | 🟢 |  |  |  |  |  |
+| [require-max-steps](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-max-steps?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-834 |  |  | This rule identifies AI SDK calls that use tools but don't specify a step limit (maxSteps or stopWhen) | 🟢 |  |  |  |  |  |
+| [require-max-tokens](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-max-tokens?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-770 |  |  | This rule identifies AI SDK calls that don't specify a token limit (maxTokens or maxOutputTokens) | 🟢 |  |  |  |  |  |
 | [require-output-filtering](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-output-filtering?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-200 |  |  | This rule identifies tool execute functions that return raw data from data sources (databases, APIs, file s… | 🟢 |  |  |  |  |  |
 | [require-output-validation](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-output-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-707 |  |  | This rule identifies code patterns where AI-generated output is displayed to users without validation or fa… | 🟢 |  |  |  |  |  |
 | [require-rag-content-validation](https://eslint.interlace.tools/docs/security/plugin-vercel-ai-security/rules/require-rag-content-validation?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-vercel-ai-security) | CWE-74 |  |  | This rule identifies code patterns where content retrieved from vector stores or document retrieval systems… | 🟢 |  |  |  |  |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-vercel-ai-security",
-  "version": "1.3.8",
+  "version": "1.3.9",
   "description": "Security-focused ESLint plugin for Vercel AI SDK. SDK-aware rules for generateText, streamText, tools, and streaming patterns with full type knowledge.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/index.js

@@ -152,7 +152,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-vercel-ai-security',
-        version: '1.3.8',
+        version: '1.3.9',
     },
     rules: exports.rules,
 };

package/src/rules/require-max-steps/index.js

@@ -30,10 +30,10 @@ exports.requireMaxSteps = (0, eslint_devkit_1.createRule)({
                 cwe: 'CWE-834',
                 owasp: 'A05:2021',
                 cvss: 6.5,
-                description: '{{function}} with tools is missing maxSteps. Without a limit, tool calls can loop indefinitely.',
+                description: '{{function}} with tools is missing a step limit. Without a limit, tool calls can loop indefinitely.',
                 severity: 'MEDIUM',
                 compliance: ['SOC2'],
-                fix: 'Add maxSteps option: {{function}}({ ..., maxSteps: 5 })',
+                fix: 'Add a step limit: {{function}}({ ..., stopWhen: stepCountIs(5) }) (v5+) or maxSteps: 5 (v4)',
                 documentationLink: 'https://sdk.vercel.ai/docs/ai-sdk-core/tools-and-tool-calling#multi-step-calls-using-stopwhen',
             }),
         },
@@ -81,7 +81,7 @@ exports.requireMaxSteps = (0, eslint_devkit_1.createRule)({
                 // Only check for maxSteps if tools are present
                 if (!hasTools)
                     return;
-                // Check if maxSteps is present
+                // Check if a step limit is present: maxSteps (v4) or stopWhen (v5+, e.g. stopWhen: stepCountIs(5))
                 const hasMaxSteps = optionsArg.properties.some(prop => {
                     if (prop.type !== 'Property')
                         return false;
@@ -90,7 +90,8 @@ exports.requireMaxSteps = (0, eslint_devkit_1.createRule)({
                         : prop.key.type === 'Literal'
                             ? String(prop.key.value)
                             : null;
-                    return keyName === 'maxSteps' || keyName === 'max_steps';
+                    // ponytail: any stopWhen counts — statically proving it bounds steps (arrays, custom conditions) isn't worth it; documented FN
+                    return keyName === 'maxSteps' || keyName === 'max_steps' || keyName === 'stopWhen';
                 });
                 if (!hasMaxSteps) {
                     context.report({

package/src/rules/require-max-tokens/index.js

@@ -30,10 +30,10 @@ exports.requireMaxTokens = (0, eslint_devkit_1.createRule)({
                 cwe: 'CWE-770',
                 owasp: 'A05:2021',
                 cvss: 6.5,
-                description: '{{function}} call without maxTokens limit can lead to excessive resource consumption',
+                description: '{{function}} call without a token limit can lead to excessive resource consumption',
                 severity: 'MEDIUM',
                 compliance: ['SOC2'],
-                fix: 'Add maxTokens option: {{function}}({ maxTokens: 4096, ... })',
+                fix: 'Add a token limit: {{function}}({ maxOutputTokens: 4096, ... }) (v5+) or maxTokens (v4)',
                 documentationLink: 'https://sdk.vercel.ai/docs/ai-sdk-core/generating-text',
             }),
         },
@@ -81,7 +81,7 @@ exports.requireMaxTokens = (0, eslint_devkit_1.createRule)({
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression') {
                     return;
                 }
-                // Check if maxTokens is present
+                // Check if a token limit is present: maxTokens (v4) or maxOutputTokens (v5+ rename)
                 const hasMaxTokens = optionsArg.properties.some(prop => {
                     if (prop.type !== 'Property')
                         return false;
@@ -90,7 +90,7 @@ exports.requireMaxTokens = (0, eslint_devkit_1.createRule)({
                         : prop.key.type === 'Literal'
                             ? String(prop.key.value)
                             : null;
-                    return keyName === 'maxTokens' || keyName === 'max_tokens';
+                    return keyName === 'maxTokens' || keyName === 'max_tokens' || keyName === 'maxOutputTokens';
                 });
                 if (!hasMaxTokens) {
                     context.report({