markuplint 5.0.0-rc.5 → 5.0.0-rc.7

package/CHANGELOG.md

@@ -3,6 +3,52 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [5.0.0-rc.7](https://github.com/markuplint/markuplint/compare/v5.0.0-rc.6...v5.0.0-rc.7) (2026-08-31)
+
+### Features
+
+- **markuplint:** surface appliedOverrides in --show-config=details ([10ed615](https://github.com/markuplint/markuplint/commit/10ed6157cf99786971ae90551ea0411cecdc8433))
+
+# [5.0.0-rc.6](https://github.com/markuplint/markuplint/compare/v5.0.0-rc.5...v5.0.0-rc.6) (2026-08-30)
+
+### Bug Fixes
+
+- add no-aria-hidden-on-hidden-until-found rule (closes [#3999](https://github.com/markuplint/markuplint/issues/3999)) ([#4017](https://github.com/markuplint/markuplint/issues/4017)) ([3dfb300](https://github.com/markuplint/markuplint/commit/3dfb3001dc66452918d5cebbb071244b68779b30))
+- resolveConfig(false) crashes with inline config (not a file path) ([#4018](https://github.com/markuplint/markuplint/issues/4018)) ([7e38b64](https://github.com/markuplint/markuplint/commit/7e38b64caa8cca69009ee765e4aada37fc48c559)), closes [#4015](https://github.com/markuplint/markuplint/issues/4015) [#4015](https://github.com/markuplint/markuplint/issues/4015)
+
+### Features
+
+- split rule-deprecation notices out of config-error ([#4013](https://github.com/markuplint/markuplint/issues/4013)) ([812e6f3](https://github.com/markuplint/markuplint/commit/812e6f356839af8f257cfd91e6b16cfdfdd7cf33))
+
+### Performance Improvements
+
+- share ConfigProvider across a run's files, fix latent overrides caching bug ([#4016](https://github.com/markuplint/markuplint/issues/4016)) ([fcc1875](https://github.com/markuplint/markuplint/commit/fcc1875b1a984a5ef1bb36aa04e7b3522fefc58e)), closes [#3997](https://github.com/markuplint/markuplint/issues/3997) [#3997](https://github.com/markuplint/markuplint/issues/3997)
+
+### BREAKING CHANGES
+
+- `ConfigProvider#resolve(targetFile, names, false)` no longer
+  clears the provider's store/cache/plugin-resolution caches by itself. Callers
+  that relied on `cache: false` alone to force a fresh re-read must now call
+  the new `ConfigProvider#invalidate()` first.
+- violations for deprecated rule names now have
+  `ruleId: 'rule-deprecation'` instead of `ruleId: 'config-error'`. Any
+  consumer filtering `MLCore.verify()` output (or the markuplint CLI/API) by
+  `ruleId === 'config-error'` to catch deprecation messages must also check
+  for `rule-deprecation`.
+
+- feat(markuplint): add --severity-deprecation CLI flag
+
+Wires the new severity.deprecation config option (@markuplint/ml-config)
+and the rule-deprecation ruleId (@markuplint/ml-core) through the CLI:
+
+- --severity-deprecation flag, mirroring --severity-parse-error
+- --show-config details now also surfaces ruleDeprecations
+- per-run dedupe and failed-file counting generalized to cover both
+  config-level ruleIds (config-error and rule-deprecation), not just
+  config-error
+
+* docs(website): document severity.deprecation (EN + JA)
+
 # [5.0.0-rc.5](https://github.com/markuplint/markuplint/compare/v5.0.0-rc.4...v5.0.0-rc.5) (2026-08-28)
 
 ### Bug Fixes

package/README.md

@@ -87,6 +87,7 @@ Options
 	--verbose                              Output with detailed information.
 	--include-node-modules                 Include files in node_modules directory. Default: false.
 	--severity-parse-error                 Specifies the severity level of parse errors. Supports "error", "warning", and "off". Default: "error".
+	--severity-deprecation                 Specifies the severity level of deprecated rule name notices. Supports "error", "warning", and "off". Default: "warning".
 	--max-count                            Limit the number of violations shown. Default: 0 (no limit).
 	--max-warnings                         Number of warnings to trigger nonzero exit code. Default: -1 (no limit).
 	--progressive-output                   Output results immediately after processing each file. Default: false.

package/lib/api/lint.d.ts

@@ -4,6 +4,11 @@ import type { Target } from '@markuplint/file-resolver';
 /**
  * Lints multiple targets (files or inline sources) and returns results for each.
  *
+ * Config-level violations (broken config, deprecated rule names) are deduped
+ * per call the same way the CLI dedupes them per run: a message identical
+ * across every file sharing one config is kept only in the first file's
+ * result, not repeated in every file's `violations` array. See #3997.
+ *
  * @param targetList - An array of file paths/globs or inline source code targets
  * @param options - API options for configuration, locale, rules, and behavior
  * @returns An array of lint results, one per processed file

package/lib/api/lint.js

@@ -1,8 +1,14 @@
-import { resolveFiles } from '@markuplint/file-resolver';
+import { ConfigProvider, resolveFiles } from '@markuplint/file-resolver';
+import { dedupeConfigLevelViolations } from '../dedupe-config-violations.js';
 import { MLEngine } from './ml-engine.js';
 /**
  * Lints multiple targets (files or inline sources) and returns results for each.
  *
+ * Config-level violations (broken config, deprecated rule names) are deduped
+ * per call the same way the CLI dedupes them per run: a message identical
+ * across every file sharing one config is kept only in the first file's
+ * result, not repeated in every file's `violations` array. See #3997.
+ *
  * @param targetList - An array of file paths/globs or inline source code targets
  * @param options - API options for configuration, locale, rules, and behavior
  * @returns An array of lint results, one per processed file
@@ -10,13 +16,44 @@ import { MLEngine } from './ml-engine.js';
 export async function lint(targetList, options) {
     const res = [];
     const files = await resolveFiles(targetList);
+    // Shared across every file so `MLEngine`'s config cache — keyed by
+    // resolved config `names`, not by target file — actually helps: see
+    // `ConfigProvider.resolve`'s doc comment and #3997.
+    const configProvider = new ConfigProvider();
+    const seenConfigMessages = new Set();
     for (const file of files) {
-        const engine = new MLEngine(file, options);
+        const engine = new MLEngine(file, { ...options, configProvider });
         const result = await engine.exec();
         if (!result) {
             continue;
         }
-        res.push(result);
+        // Dedupe both views a caller might read: the first-pass `violations`,
+        // and — when fix mode found fixes — `fixSummary.finalPassViolations`
+        // (the post-fix re-verification `command.ts` prefers when reporting
+        // fixed results). Both arrays describe the SAME file, so they always
+        // carry the same config-level messages — that's not a repeat worth
+        // suppressing. Only a *later file* repeating a message already kept
+        // (in either array) is. So both arrays are deduped against the same
+        // pre-file snapshot of `seenConfigMessages` (not against each other),
+        // and only after both are done are their combined discoveries folded
+        // back into `seenConfigMessages` for the next file. The snapshot is
+        // only taken when there's a second array to protect against — most
+        // files (no fix mode, or fix mode with nothing to fix) have none.
+        let finalPassViolations = result.fixSummary?.finalPassViolations;
+        const seenBeforeThisFile = finalPassViolations ? new Set(seenConfigMessages) : undefined;
+        const violations = dedupeConfigLevelViolations(result.violations, seenConfigMessages);
+        if (finalPassViolations && seenBeforeThisFile) {
+            const seenForFinalPass = new Set(seenBeforeThisFile);
+            finalPassViolations = dedupeConfigLevelViolations(finalPassViolations, seenForFinalPass);
+            for (const key of seenForFinalPass) {
+                seenConfigMessages.add(key);
+            }
+        }
+        res.push({
+            ...result,
+            violations,
+            fixSummary: result.fixSummary && { ...result.fixSummary, finalPassViolations },
+        });
     }
     return res;
 }

package/lib/api/ml-engine.d.ts

@@ -1,12 +1,44 @@
 import type { APIOptions, MLEngineEventMap } from './types.js';
 import type { MLResultInfo } from '../types.js';
 import type { ConfigSet, MLFile, Target } from '@markuplint/file-resolver';
-import type { PlainData } from '@markuplint/ml-config';
+import type { PlainData, RuleAliasWarning } from '@markuplint/ml-config';
 import type { Document, RuleConfigValue } from '@markuplint/ml-core';
+import { ConfigProvider } from '@markuplint/file-resolver';
 import { Emitter } from 'strict-event-emitter';
 type MLEngineOptions = {
     readonly debug?: boolean;
     readonly watch?: boolean;
+    /**
+     * A pre-built {@link ConfigProvider} to resolve config through, instead of
+     * the one this instance would otherwise create for itself.
+     *
+     * `ConfigProvider` caches by the resolved config's `names` (file paths),
+     * not by target file — so a caller looping over many files (the CLI, or
+     * the `lint()` API) that constructs one `MLEngine` per file should share
+     * a single `ConfigProvider` across that loop; every file whose config
+     * resolves to the same `names` then reuses the same cached base config
+     * (merge/validate/plugin-resolution) instead of redoing that work once
+     * per file. See #3997.
+     *
+     * Optional and additive: omitted, each `MLEngine` still creates its own
+     * provider exactly as before.
+     *
+     * **Caveat — `watch: true`**: `resolveConfig()`'s cache-busting
+     * (`cache: false`, used internally on every watch-triggered re-resolve)
+     * calls `ConfigProvider#invalidate()`, which clears the *entire* shared
+     * provider, not anything scoped to one engine or file. `resolveConfig()`
+     * runs through `ConfigProvider#runExclusive()`, so an overlapping call
+     * from another engine can no longer interleave with — and corrupt — this
+     * one's in-flight resolve (see #4015); it can only run *before* or
+     * *after* it. Sharing one `configProvider` across multiple engines that
+     * also have `watch: true` still risks one engine's re-resolve evicting
+     * another's already-cached config, forcing an avoidable re-resolve on
+     * that engine's next lookup. Neither the CLI (which doesn't support
+     * `--watch`) nor `lint()` (which never sets `watch`) create this
+     * combination — it only arises if a direct API consumer builds it
+     * deliberately.
+     */
+    readonly configProvider?: ConfigProvider;
 };
 /**
  * Options for creating an {@link MLEngine} from inline source code.
@@ -17,6 +49,16 @@ export type FromCodeOptions = APIOptions & MLEngineOptions & {
     /** Optional working directory for config resolution */
     readonly dirname?: string;
 };
+/**
+ * A {@link ConfigSet} widened with deprecated-rule-name notices found while
+ * applying {@link applyRuleAliasesToConfig}. Kept structured (not folded
+ * into `errs` as generic `Error`s) so `MLCore` can report them under their
+ * own `rule-deprecation` ruleId instead of `config-error` — see
+ * `packages/@markuplint/ml-core/src/ml-core.ts`'s `verify()`.
+ */
+type ResolvedConfigSet = ConfigSet & {
+    readonly ruleDeprecations: readonly RuleAliasWarning[];
+};
 /**
  * The main markuplint engine that orchestrates file resolution, configuration loading,
  * parsing, and linting. Supports both single-file and watch-mode operation.
@@ -86,6 +128,6 @@ export declare class MLEngine extends Emitter<MLEngineEventMap> {
      * @param cache - Whether to reuse previously loaded config files
      * @returns The resolved configuration set
      */
-    resolveConfig(cache: boolean): Promise<ConfigSet>;
+    resolveConfig(cache: boolean): Promise<ResolvedConfigSet>;
 }
 export {};

package/lib/api/ml-engine.js

@@ -10,6 +10,15 @@ import { i18n } from '../i18n.js';
 const log = coreLog.extend('ml-engine');
 const fileLog = log.extend('file');
 const configLog = log.extend('config');
+/**
+ * The config passed to {@link ConfigProvider.set} when no config was
+ * discovered, requested, or provided by the caller. A module-level constant
+ * (not rebuilt per call) so its object identity is stable — letting
+ * `ConfigProvider.set`'s auto-key cache (keyed by identity) recognize repeat
+ * calls across every file in a run sharing one `ConfigProvider`, the same
+ * way a stable `options.config`/`defaultConfig` reference does. See #3997.
+ */
+const RECOMMENDED_CONFIG = { extends: ['markuplint:recommended'] };
 /**
  * The main markuplint engine that orchestrates file resolution, configuration loading,
  * parsing, and linting. Supports both single-file and watch-mode operation.
@@ -63,7 +72,7 @@ export class MLEngine extends Emitter {
         }
         this.#file = file;
         this.#options = options;
-        this.#configProvider = new ConfigProvider();
+        this.#configProvider = options?.configProvider ?? new ConfigProvider();
         this.watchMode(!!this.#options?.watch);
         log('[MLEngine] Initialized: %s', this.#file.path);
     }
@@ -225,6 +234,7 @@ export class MLEngine extends Emitter {
                     plugins: [],
                     files: new Set(),
                     errs: [error],
+                    ruleDeprecations: [],
                 };
             }
             else {
@@ -292,6 +302,7 @@ export class MLEngine extends Emitter {
             locale,
             ruleCommonSettings,
             configErrors: configSet.errs,
+            ruleDeprecations: configSet.ruleDeprecations,
         };
     }
     /**
@@ -313,28 +324,46 @@ export class MLEngine extends Emitter {
     async resolveConfig(cache) {
         this.emit('log', 'resolveConfig', JSON.stringify(this.#configProvider, null, 2));
         configLog('configProvider: %s', this.#configProvider);
-        const defaultConfigKey = this.#options?.defaultConfig && this.#configProvider.set(mergeConfig(this.#options?.defaultConfig));
-        configLog('defaultConfigKey: %s', defaultConfigKey ?? 'N/A');
-        this.emit('log', 'defaultConfigKey', defaultConfigKey ?? 'N/A');
-        const targetConfig = await this.#configProvider.search(this.#file);
-        this.emit('log', 'targetConfig', targetConfig ?? 'N/A');
-        const configFilePathsFromTarget = this.#options?.noSearchConfig || this.#options?.configFile
-            ? (defaultConfigKey ?? null)
-            : (targetConfig ?? defaultConfigKey);
-        configLog('configFilePathsFromTarget: %s', configFilePathsFromTarget ?? 'N/A');
-        this.emit('log', 'configFilePathsFromTarget', configFilePathsFromTarget ?? 'N/A');
-        const configKey = this.#options?.config && this.#configProvider.set(mergeConfig(this.#options.config));
-        configLog('option.config: %s', configKey ?? 'N/A');
-        this.emit('log', 'option.config', configFilePathsFromTarget ?? 'N/A');
-        let defaultRecommended = null;
-        if (!defaultConfigKey && !configFilePathsFromTarget && !configKey && !this.#options?.configFile) {
-            // No configured
-            // Default: set recommended
-            defaultRecommended = this.#configProvider.set({ extends: ['markuplint:recommended'] });
-        }
-        configLog('defaultRecommended: %s', defaultRecommended ?? 'N/A');
-        this.emit('log', 'defaultRecommended', defaultRecommended ?? 'N/A');
-        const resolvedConfigSet = await this.#configProvider.resolve(this.#file, [configFilePathsFromTarget, this.#options?.configFile, configKey, defaultRecommended], cache);
+        // Runs the whole invalidate → set → search → resolve sequence as one
+        // exclusive unit on the provider — an overlapping call on the same
+        // (possibly shared, e.g. two watch-triggered re-resolves close
+        // together) `ConfigProvider` must not interleave its own `invalidate()`
+        // in the middle of this one's `set()`/`search()` calls, which would
+        // wipe the keys just registered below before `resolve()` gets to use
+        // them. See #4015.
+        const resolvedConfigSet = await this.#configProvider.runExclusive(async () => {
+            if (!cache) {
+                // Must run before any `set()` call below — `ConfigProvider#resolve()`
+                // no longer clears its own store on `cache: false`, so invalidating
+                // after registering this call's inline config would discard it
+                // again immediately. See #4015.
+                this.#configProvider.invalidate();
+            }
+            const defaultConfigKey = this.#options?.defaultConfig &&
+                this.#configProvider.set(mergeConfig(this.#options.defaultConfig), undefined, this.#options.defaultConfig);
+            configLog('defaultConfigKey: %s', defaultConfigKey ?? 'N/A');
+            this.emit('log', 'defaultConfigKey', defaultConfigKey ?? 'N/A');
+            const targetConfig = await this.#configProvider.search(this.#file);
+            this.emit('log', 'targetConfig', targetConfig ?? 'N/A');
+            const configFilePathsFromTarget = this.#options?.noSearchConfig || this.#options?.configFile
+                ? (defaultConfigKey ?? null)
+                : (targetConfig ?? defaultConfigKey);
+            configLog('configFilePathsFromTarget: %s', configFilePathsFromTarget ?? 'N/A');
+            this.emit('log', 'configFilePathsFromTarget', configFilePathsFromTarget ?? 'N/A');
+            const configKey = this.#options?.config &&
+                this.#configProvider.set(mergeConfig(this.#options.config), undefined, this.#options.config);
+            configLog('option.config: %s', configKey ?? 'N/A');
+            this.emit('log', 'option.config', configFilePathsFromTarget ?? 'N/A');
+            let defaultRecommended = null;
+            if (!defaultConfigKey && !configFilePathsFromTarget && !configKey && !this.#options?.configFile) {
+                // No configured
+                // Default: set recommended
+                defaultRecommended = this.#configProvider.set(RECOMMENDED_CONFIG);
+            }
+            configLog('defaultRecommended: %s', defaultRecommended ?? 'N/A');
+            this.emit('log', 'defaultRecommended', defaultRecommended ?? 'N/A');
+            return this.#configProvider.resolve(this.#file, [configFilePathsFromTarget, this.#options?.configFile, configKey, defaultRecommended], cache);
+        });
         // Rewrite deprecated rule names (v5 rule-system redesign, #3989) to
         // their current replacement(s) so old configurations keep working.
         // Applied once, here, after `extends` is fully merged — everything
@@ -343,16 +372,13 @@ export class MLEngine extends Emitter {
         // the top-level `rules` map, and each `nodeRules`/`childNodeRules`
         // entry's own `rules`.
         const { config: aliasedConfig, warnings: ruleAliasWarnings } = applyRuleAliasesToConfig(resolvedConfigSet.config, ruleAliasTable);
+        // Kept structured (not folded into `errs` as generic `Error`s) so
+        // `MLCore` can report these under their own `rule-deprecation` ruleId,
+        // separate from genuine config-validation failures — see
+        // `ResolvedConfigSet`'s doc comment.
         const configSet = ruleAliasWarnings.length === 0
-            ? resolvedConfigSet
-            : {
-                ...resolvedConfigSet,
-                config: aliasedConfig,
-                errs: [
-                    ...resolvedConfigSet.errs,
-                    ...ruleAliasWarnings.map(({ deprecatedName, replacedBy }) => new Error(`Rule "${deprecatedName}" is deprecated and will be removed in v6. Use ${replacedBy.join(', ')} instead.`)),
-                ],
-            };
+            ? { ...resolvedConfigSet, ruleDeprecations: [] }
+            : { ...resolvedConfigSet, config: aliasedConfig, ruleDeprecations: ruleAliasWarnings };
         this.emit('config', this.#file.path, configSet);
         if (this.#options?.watch) {
             // It doesn't watch the main HTML file because it may is watched and managed by a language server or text editor or more.

package/lib/cli/bootstrap.d.ts

@@ -1,5 +1,5 @@
 import type { ReadonlyDeep } from 'type-fest';
-export declare const help = "\nUsage\n\t$ markuplint <HTML file paths (glob format)>\n\t$ <stdout> | markuplint\n\nOptions\n\t--config,                -c FILE_PATH  A configuration file path.\n\t--fix,                                 Fix HTML.\n\t--fix-dry-run                          Show what --fix would change without writing files.\n\t--format,                -f FORMAT     Output format. Support \"JSON\", \"Simple\", \"GitHub\" and \"Standard\". Default: \"Standard\".\n\t--no-search-config                     No search a configure file automatically.\n\t--ignore-ext                           Evaluate files that are received even though the type of extension.\n\t--no-import-preset-rules               No import preset rules.\n\t--locale                               Locale of the message of violation. Default is an OS setting.\n\t--no-color,                            Output no color.\n\t--problem-only,          -p            Output only problems, without passeds.\n\t--no-allow-warnings                    Return status code 1 even if there are warnings.\n\t--allow-empty-input                    Return status code 1 even if there are no input files.\n\t--show-config                          Output computed configuration of the target file. Supports \"details\" and empty. Default: empty.\n\t--verbose                              Output with detailed information.\n\t--include-node-modules                 Include files in node_modules directory. Default: false.\n\t--severity-parse-error                 Severity for the built-in parse-error channel. Supports \"error\", \"warning\", and \"off\". Unset by default: fatal ParserErrors emit at \"error\" and non-fatal parse5 events are off (opt-in per code via config).\n\t--max-count                            Limit the number of violations shown. Default: 0 (no limit).\n\t--max-warnings                         Number of warnings to trigger nonzero exit code. Default: -1 (no limit).\n\t--no-progressive-output                Wait until every file is processed before outputting results. Default: false (output progressively).\n\n\t--suppress                             [Experimental] Generate/update suppressions file for all current errors.\n\t--suppress-rule RULE_ID                [Experimental] Suppress only the specified rule.\n\t--prune-suppressions                   [Experimental] Remove stale entries from the suppressions file.\n\t--suppressions-location PATH           [Experimental] Custom path for the suppressions file. Default: \"markuplint-suppressions.json\".\n\n\t--init                                 Initialize settings interactively.\n\t--search                               Search lines of codes that include the target element by selectors.\n\n\t--help,                  -h            Show help.\n\t--version,               -v            Show version.\n\nExamples\n\t$ markuplint verifyee.html --config path/to/.markuplintrc\n\t$ cat verifyee.html | markuplint\n";
+export declare const help = "\nUsage\n\t$ markuplint <HTML file paths (glob format)>\n\t$ <stdout> | markuplint\n\nOptions\n\t--config,                -c FILE_PATH  A configuration file path.\n\t--fix,                                 Fix HTML.\n\t--fix-dry-run                          Show what --fix would change without writing files.\n\t--format,                -f FORMAT     Output format. Support \"JSON\", \"Simple\", \"GitHub\" and \"Standard\". Default: \"Standard\".\n\t--no-search-config                     No search a configure file automatically.\n\t--ignore-ext                           Evaluate files that are received even though the type of extension.\n\t--no-import-preset-rules               No import preset rules.\n\t--locale                               Locale of the message of violation. Default is an OS setting.\n\t--no-color,                            Output no color.\n\t--problem-only,          -p            Output only problems, without passeds.\n\t--no-allow-warnings                    Return status code 1 even if there are warnings.\n\t--allow-empty-input                    Return status code 1 even if there are no input files.\n\t--show-config                          Output computed configuration of the target file. Supports \"details\" and empty. Default: empty.\n\t--verbose                              Output with detailed information.\n\t--include-node-modules                 Include files in node_modules directory. Default: false.\n\t--severity-parse-error                 Severity for the built-in parse-error channel. Supports \"error\", \"warning\", and \"off\". Unset by default: fatal ParserErrors emit at \"error\" and non-fatal parse5 events are off (opt-in per code via config).\n\t--severity-deprecation                 Severity for the built-in rule-deprecation channel (deprecated rule names). Supports \"error\", \"warning\", and \"off\". Default: \"warning\".\n\t--max-count                            Limit the number of violations shown. Default: 0 (no limit).\n\t--max-warnings                         Number of warnings to trigger nonzero exit code. Default: -1 (no limit).\n\t--no-progressive-output                Wait until every file is processed before outputting results. Default: false (output progressively).\n\n\t--suppress                             [Experimental] Generate/update suppressions file for all current errors.\n\t--suppress-rule RULE_ID                [Experimental] Suppress only the specified rule.\n\t--prune-suppressions                   [Experimental] Remove stale entries from the suppressions file.\n\t--suppressions-location PATH           [Experimental] Custom path for the suppressions file. Default: \"markuplint-suppressions.json\".\n\n\t--init                                 Initialize settings interactively.\n\t--search                               Search lines of codes that include the target element by selectors.\n\n\t--help,                  -h            Show help.\n\t--version,               -v            Show version.\n\nExamples\n\t$ markuplint verifyee.html --config path/to/.markuplintrc\n\t$ cat verifyee.html | markuplint\n";
 export declare const cli: import("meow").Result<{
     config: {
         type: "string";
@@ -74,6 +74,9 @@ export declare const cli: import("meow").Result<{
     severityParseError: {
         type: "string";
     };
+    severityDeprecation: {
+        type: "string";
+    };
     maxCount: {
         type: "number";
         default: number;

package/lib/cli/bootstrap.js

@@ -21,6 +21,7 @@ Options
 	--verbose                              Output with detailed information.
 	--include-node-modules                 Include files in node_modules directory. Default: false.
 	--severity-parse-error                 Severity for the built-in parse-error channel. Supports "error", "warning", and "off". Unset by default: fatal ParserErrors emit at "error" and non-fatal parse5 events are off (opt-in per code via config).
+	--severity-deprecation                 Severity for the built-in rule-deprecation channel (deprecated rule names). Supports "error", "warning", and "off". Default: "warning".
 	--max-count                            Limit the number of violations shown. Default: 0 (no limit).
 	--max-warnings                         Number of warnings to trigger nonzero exit code. Default: -1 (no limit).
 	--no-progressive-output                Wait until every file is processed before outputting results. Default: false (output progressively).
@@ -116,6 +117,9 @@ export const cli = meow(help, {
         severityParseError: {
             type: 'string',
         },
+        severityDeprecation: {
+            type: 'string',
+        },
         maxCount: {
             type: 'number',
             default: 0,

package/lib/cli/command.js

@@ -1,13 +1,30 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
-import { resolveFiles } from '@markuplint/file-resolver';
+import { ConfigProvider, resolveFiles } from '@markuplint/file-resolver';
 import { ViolationCollector } from '@markuplint/ml-core';
 import { isFatalError } from '@markuplint/shared';
 import { MLEngine } from '../api/index.js';
 import { log } from '../debug.js';
 import { applySuppressions, generateSuppressions, mergeSuppressions, pruneSuppressions, readSuppressionsFile, resolveSuppressionsPath, writeSuppressionsFile, } from '../suppressions/index.js';
+import { CONFIG_LEVEL_RULE_IDS, dedupeConfigLevelViolations } from '../dedupe-config-violations.js';
 import { outputDryRunDiff } from './dry-run-output.js';
 import { output, outputSummary } from './output.js';
+/**
+ * Validates a `--severity-*` flag's raw string value against the uniform
+ * single-value form both `--severity-parse-error` and `--severity-deprecation`
+ * accept, shared so adding another such flag doesn't mean copy-pasting this
+ * check again.
+ *
+ * @returns the validated value, or `undefined` if unset or not one of
+ * `"error"`, `"warning"`, `"off"`.
+ */
+function parseSeverityFlag(value) {
+    const normalized = value?.toLowerCase();
+    if (normalized != null && ['error', 'warning', 'off'].includes(normalized)) {
+        return normalized;
+    }
+    return undefined;
+}
 export async function command(files, options, apiOptions) {
     const fixDryRun = options.fixDryRun;
     if (options.fix && fixDryRun) {
@@ -47,18 +64,22 @@ export async function command(files, options, apiOptions) {
     const collector = new ViolationCollector(options.maxCount);
     const processedFiles = [];
     const skippedFiles = [];
-    // `config-error` violations (deprecated rule names, unresolved rule
-    // references, ...) come from resolving this run's config, so the same
-    // message is identical across every file. Track messages already
-    // reported once so a run over many files doesn't repeat the same lines
-    // per file — the config is one thing, not N things.
+    // See `dedupeConfigLevelViolations` for why this Set needs to persist
+    // across the whole run (not per file).
     const seenConfigMessages = new Set();
     const filesContent = new Map();
     const engines = new Map();
-    const severityParseError = options.severityParseError?.toLowerCase();
-    const severity = severityParseError != null && ['error', 'warning', 'off'].includes(severityParseError)
-        ? { parseError: severityParseError }
-        : {};
+    // Shared across every file in this run so its config cache — keyed by
+    // resolved config `names`, not by target file — actually helps: config
+    // loading/merging/plugin-resolution is done once per distinct config,
+    // not once per file. See #3997.
+    const configProvider = new ConfigProvider();
+    const parsedSeverityParseError = parseSeverityFlag(options.severityParseError);
+    const parsedSeverityDeprecation = parseSeverityFlag(options.severityDeprecation);
+    const severity = {
+        ...(parsedSeverityParseError != null && { parseError: parsedSeverityParseError }),
+        ...(parsedSeverityDeprecation != null && { deprecation: parsedSeverityDeprecation }),
+    };
     // Progressive output prints each file's own violations as soon as that
     // file is processed, ahead of the two whole-run passes that batch output
     // waits for: suppressions (applied once at the end, below, via
@@ -101,6 +122,7 @@ export async function command(files, options, apiOptions) {
             debug: verbose,
             severity,
             ...apiOptions,
+            configProvider,
         });
         if (options.showConfig != null) {
             const isDetails = options.showConfig === 'details';
@@ -116,6 +138,8 @@ export async function command(files, options, apiOptions) {
                     dependencies,
                     plugins: configSet.plugins,
                     errors: configSet.errs,
+                    ruleDeprecations: configSet.ruleDeprecations,
+                    appliedOverrides: configSet.appliedOverrides ?? [],
                 };
             }
             else {
@@ -143,20 +167,7 @@ export async function command(files, options, apiOptions) {
         const violationsBeforeDedupe = fixDryRun
             ? result.violations
             : (result.fixSummary?.finalPassViolations ?? result.violations);
-        // `config-error` is regenerated fresh per file (config resolution is
-        // not shared across a run), so an identical message would otherwise
-        // repeat once per file. Keep only the first occurrence across this run.
-        const reportedViolations = violationsBeforeDedupe.filter(violation => {
-            if (violation.ruleId !== 'config-error') {
-                return true;
-            }
-            const key = `${violation.ruleId} ${violation.message}`;
-            if (seenConfigMessages.has(key)) {
-                return false;
-            }
-            seenConfigMessages.add(key);
-            return true;
-        });
+        const reportedViolations = dedupeConfigLevelViolations(violationsBeforeDedupe, seenConfigMessages);
         // Progressive出力が有効でJSON形式でない場合
         if (progressiveOutput && format !== 'json') {
             // 即座に出力
@@ -326,10 +337,11 @@ export async function command(files, options, apiOptions) {
     let failedFileCount = 0;
     for (const filePath of processedFiles) {
         const violations = outputViolationsByFile.get(filePath) || [];
-        // A file whose only violations are `config-error` didn't fail on its
-        // own content — the config issue is reported once for the whole run
-        // (see the dedupe above), not attributable to this particular file.
-        if (violations.some(violation => violation.ruleId !== 'config-error')) {
+        // A file whose only violations are config-level (`CONFIG_LEVEL_RULE_IDS`)
+        // didn't fail on its own content — the config issue is reported once
+        // for the whole run (see the dedupe above), not attributable to this
+        // particular file.
+        if (violations.some(violation => !CONFIG_LEVEL_RULE_IDS.has(violation.ruleId))) {
             failedFileCount++;
         }
         for (const violation of violations) {

package/lib/dedupe-config-violations.d.ts

@@ -0,0 +1,29 @@
+import type { Violation } from '@markuplint/ml-config';
+/**
+ * Synthetic ruleIds produced from resolving a run's config rather than from
+ * linting a file's content (`config-error`: broken config; `rule-deprecation`:
+ * deprecated-but-working rule names). Both regenerate identically for every
+ * file that shares the same config, so both need the same per-run dedupe —
+ * see {@link dedupeConfigLevelViolations} — and the same exclusion from
+ * per-file failure counting (`packages/markuplint/src/cli/command.ts`).
+ */
+export declare const CONFIG_LEVEL_RULE_IDS: Set<string>;
+/**
+ * Filters `violations` down to the first occurrence of each distinct
+ * config-level ({@link CONFIG_LEVEL_RULE_IDS}) message, tracked in `seen`
+ * across calls. Non-config-level violations always pass through unchanged.
+ *
+ * Even with config resolution now shared across a run (see
+ * `ConfigProvider`, #3997), each file's `MLCore.verify()` still builds its
+ * own `violations` array independently from that shared config data — so a
+ * config-level message would otherwise still repeat once per file that
+ * shares the config. The config is one thing, not N things. `seen` is
+ * caller-owned (a plain `Set<string>`) so both the CLI (per run) and the
+ * `lint()` API (per call) can each keep their own dedupe scope without
+ * sharing state between unrelated runs.
+ *
+ * @param violations - Violations to filter, in file-processing order
+ * @param seen - Accumulates `${ruleId} ${message}` keys already kept; mutated in place
+ * @returns `violations` with repeat config-level entries removed
+ */
+export declare function dedupeConfigLevelViolations(violations: readonly Violation[], seen: Set<string>): readonly Violation[];

package/lib/dedupe-config-violations.js

@@ -0,0 +1,41 @@
+import { CONFIG_ERROR_RULE_ID, RULE_DEPRECATION_RULE_ID } from '@markuplint/ml-core';
+/**
+ * Synthetic ruleIds produced from resolving a run's config rather than from
+ * linting a file's content (`config-error`: broken config; `rule-deprecation`:
+ * deprecated-but-working rule names). Both regenerate identically for every
+ * file that shares the same config, so both need the same per-run dedupe —
+ * see {@link dedupeConfigLevelViolations} — and the same exclusion from
+ * per-file failure counting (`packages/markuplint/src/cli/command.ts`).
+ */
+export const CONFIG_LEVEL_RULE_IDS = new Set([CONFIG_ERROR_RULE_ID, RULE_DEPRECATION_RULE_ID]);
+/**
+ * Filters `violations` down to the first occurrence of each distinct
+ * config-level ({@link CONFIG_LEVEL_RULE_IDS}) message, tracked in `seen`
+ * across calls. Non-config-level violations always pass through unchanged.
+ *
+ * Even with config resolution now shared across a run (see
+ * `ConfigProvider`, #3997), each file's `MLCore.verify()` still builds its
+ * own `violations` array independently from that shared config data — so a
+ * config-level message would otherwise still repeat once per file that
+ * shares the config. The config is one thing, not N things. `seen` is
+ * caller-owned (a plain `Set<string>`) so both the CLI (per run) and the
+ * `lint()` API (per call) can each keep their own dedupe scope without
+ * sharing state between unrelated runs.
+ *
+ * @param violations - Violations to filter, in file-processing order
+ * @param seen - Accumulates `${ruleId} ${message}` keys already kept; mutated in place
+ * @returns `violations` with repeat config-level entries removed
+ */
+export function dedupeConfigLevelViolations(violations, seen) {
+    return violations.filter(violation => {
+        if (!CONFIG_LEVEL_RULE_IDS.has(violation.ruleId)) {
+            return true;
+        }
+        const key = `${violation.ruleId} ${violation.message}`;
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "markuplint",
-	"version": "5.0.0-rc.5",
+	"version": "5.0.0-rc.7",
 	"description": "An HTML linter for all markup developers",
 	"author": "Yusuke Hirao",
 	"license": "MIT",
@@ -35,17 +35,17 @@
 		"clean": "tsc --build --clean tsconfig.build.json"
 	},
 	"dependencies": {
-		"@markuplint/cli-utils": "5.0.0-rc.5",
-		"@markuplint/file-resolver": "5.0.0-rc.5",
-		"@markuplint/html-parser": "5.0.0-rc.5",
-		"@markuplint/html-spec": "5.0.0-rc.5",
-		"@markuplint/i18n": "5.0.0-rc.5",
-		"@markuplint/ml-ast": "5.0.0-rc.5",
-		"@markuplint/ml-config": "5.0.0-rc.5",
-		"@markuplint/ml-core": "5.0.0-rc.5",
-		"@markuplint/ml-spec": "5.0.0-rc.5",
-		"@markuplint/rules": "5.0.0-rc.5",
-		"@markuplint/shared": "5.0.0-rc.5",
+		"@markuplint/cli-utils": "5.0.0-rc.7",
+		"@markuplint/file-resolver": "5.0.0-rc.7",
+		"@markuplint/html-parser": "5.0.0-rc.7",
+		"@markuplint/html-spec": "5.0.0-rc.7",
+		"@markuplint/i18n": "5.0.0-rc.7",
+		"@markuplint/ml-ast": "5.0.0-rc.7",
+		"@markuplint/ml-config": "5.0.0-rc.7",
+		"@markuplint/ml-core": "5.0.0-rc.7",
+		"@markuplint/ml-spec": "5.0.0-rc.7",
+		"@markuplint/rules": "5.0.0-rc.7",
+		"@markuplint/shared": "5.0.0-rc.7",
 		"@types/debug": "4.1.13",
 		"chokidar": "5.0.0",
 		"debug": "4.4.3",
@@ -55,5 +55,5 @@
 		"strip-ansi": "7.2.0",
 		"type-fest": "5.6.0"
 	},
-	"gitHead": "8d87463af2ff3f1b83fb28da20f1819362cf3555"
+	"gitHead": "8d7a3b801e0f5f88438c003e7eee2bd45e6aedd0"
 }