oxlint-plugin-react-doctor 0.7.2-dev.aa519e5 → 0.7.2-dev.b97a92f

package/dist/index.js

@@ -13508,7 +13508,7 @@ const jsTosortedImmutable = defineRule({
 	title: "Spread copy before sort()",
 	tags: ["test-noise"],
 	severity: "warn",
-	disabledBy: ["react-native", "pre-es2023"],
+	disabledWhen: ["react-native", "pre-es2023"],
 	recommendation: "Use `array.toSorted()` (ES2023) instead of `[...array].sort()` so you sort without copying the array first",
 	create: (context) => ({ CallExpression(node) {
 		if (!isMemberProperty(node.callee, "sort")) return;
@@ -14755,7 +14755,7 @@ const jsxNoConstructedContextValues = defineRule({
 	title: "Unstable context provider value",
 	tags: ["react-jsx-only"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Wrap the context value in `useMemo` or move it outside the component so consumers do not redraw every render.",
 	category: "Performance",
 	create: (context) => {
@@ -15123,7 +15123,7 @@ const jsxNoJsxAsProp = defineRule({
 	title: "JSX element passed as a prop",
 	tags: ["react-jsx-only"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Move the JSX outside the component or wrap it in `useMemo` so memoized children do not redraw every render.",
 	category: "Performance",
 	create: (context) => {
@@ -15511,7 +15511,7 @@ const jsxNoNewArrayAsProp = defineRule({
 	title: "New array passed as a prop",
 	tags: ["react-jsx-only"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Wrap the array in `useMemo` or move it outside the component so memoized children do not redraw every render.",
 	category: "Performance",
 	create: (context) => {
@@ -15975,7 +15975,7 @@ const jsxNoNewFunctionAsProp = defineRule({
 	title: "New function passed as a prop",
 	tags: ["react-jsx-only"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Wrap the callback in `useCallback` or move it outside the component so memoized children do not redraw every render.",
 	category: "Performance",
 	create: (context) => {
@@ -16282,7 +16282,7 @@ const jsxNoNewObjectAsProp = defineRule({
 	title: "New object passed as a prop",
 	tags: ["react-jsx-only"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Wrap the object in `useMemo` or move it outside the component so memoized children do not redraw every render.",
 	category: "Performance",
 	create: (context) => {
@@ -18106,6 +18106,7 @@ const getReactDoctorStringArraySetting = (settings, settingName) => {
 	if (!Array.isArray(settingValue)) return [];
 	return settingValue.filter((entry) => typeof entry === "string" && entry.length > 0);
 };
+const hasCapability = (settings, capability) => getReactDoctorStringArraySetting(settings, "capabilities").includes(capability);
 //#endregion
 //#region src/plugin/utils/is-in-project-directory.ts
 const isInProjectDirectory = (context, directoryPath) => {
@@ -18560,6 +18561,7 @@ const describeClientSideNavigation = (node) => {
 	}
 	return null;
 };
+const STATIC_EXPORT_RECOMMENDATION = "Avoid redirects inside useEffect — they flash the wrong page first. Use an event handler (e.g. onClick), or call redirect() from next/navigation during render (it prerenders a client-side redirect under output: \"export\"). Middleware and getServerSideProps redirects aren't available in a static export.";
 const nextjsNoClientSideRedirect = defineRule({
 	id: "nextjs-no-client-side-redirect",
 	title: "Client-side redirect for navigation",
@@ -18567,6 +18569,7 @@ const nextjsNoClientSideRedirect = defineRule({
 	requires: ["nextjs"],
 	severity: "warn",
 	recommendation: "Avoid redirects inside useEffect. Use an event handler, middleware, or server-side redirect (App Router: redirect() from next/navigation; Pages Router: getServerSideProps redirect)",
+	recommendationFor: (hasCapability) => hasCapability("nextjs:static-export") ? STATIC_EXPORT_RECOMMENDATION : void 0,
 	create: (context) => {
 		return { CallExpression(node) {
 			if (!isHookCall$2(node, EFFECT_HOOK_NAMES$1)) return;
@@ -28928,7 +28931,7 @@ const noJsonParseStringifyClone = defineRule({
 	id: "no-json-parse-stringify-clone",
 	title: "JSON parse/stringify deep clone",
 	severity: "warn",
-	disabledBy: ["react-native"],
+	disabledWhen: ["react-native"],
 	recommendation: "Replace `JSON.parse(JSON.stringify(value))` with `structuredClone(value)`. It is faster and preserves Dates, Maps, Sets, and cyclic references.",
 	create: (context) => ({ CallExpression(node) {
 		if (!isJsonMethodCall(node, "parse")) return;
@@ -31752,12 +31755,8 @@ const noPolymorphicChildren = defineRule({
 //#endregion
 //#region src/plugin/rules/correctness/no-prevent-default.ts
 const PREVENT_DEFAULT_ELEMENTS = new Map([["form", ["onSubmit"]], ["a", ["onClick"]]]);
-const SERVER_CAPABLE_FRAMEWORKS = new Set([
-	"nextjs",
-	"tanstack-start",
-	"remix"
-]);
 const FORM_MESSAGE_SERVER_CAPABLE = "Your users can't submit this <form> without JavaScript because onSubmit calls preventDefault(), so use a server action like `<form action={serverAction}>` to make it work either way.";
+const FORM_MESSAGE_GENERIC = "Your users can't submit this <form> because onSubmit calls preventDefault().";
 const ANCHOR_MESSAGE = "Your users click this <a> & nothing navigates because onClick calls preventDefault(), so use a <button> or a routing component instead.";
 const collectPreventDefaultCalls = (node) => {
 	const preventDefaultCalls = [];
@@ -31894,15 +31893,18 @@ const noPreventDefault = defineRule({
 	recommendation: "Use `<form action>` where your framework supports it (it works without JS), or use a `<button>` instead of an `<a>` with preventDefault.",
 	create: (context) => {
 		const framework = getReactDoctorStringSetting(context.settings, "framework");
-		const isServerCapableFramework = framework !== void 0 && SERVER_CAPABLE_FRAMEWORKS.has(framework);
+		const isClientOnlyFramework = hasCapability(context.settings, "client-only");
+		const isServerActionsFramework = hasCapability(context.settings, "server-actions");
+		const formMessage = isServerActionsFramework ? FORM_MESSAGE_SERVER_CAPABLE : FORM_MESSAGE_GENERIC;
 		return { JSXOpeningElement(node) {
 			const elementName = isNodeOfType(node.name, "JSXIdentifier") ? node.name.name : null;
 			if (!elementName) return;
 			const targetEventProps = PREVENT_DEFAULT_ELEMENTS.get(elementName);
 			if (!targetEventProps) return;
 			if (elementName === "form") {
-				if (!isServerCapableFramework) return;
-				if (framework === "nextjs") {
+				if (isClientOnlyFramework) return;
+				if (framework === void 0 || framework === "unknown") return;
+				if (framework === "nextjs" && isServerActionsFramework) {
 					const programRoot = findProgramRoot(node);
 					if (!programRoot || !hasDirective(programRoot, "use client")) return;
 				}
@@ -31926,7 +31928,7 @@ const noPreventDefault = defineRule({
 				}
 				context.report({
 					node,
-					message: elementName === "form" ? FORM_MESSAGE_SERVER_CAPABLE : ANCHOR_MESSAGE
+					message: elementName === "form" ? formMessage : ANCHOR_MESSAGE
 				});
 				return;
 			}
@@ -33196,11 +33198,41 @@ const isIdentifierLikeKeyNameValue = (literalValue) => {
 	if (wordSegments.length < 2) return false;
 	return wordSegments.every((segment) => /^[a-z]+$/.test(segment));
 };
+const FRAMEWORK_ENV_ADVICE = [
+	[
+		"nextjs",
+		"Next.js",
+		"NEXT_PUBLIC_*"
+	],
+	[
+		"vite",
+		"Vite",
+		"VITE_*"
+	],
+	[
+		"tanstack-start",
+		"TanStack Start",
+		"VITE_*"
+	],
+	[
+		"cra",
+		"Create React App",
+		"REACT_APP_*"
+	],
+	[
+		"gatsby",
+		"Gatsby",
+		"GATSBY_*"
+	]
+];
 const noSecretsInClientCode = defineRule({
 	id: "no-secrets-in-client-code",
 	title: "Secret in client code",
 	severity: "warn",
 	recommendation: "Move secrets to server-only code. Anything in client env variables gets shipped to the browser, so it can't hold secrets.",
+	recommendationFor: (hasCapability) => {
+		for (const [frameworkToken, frameworkName, publicEnvPrefix] of FRAMEWORK_ENV_ADVICE) if (hasCapability(frameworkToken)) return `Move secrets to server-only code. In ${frameworkName}, only \`${publicEnvPrefix}\` env vars are exposed to the browser, and they must not contain secrets`;
+	},
 	create: (context) => {
 		const filename = normalizeFilename(context.filename ?? "");
 		const framework = getReactDoctorStringSetting(context.settings, "framework");
@@ -33238,7 +33270,7 @@ const noSecretsInClientCode = defineRule({
 				const isServerOnlyScope = isInsideServerOnlyScope(node);
 				const trailingSuffix = getIdentifierTrailingWord(variableName);
 				const isUiConstant = SECRET_FALSE_POSITIVE_SUFFIXES.has(trailingSuffix);
-				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && !isPublicUrlValue(literalValue) && !isPlaceholderValueForVariableHeuristic && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && literalValue.length > 24) {
+				if (shouldUseVariableNameHeuristic && !isServerOnlyScope && SECRET_VARIABLE_PATTERN.test(variableName) && !isUiConstant && !isPublicUrlValue(literalValue) && !isPlaceholderValueForVariableHeuristic && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && !isSelfReferentialSentinelValue(variableName, literalValue) && !isIdentifierLikeKeyNameValue(literalValue) && literalValue.length > 24) {
 					context.report({
 						node,
 						message: `Hardcoding "${variableName}" in client code is a security vulnerability: the secret ships to the browser where anyone can read it.`
@@ -37962,7 +37994,7 @@ const preferModuleScopeStaticValue = defineRule({
 	tags: ["test-noise"],
 	severity: "warn",
 	category: "Architecture",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Move the value above the component, at the top of the file. It doesn't use local state, so rebuilding it each update is wasted and makes it look new every time.",
 	create: (context) => ({ VariableDeclarator(node) {
 		if (!isNodeOfType(node.id, "Identifier")) return;
@@ -38032,7 +38064,7 @@ const preferStableEmptyFallback = defineRule({
 	tags: ["react-jsx-only", "test-noise"],
 	severity: "warn",
 	category: "Performance",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Make a `const EMPTY = []` (or `{}`) at module scope and use it as the `||` / `??` fallback, so the value stays the same each render.",
 	create: (context) => {
 		let memoRegistry = null;
@@ -39361,7 +39393,7 @@ const reduxUseselectorInlineDerivation = defineRule({
 	title: "useSelector derives data inline",
 	severity: "warn",
 	category: "Performance",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Select the raw slice and memoize derivation so Redux actions do not rebuild a collection and redraw this component.",
 	create: (context) => {
 		let aliases = /* @__PURE__ */ new Set();
@@ -39421,7 +39453,7 @@ const reduxUseselectorReturnsNewCollection = defineRule({
 	title: "useSelector returns a new collection",
 	severity: "warn",
 	category: "Performance",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Return a stable selected value, split selectors, or pass `shallowEqual` so every Redux action does not redraw this component.",
 	create: (context) => {
 		let aliases = /* @__PURE__ */ new Set();
@@ -39721,7 +39753,7 @@ const renderingHydrationMismatchTime = defineRule({
 	title: "Time or random value in JSX",
 	severity: "warn",
 	category: "Correctness",
-	disabledBy: ["vite", "cra"],
+	disabledWhen: ["vite", "cra"],
 	recommendation: "Move time or random values into useEffect+useState so they only run in the browser, or add suppressHydrationWarning to the parent if it's intentional",
 	create: (context) => {
 		const isTestlikeFile = isTestlikeFilename(context.filename);
@@ -41688,7 +41720,7 @@ const rnListCallbackPerRow = defineRule({
 	tags: ["test-noise"],
 	requires: ["react-native"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Move the handler out with useCallback at list scope and pass the row id as a prop. Then memo() rows skip redrawing when their data has not changed.",
 	create: (context) => {
 		const inspect = (node) => {
@@ -42316,7 +42348,7 @@ const rnNoInlineFlatlistRenderitem = defineRule({
 	tags: ["test-noise"],
 	requires: ["react-native"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Move renderItem to a named function or wrap it in useCallback so it is not rebuilt every time the screen redraws.",
 	create: (context) => ({ JSXAttribute(node) {
 		if (!isNodeOfType(node.name, "JSXIdentifier") || node.name.name !== "renderItem") return;
@@ -42341,7 +42373,7 @@ const rnNoInlineObjectInListItem = defineRule({
 	tags: ["test-noise"],
 	requires: ["react-native"],
 	severity: "warn",
-	disabledBy: ["react-compiler"],
+	disabledWhen: ["react-compiler"],
 	recommendation: "Move style and object props out of renderItem (StyleSheet.create, useMemo at list scope, or pass primitives) so memo() rows stop redrawing when their data has not changed.",
 	create: (context) => {
 		const renderPropStack = [];
@@ -48452,7 +48484,7 @@ const serverFetchWithoutRevalidate = defineRule({
 	id: "server-fetch-without-revalidate",
 	title: "Fetch without revalidate",
 	severity: "warn",
-	disabledBy: ["nextjs:15"],
+	disabledWhen: ["nextjs:15", "nextjs:static-export"],
 	recommendation: "Pass `{ next: { revalidate: <seconds> } }` (or `cache: \"no-store\"`) so old data doesn't stick around.",
 	create: (context) => {
 		let isServerSideFile = false;
@@ -56227,9 +56259,23 @@ const classifySecurityScanFile = (relativePath) => {
 };
 const shouldReadSecurityScanContent = (relativePath, isGeneratedBundle) => isGeneratedBundle || isProbablyTextFile(relativePath) || isConfigOrCiPath(relativePath) || isRepositorySecretFilePath(relativePath);
 //#endregion
+//#region src/plugin/utils/capability.ts
+const FRAMEWORK_TOKENS = [
+	"nextjs",
+	"vite",
+	"cra",
+	"remix",
+	"gatsby",
+	"expo",
+	"react-native",
+	"tanstack-start",
+	"preact",
+	"unknown"
+];
+//#endregion
 //#region src/index.ts
 var src_default = plugin;
 //#endregion
-export { ALL_REACT_DOCTOR_RULES, ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, EXTERNAL_RULES, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, NEXTJS_RULES, PREACT_RULES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, REACT_NATIVE_DEPENDENCY_NAMES, REACT_NATIVE_DEPENDENCY_PREFIXES, REACT_NATIVE_RULES, RECOMMENDED_RULES, RULES, TANSTACK_QUERY_RULES, TANSTACK_START_RULES, UNBOUNDED_CROSS_FILE_RULE_IDS, classifySecurityScanFile, collectCrossFileDependencyProbes, src_default as default, isReactNativeDependencyName, resetManifestCaches, shouldReadSecurityScanContent };
+export { ALL_REACT_DOCTOR_RULES, ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, EXTERNAL_RULES, FRAMEWORK_SPECIFIC_RULE_KEYS, FRAMEWORK_TOKENS, MOTION_LIBRARY_PACKAGES, NEXTJS_RULES, PREACT_RULES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, REACT_NATIVE_DEPENDENCY_NAMES, REACT_NATIVE_DEPENDENCY_PREFIXES, REACT_NATIVE_RULES, RECOMMENDED_RULES, RULES, TANSTACK_QUERY_RULES, TANSTACK_START_RULES, UNBOUNDED_CROSS_FILE_RULE_IDS, classifySecurityScanFile, collectCrossFileDependencyProbes, src_default as default, isReactNativeDependencyName, resetManifestCaches, shouldReadSecurityScanContent };
 
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.2-dev.aa519e5",
+  "version": "0.7.2-dev.b97a92f",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",