oxlint-plugin-react-doctor 0.7.4-dev.593824d → 0.7.4-dev.5aa82e8

package/dist/index.d.ts

@@ -5296,6 +5296,29 @@ declare const REACT_DOCTOR_RULES: readonly [{
     readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
     readonly create: (context: RuleContext) => RuleVisitors;
   };
+}, {
+  readonly key: "react-doctor/no-prop-callback-in-render";
+  readonly id: "no-prop-callback-in-render";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Bugs";
+    readonly requires: readonly Capability[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly tags?: ReadonlyArray<string>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
 }, {
   readonly key: "react-doctor/no-prop-types";
   readonly id: "no-prop-types";
@@ -5480,6 +5503,29 @@ declare const REACT_DOCTOR_RULES: readonly [{
     readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
     readonly create: (context: RuleContext) => RuleVisitors;
   };
+}, {
+  readonly key: "react-doctor/no-ref-current-in-render";
+  readonly id: "no-ref-current-in-render";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Bugs";
+    readonly requires: readonly Capability[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly tags?: ReadonlyArray<string>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
 }, {
   readonly key: "react-doctor/no-render-in-render";
   readonly id: "no-render-in-render";
@@ -14516,6 +14562,29 @@ declare const RULES: readonly [{
     readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
     readonly create: (context: RuleContext) => RuleVisitors;
   };
+}, {
+  readonly key: "react-doctor/no-prop-callback-in-render";
+  readonly id: "no-prop-callback-in-render";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Bugs";
+    readonly requires: readonly Capability[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly tags?: ReadonlyArray<string>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
 }, {
   readonly key: "react-doctor/no-prop-types";
   readonly id: "no-prop-types";
@@ -14700,6 +14769,29 @@ declare const RULES: readonly [{
     readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
     readonly create: (context: RuleContext) => RuleVisitors;
   };
+}, {
+  readonly key: "react-doctor/no-ref-current-in-render";
+  readonly id: "no-ref-current-in-render";
+  readonly source: "react-doctor";
+  readonly originallyExternal: false;
+  readonly rule: {
+    readonly framework: "global";
+    readonly category: "Bugs";
+    readonly requires: readonly Capability[];
+    readonly id: string;
+    readonly title?: string;
+    readonly severity: RuleSeverity;
+    readonly disabledWhen?: ReadonlyArray<Capability>;
+    readonly tags?: ReadonlyArray<string>;
+    readonly matchByOccurrence?: boolean;
+    readonly defaultEnabled?: boolean;
+    readonly lifecycle?: "retired";
+    readonly scan?: FileScan;
+    readonly committedFilesOnly?: boolean;
+    readonly recommendation?: string;
+    readonly recommendationFor?: (hasCapability: CapabilityQuery) => string | undefined;
+    readonly create: (context: RuleContext) => RuleVisitors;
+  };
 }, {
   readonly key: "react-doctor/no-render-in-render";
   readonly id: "no-render-in-render";

package/dist/index.js

@@ -553,7 +553,7 @@ const EXTERNAL_SYNC_OBSERVER_CONSTRUCTORS = new Set([
 	"ResizeObserver",
 	"PerformanceObserver"
 ]);
-const STORAGE_OBJECTS$1 = new Set(["localStorage", "sessionStorage"]);
+const STORAGE_OBJECTS = new Set(["localStorage", "sessionStorage"]);
 //#endregion
 //#region src/plugin/constants/react.ts
 const INDEX_PARAMETER_NAMES = new Set([
@@ -5139,8 +5139,10 @@ const STORAGE_GLOBALS = new Set([
 const SENSITIVE_KEY_PATTERN = /token|jwt|secret|password|passwd|credential|api[-_]?key|bearer|private[-_]?key/i;
 const NON_AUTH_TOKEN_PATTERN = /csrf|xsrf|device|fcm|apns|push|design|tokeniz|syntax|css|theme|color/i;
 const STRONG_AUTH_KEY_PATTERN = /jwt|secret|password|passwd|credential|private[-_]?key|api[-_]?key|bearer|access[-_]?token|refresh[-_]?token|auth[-_]?token|id[-_]?token|session/i;
+const PRODUCT_API_KEY_COLLECTION_PATTERN = /[._:-](?:created|generated|saved)[-_]?api[-_]?keys$/i;
 const isAuthCredentialKey = (key) => {
 	if (!SENSITIVE_KEY_PATTERN.test(key)) return false;
+	if (PRODUCT_API_KEY_COLLECTION_PATTERN.test(key)) return false;
 	if (NON_AUTH_TOKEN_PATTERN.test(key) && !STRONG_AUTH_KEY_PATTERN.test(key)) return false;
 	return true;
 };
@@ -6135,7 +6137,6 @@ const isGlobalMethodCall = (node, objectName, methodName) => {
 //#region src/plugin/rules/client/client-localstorage-no-version.ts
 const VERSIONED_KEY_PATTERN = /(?:[._:-]v\d+|@\d+|\bv\d+\b)/i;
 const CAMEL_CASE_VERSIONED_KEY_PATTERN = /[a-z]V\d+/;
-const STORAGE_OBJECTS = new Set(["localStorage", "sessionStorage"]);
 const isVersionedKey = (key) => VERSIONED_KEY_PATTERN.test(key) || CAMEL_CASE_VERSIONED_KEY_PATTERN.test(key);
 const isJsonStringifyCall = (node) => isGlobalMethodCall(node, "JSON", "stringify");
 const resolveStringKey = (keyArg, context) => {
@@ -6158,7 +6159,7 @@ const clientLocalstorageNoVersion = defineRule({
 		if (!isNodeOfType(node.callee, "MemberExpression")) return;
 		const receiver = stripParenExpression(node.callee.object);
 		if (!isNodeOfType(receiver, "Identifier")) return;
-		if (!STORAGE_OBJECTS.has(receiver.name)) return;
+		if (receiver.name !== "localStorage") return;
 		if (!isNodeOfType(node.callee.property, "Identifier")) return;
 		if (node.callee.property.name !== "setItem") return;
 		const keyArg = node.arguments?.[0];
@@ -8938,7 +8939,7 @@ const getListenerAbortControllerKey = (usage, context) => {
 	}
 	return null;
 };
-const SYNCHRONOUS_ITERATOR_METHOD_NAMES$1 = new Set([
+const SYNCHRONOUS_ITERATOR_METHOD_NAMES$2 = new Set([
 	"every",
 	"filter",
 	"flatMap",
@@ -8954,7 +8955,7 @@ const isSynchronousIteratorCallback = (functionNode) => {
 	const callee = stripParenExpression(callNode.callee);
 	if (!isNodeOfType(callee, "MemberExpression") || callee.computed || !isNodeOfType(callee.property, "Identifier")) return false;
 	if (isNodeOfType(callee.object, "Identifier") && callee.object.name === "Array" && callee.property.name === "from") return callNode.arguments?.[1] === functionNode;
-	return SYNCHRONOUS_ITERATOR_METHOD_NAMES$1.has(callee.property.name) && callNode.arguments?.[0] === functionNode;
+	return SYNCHRONOUS_ITERATOR_METHOD_NAMES$2.has(callee.property.name) && callNode.arguments?.[0] === functionNode;
 };
 const findDirectCallForReference = (identifier) => {
 	const expressionRoot = findTransparentExpressionRoot(identifier);
@@ -10589,6 +10590,19 @@ const isUnstableInitializer = (node) => {
 	if (isNodeOfType(stripped, "LogicalExpression")) return isUnstableInitializer(stripped.left) || isUnstableInitializer(stripped.right);
 	return isNodeOfType(stripped, "ObjectExpression") || isNodeOfType(stripped, "ArrayExpression") || isNodeOfType(stripped, "ClassExpression") || isNodeOfType(stripped, "ClassDeclaration") || isNodeOfType(stripped, "JSXElement") || isNodeOfType(stripped, "JSXFragment") || isNodeOfType(stripped, "AssignmentExpression") || isNodeOfType(stripped, "NewExpression");
 };
+const isPotentiallyFreshComparedValue = (node, scopes, visitedSymbolIds = /* @__PURE__ */ new Set()) => {
+	const candidate = unwrapExpression$3(node);
+	if (isUnstableInitializer(candidate)) return true;
+	if (isNodeOfType(candidate, "ConditionalExpression")) return isPotentiallyFreshComparedValue(candidate.consequent, scopes, visitedSymbolIds) || isPotentiallyFreshComparedValue(candidate.alternate, scopes, visitedSymbolIds);
+	if (isNodeOfType(candidate, "LogicalExpression")) return isPotentiallyFreshComparedValue(candidate.left, scopes, visitedSymbolIds) || isPotentiallyFreshComparedValue(candidate.right, scopes, visitedSymbolIds);
+	if (!isNodeOfType(candidate, "Identifier")) return false;
+	const symbol = scopes.symbolFor(candidate);
+	if (!symbol || visitedSymbolIds.has(symbol.id)) return false;
+	if (symbol.kind === "let" || symbol.kind === "var") return true;
+	if (symbol.kind !== "const" || !symbol.initializer) return false;
+	visitedSymbolIds.add(symbol.id);
+	return isPotentiallyFreshComparedValue(symbol.initializer, scopes, visitedSymbolIds);
+};
 const isExtraDepAllowedForHook = (hookName, node, scopes) => {
 	if (!isExtraReactiveDepAllowed(node, scopes)) return false;
 	if (EFFECT_HOOKS_ALLOWING_EXTRA_REACTIVE_DEPS.has(hookName)) return true;
@@ -10602,6 +10616,52 @@ const isStableSetterLikeSymbol = (symbol, scopes) => {
 	if (!symbolHasStableHookOrigin(symbol, scopes)) return false;
 	return symbol.name.startsWith("set") || symbol.name.startsWith("dispatch") || symbol.name.startsWith("startTransition");
 };
+const isConvergingFunctionalUpdater = (node, scopes) => {
+	const updater = unwrapExpression$3(node);
+	if (!isNodeOfType(updater, "ArrowFunctionExpression") && !isNodeOfType(updater, "FunctionExpression")) return false;
+	const previousValueParameter = updater.params?.[0];
+	if (!previousValueParameter || !isNodeOfType(previousValueParameter, "Identifier")) return false;
+	let returnedExpression = updater.body;
+	if (isNodeOfType(updater.body, "BlockStatement")) {
+		returnedExpression = null;
+		for (const statement of updater.body.body ?? []) if (isNodeOfType(statement, "ReturnStatement") && statement.argument) {
+			returnedExpression = statement.argument;
+			break;
+		}
+	}
+	const conditional = returnedExpression ? unwrapExpression$3(returnedExpression) : null;
+	if (!conditional || !isNodeOfType(conditional, "ConditionalExpression")) return false;
+	const test = unwrapExpression$3(conditional.test);
+	if (!isNodeOfType(test, "BinaryExpression") || ![
+		"===",
+		"!==",
+		"==",
+		"!="
+	].includes(test.operator)) return false;
+	const isPreviousValue = (expression) => {
+		const candidate = unwrapExpression$3(expression);
+		return isNodeOfType(candidate, "Identifier") && candidate.name === previousValueParameter.name;
+	};
+	let comparedValue = null;
+	if (isPreviousValue(test.left)) comparedValue = test.right;
+	else if (isPreviousValue(test.right)) comparedValue = test.left;
+	if (!comparedValue) return false;
+	if (isPotentiallyFreshComparedValue(comparedValue, scopes)) return false;
+	const isSameComparedValue = (expression) => {
+		const candidate = unwrapExpression$3(expression);
+		const compared = unwrapExpression$3(comparedValue);
+		if (isNodeOfType(candidate, "Identifier") && isNodeOfType(compared, "Identifier")) return candidate.name === compared.name;
+		if (isNodeOfType(candidate, "Literal") && isNodeOfType(compared, "Literal")) return candidate.value === compared.value;
+		return false;
+	};
+	return test.operator === "===" || test.operator === "==" ? isPreviousValue(conditional.consequent) && isSameComparedValue(conditional.alternate) : isSameComparedValue(conditional.consequent) && isPreviousValue(conditional.alternate);
+};
+const isGuardedStableSetterCall = (identifier, symbol, scopes) => {
+	const parent = identifier.parent;
+	if (!parent || !isNodeOfType(parent, "CallExpression") || parent.callee !== identifier || !isStableSetterLikeSymbol(symbol, scopes)) return false;
+	const writtenValue = parent.arguments?.[0];
+	return Boolean(writtenValue && isConvergingFunctionalUpdater(writtenValue, scopes));
+};
 const findStableSetterReference = (node, scopes) => {
 	let setterName = null;
 	const visit = (current) => {
@@ -10609,7 +10669,7 @@ const findStableSetterReference = (node, scopes) => {
 		if (current !== node && (isNodeOfType(current, "FunctionDeclaration") || isNodeOfType(current, "FunctionExpression") || isNodeOfType(current, "ArrowFunctionExpression"))) return;
 		if (isNodeOfType(current, "Identifier")) {
 			const symbol = scopes.referenceFor(current)?.resolvedSymbol;
-			if (symbol && isStableSetterLikeSymbol(symbol, scopes)) {
+			if (symbol && isStableSetterLikeSymbol(symbol, scopes) && !isGuardedStableSetterCall(current, symbol, scopes)) {
 				setterName = symbol.name;
 				return;
 			}
@@ -13502,7 +13562,7 @@ const jsCacheStorage = defineRule({
 			CallExpression(node) {
 				if (!isMemberProperty(node.callee, "getItem")) return;
 				const receiver = stripParenExpression(node.callee.object);
-				if (!isNodeOfType(receiver, "Identifier") || !STORAGE_OBJECTS$1.has(receiver.name)) return;
+				if (!isNodeOfType(receiver, "Identifier") || !STORAGE_OBJECTS.has(receiver.name)) return;
 				if (!isNodeOfType(node.arguments?.[0], "Literal")) return;
 				const storageReadCounts = storageReadCountStack[storageReadCountStack.length - 1];
 				const storageKey = String(node.arguments[0].value);
@@ -13769,6 +13829,11 @@ const jsEarlyExit = defineRule({
 });
 //#endregion
 //#region src/plugin/rules/js-performance/js-flatmap-filter.ts
+const BOUNDED_PIPELINE_SOURCE_METHOD_NAMES = new Set(["slice", "split"]);
+const isBoundedPipelineSource = (node) => {
+	const receiver = stripParenExpression(node);
+	return isNodeOfType(receiver, "CallExpression") && isNodeOfType(receiver.callee, "MemberExpression") && isNodeOfType(receiver.callee.property, "Identifier") && BOUNDED_PIPELINE_SOURCE_METHOD_NAMES.has(receiver.callee.property.name);
+};
 const jsFlatmapFilter = defineRule({
 	id: "js-flatmap-filter",
 	title: ".map().filter(Boolean) loops twice",
@@ -13786,6 +13851,7 @@ const jsFlatmapFilter = defineRule({
 		if (!isNodeOfType(innerCall, "CallExpression") || !isNodeOfType(innerCall.callee, "MemberExpression") || !isNodeOfType(innerCall.callee.property, "Identifier")) return;
 		if (innerCall.callee.property.name !== "map") return;
 		const receiver = stripParenExpression(innerCall.callee.object);
+		if (receiver && isBoundedPipelineSource(receiver)) return;
 		if (receiver && isNodeOfType(receiver, "ArrayExpression")) {
 			const elements = receiver.elements ?? [];
 			if (elements.length > 0 && elements.length <= 8 && elements.every((element) => element == null || !isNodeOfType(element, "SpreadElement"))) return;
@@ -15721,6 +15787,40 @@ const isArrayVariableRenderedAsList = (declarator) => {
 	renderedAsListCache.set(declarator, didFindRenderingUse);
 	return didFindRenderingUse;
 };
+const namedCallbackIteratorCallCache = /* @__PURE__ */ new WeakMap();
+const findNamedCallbackIteratorCall = (functionNode) => {
+	const cached = namedCallbackIteratorCallCache.get(functionNode);
+	if (cached !== void 0) return cached;
+	const bindingIdentifier = getFunctionBindingIdentifier(functionNode);
+	if (!bindingIdentifier) {
+		namedCallbackIteratorCallCache.set(functionNode, null);
+		return null;
+	}
+	const programRoot = findProgramRoot(functionNode);
+	if (!programRoot) {
+		namedCallbackIteratorCallCache.set(functionNode, null);
+		return null;
+	}
+	let iteratorCall = null;
+	walkAst(programRoot, (node) => {
+		if (iteratorCall) return false;
+		if (!isNodeOfType(node, "Identifier") || node === bindingIdentifier || node.name !== bindingIdentifier.name) return;
+		const binding = findVariableInitializer(node, node.name);
+		if (!binding || binding.bindingIdentifier !== bindingIdentifier) return;
+		const callbackExpression = findTransparentExpressionRoot(node);
+		const callExpression = callbackExpression.parent;
+		if (!callExpression || !isNodeOfType(callExpression, "CallExpression")) return;
+		const callee = callExpression.callee;
+		if (!isNodeOfType(callee, "MemberExpression") || !isNodeOfType(callee.property, "Identifier") || !ITERATOR_METHOD_NAMES$1.has(callee.property.name)) return;
+		const callbackIndex = callee.property.name === "from" ? 1 : 0;
+		if (callExpression.arguments[callbackIndex] !== callbackExpression) return;
+		if (isNonChildrenJsxAttributeValue(callExpression)) return;
+		iteratorCall = callExpression;
+		return false;
+	});
+	namedCallbackIteratorCallCache.set(functionNode, iteratorCall);
+	return iteratorCall;
+};
 const findEnclosingIteratorContext = (jsxNode) => {
 	let current = jsxNode;
 	let isOutsideContainingFunction = false;
@@ -15735,6 +15835,11 @@ const findEnclosingIteratorContext = (jsxNode) => {
 			const grandparent = parent.parent;
 			if (grandparent && isNodeOfType(grandparent, "Property")) return null;
 			if (isOutsideContainingFunction) return null;
+			const namedCallbackIteratorCall = findNamedCallbackIteratorCall(parent);
+			if (namedCallbackIteratorCall) return {
+				kind: "iterator",
+				callExpression: namedCallbackIteratorCall
+			};
 			isOutsideContainingFunction = true;
 		} else if (isNodeOfType(parent, "ArrayExpression")) {
 			if (isOutsideContainingFunction) return null;
@@ -15778,7 +15883,10 @@ const resolveIterationItemName = (callExpression) => {
 	if (!isNodeOfType(callee, "MemberExpression")) return null;
 	if (!isNodeOfType(callee.property, "Identifier")) return null;
 	const targetArgIndex = callee.property.name === "from" ? 1 : 0;
-	const callback = callExpression.arguments[targetArgIndex];
+	const callbackArgument = callExpression.arguments[targetArgIndex];
+	if (!callbackArgument) return null;
+	const unwrappedCallback = stripParenExpression(callbackArgument);
+	const callback = isNodeOfType(unwrappedCallback, "Identifier") ? findVariableInitializer(unwrappedCallback, unwrappedCallback.name)?.initializer : unwrappedCallback;
 	if (!callback || !isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression")) return null;
 	const firstParam = callback.params[0];
 	return firstParam && isNodeOfType(firstParam, "Identifier") ? firstParam.name : null;
@@ -22752,7 +22860,7 @@ const readsPostMountValueThroughLocals = (root, effectFn, options = {}, visitedL
 };
 //#endregion
 //#region src/plugin/rules/state-and-effects/utils/collect-effect-state-write-facts.ts
-const SYNCHRONOUS_ITERATOR_METHOD_NAMES = new Set([
+const SYNCHRONOUS_ITERATOR_METHOD_NAMES$1 = new Set([
 	"every",
 	"filter",
 	"find",
@@ -23060,7 +23168,7 @@ const collectBoundedEffectExecutionFrames = (analysis, effectNode, currentFilena
 		const calleeName = getCallCalleeName$1(child);
 		const memberName = getStaticMemberName(callee);
 		const isDeferringCall = calleeName !== null && DEFERRING_CALLEE_NAMES.has(calleeName) || memberName !== null && DEFERRING_MEMBER_NAMES.has(memberName);
-		const isIteratorCall = memberName !== null && SYNCHRONOUS_ITERATOR_METHOD_NAMES.has(memberName) && isNodeOfType(callee, "MemberExpression");
+		const isIteratorCall = memberName !== null && SYNCHRONOUS_ITERATOR_METHOD_NAMES$1.has(memberName) && isNodeOfType(callee, "MemberExpression");
 		const enqueueFrame = (callableNode, argumentsForCallable, isDeferred, introducedBindings, allowWithoutInvocationEvidence = false) => {
 			const callable = resolveWrappedCallable(analysis, callableNode);
 			if (!callable || callable.async === true || callable === effectFunction) return;
@@ -23297,10 +23405,15 @@ const isLocallyConstructedObjectMember = (reference, memberExpression) => isNode
 	const definitionNode = definition.node;
 	return isNodeOfType(definitionNode, "VariableDeclarator") && Boolean(definitionNode.init) && (isNodeOfType(definitionNode.init, "ObjectExpression") || isNodeOfType(definitionNode.init, "ArrayExpression"));
 }) === true;
+const getUseRefDeclarator = (analysis, memberExpression) => {
+	if (!isNodeOfType(memberExpression, "MemberExpression") || getStaticMemberName(memberExpression) !== "current" || !isNodeOfType(memberExpression.object, "Identifier")) return null;
+	return getRef(analysis, memberExpression.object)?.resolved?.defs.map((definition) => definition.node).find((definitionNode) => isNodeOfType(definitionNode, "VariableDeclarator") && isNodeOfType(definitionNode.init, "CallExpression") && getCallCalleeName$1(definitionNode.init) === "useRef") ?? null;
+};
 const collectValueEvidence = (analysis, expression, frame, remainingCallFrames, visitedBindings = /* @__PURE__ */ new Set()) => {
 	const node = stripParenExpression(expression);
 	const evidence = emptyEvidence();
-	if (readsPostMountValue(node) || readsPostMountValueThroughLocals(node, frame.functionNode)) {
+	const useRefDeclarator = getUseRefDeclarator(analysis, node);
+	if (!useRefDeclarator && (readsPostMountValue(node) || readsPostMountValueThroughLocals(node, frame.functionNode))) {
 		evidence.readsExternalValue = true;
 		return evidence;
 	}
@@ -23342,7 +23455,11 @@ const collectValueEvidence = (analysis, expression, frame, remainingCallFrames,
 			evidence.hasUnknownSource = true;
 			return evidence;
 		}
-		if (reference.resolved.references.some((candidateReference) => candidateReference.isWrite() && !candidateReference.init)) {
+		const nonInitializerWrites = reference.resolved.references.filter((candidateReference) => candidateReference.isWrite() && !candidateReference.init);
+		if (nonInitializerWrites.length > 0) {
+			const writtenIdentifier = nonInitializerWrites[0]?.identifier;
+			const assignment = writtenIdentifier.parent;
+			if (nonInitializerWrites.length === 1 && assignment && isNodeOfType(assignment, "AssignmentExpression") && assignment.operator === "=" && assignment.left === writtenIdentifier) return collectValueEvidence(analysis, assignment.right, frame, remainingCallFrames, visitedBindings);
 			evidence.hasUnknownSource = true;
 			return evidence;
 		}
@@ -23358,6 +23475,40 @@ const collectValueEvidence = (analysis, expression, frame, remainingCallFrames,
 		return collectValueEvidence(analysis, initializer.init, frame, remainingCallFrames, visitedBindings);
 	}
 	if (isNodeOfType(node, "MemberExpression")) {
+		if (getStaticMemberName(node) === "current" && isNodeOfType(node.object, "Identifier")) {
+			const refBinding = getRef(analysis, node.object)?.resolved;
+			const refDeclarator = useRefDeclarator;
+			if (refBinding && refDeclarator && isNodeOfType(refDeclarator, "VariableDeclarator") && isNodeOfType(refDeclarator.init, "CallExpression")) {
+				if (visitedBindings.has(refBinding)) {
+					evidence.hasUnknownSource = true;
+					return evidence;
+				}
+				const refVisitedBindings = new Set(visitedBindings);
+				refVisitedBindings.add(refBinding);
+				const initialValue = refDeclarator.init.arguments?.[0];
+				if (initialValue) mergeEvidence(evidence, collectValueEvidence(analysis, initialValue, frame, remainingCallFrames, new Set(refVisitedBindings)));
+				for (const candidateReference of refBinding.references) {
+					if (candidateReference.init) continue;
+					const identifier = candidateReference.identifier;
+					const member = identifier.parent;
+					if (!member || !isNodeOfType(member, "MemberExpression") || member.object !== identifier || getStaticMemberName(member) !== "current") {
+						evidence.hasUnknownSource = true;
+						continue;
+					}
+					const memberParent = member.parent;
+					if (memberParent && isNodeOfType(memberParent, "AssignmentExpression") && memberParent.left === member) {
+						if (memberParent.operator !== "=") {
+							evidence.hasUnknownSource = true;
+							continue;
+						}
+						mergeEvidence(evidence, collectValueEvidence(analysis, memberParent.right, frame, remainingCallFrames, new Set(refVisitedBindings)));
+						continue;
+					}
+					if (memberParent && isNodeOfType(memberParent, "UpdateExpression")) evidence.hasUnknownSource = true;
+				}
+				return evidence;
+			}
+		}
 		if (isNodeOfType(node.object, "Identifier")) {
 			const objectReference = getRef(analysis, node.object);
 			if (objectReference && isLocallyConstructedObjectMember(objectReference, node)) {
@@ -29136,6 +29287,18 @@ const MUTATING_COLLECTION_METHOD_NAMES = new Set([
 	"set",
 	"add"
 ]);
+const SYNCHRONOUS_ITERATOR_METHOD_NAMES = new Set([
+	"every",
+	"filter",
+	"find",
+	"findIndex",
+	"flatMap",
+	"forEach",
+	"map",
+	"reduce",
+	"reduceRight",
+	"some"
+]);
 const getMemberRootBindingName = (node, scope) => {
 	let currentNode = node;
 	while (isNodeOfType(currentNode, "MemberExpression")) currentNode = currentNode.object;
@@ -29189,6 +29352,26 @@ const addMutatingCollectionCallDependencies = (graph, expression, scope, eventHa
 	addDependencyNames(dependencyNames, controlDependencyNames);
 	addDependencies(graph, receiverRootName, dependencyNames);
 };
+const addIteratorMutationDependencies = (graph, expression, scope, eventHandlerReferenceNames, controlDependencyNames) => {
+	if (!isNodeOfType(expression, "CallExpression")) return;
+	if (!isNodeOfType(expression.callee, "MemberExpression")) return;
+	const methodName = getStaticMemberPropertyName(expression.callee);
+	if (!methodName || !SYNCHRONOUS_ITERATOR_METHOD_NAMES.has(methodName)) return;
+	const iteratorDependencyNames = collectScopedReferenceNames(expression.callee.object, scope, eventHandlerReferenceNames);
+	addDependencyNames(iteratorDependencyNames, controlDependencyNames);
+	for (const argument of expression.arguments ?? []) {
+		if (!isNodeOfType(argument, "ArrowFunctionExpression") && !isNodeOfType(argument, "FunctionExpression")) continue;
+		walkAst(argument.body, (node) => {
+			if (node !== argument.body && isFunctionLike$1(node)) return false;
+			if (!isNodeOfType(node, "CallExpression")) return;
+			if (!isNodeOfType(node.callee, "MemberExpression")) return;
+			const nestedMethodName = getStaticMemberPropertyName(node.callee);
+			if (!nestedMethodName || !MUTATING_COLLECTION_METHOD_NAMES.has(nestedMethodName)) return;
+			const receiverRootName = getMemberRootBindingName(node.callee.object, scope);
+			if (receiverRootName) addDependencies(graph, receiverRootName, iteratorDependencyNames);
+		});
+	}
+};
 const collectExpressionDependencies = (graph, expression, scope, eventHandlerReferenceNames, controlDependencyNames) => {
 	if (isNodeOfType(expression, "AssignmentExpression")) {
 		addAssignmentExpressionDependencies(graph, expression, scope, eventHandlerReferenceNames, controlDependencyNames);
@@ -29196,6 +29379,7 @@ const collectExpressionDependencies = (graph, expression, scope, eventHandlerRef
 	}
 	if (isNodeOfType(expression, "CallExpression")) {
 		addMutatingCollectionCallDependencies(graph, expression, scope, eventHandlerReferenceNames, controlDependencyNames);
+		addIteratorMutationDependencies(graph, expression, scope, eventHandlerReferenceNames, controlDependencyNames);
 		return;
 	}
 	if (isNodeOfType(expression, "SequenceExpression")) {
@@ -30236,28 +30420,26 @@ const noGiantComponent = defineRule({
 			const lineCount = bodyNode.loc.end.line - bodyNode.loc.start.line + 1;
 			return lineCount > 300 ? lineCount : null;
 		};
-		const reportOversizedComponent = (nameNode, componentName, lineCount) => {
+		const reportOversizedComponent = (nameNode, componentName) => {
 			context.report({
 				node: nameNode,
-				message: `Component "${componentName}" is ${lineCount} lines long, which is hard to read & change. Split it into a few smaller components.`
+				message: `Component "${componentName}" is over 300 lines long, which is hard to read & change. Split it into a few smaller components.`
 			});
 		};
 		return {
 			FunctionDeclaration(node) {
 				if (!node.id?.name || !isUppercaseName(node.id.name)) return;
-				const lineCount = getOversizedComponentLineCount(node);
-				if (lineCount === null) return;
+				if (getOversizedComponentLineCount(node) === null) return;
 				if (!functionContainsReactRenderOutput(node, context.scopes)) return;
-				reportOversizedComponent(node.id, node.id.name, lineCount);
+				reportOversizedComponent(node.id, node.id.name);
 			},
 			VariableDeclarator(node) {
 				if (!isNodeOfType(node.id, "Identifier") || !isUppercaseName(node.id.name)) return;
 				const functionNode = unwrapReactHocFunction(node.init);
 				if (!functionNode) return;
-				const lineCount = getOversizedComponentLineCount(functionNode);
-				if (lineCount === null) return;
+				if (getOversizedComponentLineCount(functionNode) === null) return;
 				if (!functionContainsReactRenderOutput(functionNode, context.scopes)) return;
-				reportOversizedComponent(node.id, node.id.name, lineCount);
+				reportOversizedComponent(node.id, node.id.name);
 			}
 		};
 	}
@@ -35028,6 +35210,66 @@ const noPropCallbackInEffect = defineRule({
 	}
 });
 //#endregion
+//#region src/plugin/rules/state-and-effects/no-prop-callback-in-render.ts
+const isPreservedThroughConciseArrow = (callExpression, scopes) => {
+	let node = callExpression;
+	let parent = node.parent;
+	while (parent) {
+		if (isNodeOfType(parent, "ChainExpression")) {
+			node = parent;
+			parent = node.parent;
+			continue;
+		}
+		if (isNodeOfType(parent, "LogicalExpression") && parent.right === node) {
+			node = parent;
+			parent = node.parent;
+			continue;
+		}
+		if (isNodeOfType(parent, "ConditionalExpression") && (parent.consequent === node || parent.alternate === node)) {
+			node = parent;
+			parent = node.parent;
+			continue;
+		}
+		if (isNodeOfType(parent, "SequenceExpression")) {
+			const expressions = parent.expressions ?? [];
+			if (expressions[expressions.length - 1] !== node) return false;
+			node = parent;
+			parent = node.parent;
+			continue;
+		}
+		if (!isNodeOfType(parent, "ArrowFunctionExpression") || parent.body !== node) return !isResultDiscardedCall(node);
+		const invocation = parent.parent;
+		if (!isNodeOfType(invocation, "CallExpression") || !executesDuringRender(parent, scopes)) return true;
+		if (invocation.arguments?.[0] === parent || invocation.arguments?.[1] === parent) {
+			const callee = stripParenExpression(invocation.callee);
+			return !(isNodeOfType(callee, "MemberExpression") && !callee.computed && isNodeOfType(callee.property, "Identifier") && callee.property.name === "forEach" && invocation.arguments[0] === parent);
+		}
+		node = invocation;
+		parent = node.parent;
+	}
+	return false;
+};
+const noPropCallbackInRender = defineRule({
+	id: "no-prop-callback-in-render",
+	title: "Prop callback invoked during render",
+	severity: "error",
+	recommendation: "Invoke the callback from the event or asynchronous operation that produced the value, or from an effect when synchronizing with an external system. Render must stay pure because React can replay or discard it.",
+	create: (context) => ({ CallExpression(node) {
+		if (!isResultDiscardedCall(node)) return;
+		if (isPreservedThroughConciseArrow(node, context.scopes)) return;
+		if (!findRenderPhaseComponentOrHook(node, context.scopes)) return;
+		const analysis = getProgramAnalysis(node);
+		if (!analysis) return;
+		const callee = stripParenExpression(node.callee);
+		if (isFunctionLike$1(callee)) return;
+		if (!getDownstreamRefs(analysis, callee).some((reference) => isPropCallbackInvocationRef(analysis, reference))) return;
+		context.report({
+			node,
+			message: "This prop callback runs during render. React can replay or discard render work, so the callback can fire more than once or for UI that never commits."
+		});
+	} })
+});
+//#endregion
 //#region src/plugin/rules/architecture/no-prop-types.ts
 const PROP_TYPES_PROPERTY = "propTypes";
 const isPropTypesKey = (key, computed) => {
@@ -35722,6 +35964,63 @@ const noRedundantShouldComponentUpdate = defineRule({
 	}
 });
 //#endregion
+//#region src/plugin/rules/state-and-effects/no-ref-current-in-render.ts
+const resolveReactRefSymbol = (memberExpression, scopes) => {
+	const receiver = isNodeOfType(memberExpression, "MemberExpression") ? stripParenExpression(memberExpression.object) : null;
+	if (!isNodeOfType(memberExpression, "MemberExpression") || memberExpression.computed || !isNodeOfType(memberExpression.property, "Identifier") || memberExpression.property.name !== "current" || !isNodeOfType(receiver, "Identifier")) return null;
+	const symbol = resolveConstIdentifierAlias(receiver, scopes);
+	if (!symbol?.initializer) return null;
+	const initializer = stripParenExpression(symbol.initializer);
+	if (!isNodeOfType(initializer, "CallExpression")) return null;
+	return isReactApiCall(initializer, "useRef", scopes, { allowGlobalReactNamespace: true }) ? symbol : null;
+};
+const isSameRefCurrentMember = (node, refSymbol, scopes) => {
+	if (!isNodeOfType(node, "MemberExpression") || node.computed || !isNodeOfType(node.property, "Identifier") || node.property.name !== "current") return false;
+	const receiver = stripParenExpression(node.object);
+	return isNodeOfType(receiver, "Identifier") && resolveConstIdentifierAlias(receiver, scopes)?.id === refSymbol.id;
+};
+const isDocumentedLazyInitialization = (assignmentExpression, refSymbol, scopes) => {
+	if (assignmentExpression.operator !== "=" || !isNodeOfType(assignmentExpression.right, "NewExpression")) return false;
+	let descendant = assignmentExpression;
+	let ancestor = descendant.parent;
+	while (ancestor) {
+		if (isNodeOfType(ancestor, "IfStatement") && ancestor.consequent === descendant && isNodeOfType(ancestor.test, "BinaryExpression") && (ancestor.test.operator === "===" || ancestor.test.operator === "==")) {
+			const { left, right } = ancestor.test;
+			if (isSameRefCurrentMember(left, refSymbol, scopes) && isNodeOfType(right, "Literal") && right.value === null || isSameRefCurrentMember(right, refSymbol, scopes) && isNodeOfType(left, "Literal") && left.value === null) return true;
+		}
+		descendant = ancestor;
+		ancestor = descendant.parent;
+	}
+	return false;
+};
+const noRefCurrentInRender = defineRule({
+	id: "no-ref-current-in-render",
+	title: "Ref mutated during render",
+	severity: "error",
+	recommendation: "Move ref writes into an event handler or effect. Render must stay pure because React can replay or discard it. The predictable null-guarded lazy initialization pattern remains supported.",
+	create: (context) => {
+		const report = (memberExpression) => {
+			if (!resolveReactRefSymbol(memberExpression, context.scopes)) return;
+			if (!findRenderPhaseComponentOrHook(memberExpression, context.scopes)) return;
+			context.report({
+				node: memberExpression,
+				message: "This ref is mutated during render. React can replay or discard render work, so the mutation can leak from UI that never commits."
+			});
+		};
+		return {
+			AssignmentExpression(node) {
+				const refSymbol = resolveReactRefSymbol(node.left, context.scopes);
+				if (!refSymbol) return;
+				if (isDocumentedLazyInitialization(node, refSymbol, context.scopes)) return;
+				report(node.left);
+			},
+			UpdateExpression(node) {
+				report(node.argument);
+			}
+		};
+	}
+});
+//#endregion
 //#region src/plugin/rules/architecture/no-render-in-render.ts
 const isInsideComponentContext = (node) => {
 	let cursor = node.parent;
@@ -57112,6 +57411,18 @@ const reactDoctorRules = [
 			requires: [...new Set(["react", ...noPropCallbackInEffect.requires ?? []])]
 		}
 	},
+	{
+		key: "react-doctor/no-prop-callback-in-render",
+		id: "no-prop-callback-in-render",
+		source: "react-doctor",
+		originallyExternal: false,
+		rule: {
+			...noPropCallbackInRender,
+			framework: "global",
+			category: "Bugs",
+			requires: [...new Set(["react", ...noPropCallbackInRender.requires ?? []])]
+		}
+	},
 	{
 		key: "react-doctor/no-prop-types",
 		id: "no-prop-types",
@@ -57203,6 +57514,18 @@ const reactDoctorRules = [
 			requires: [...new Set(["react", ...noRedundantShouldComponentUpdate.requires ?? []])]
 		}
 	},
+	{
+		key: "react-doctor/no-ref-current-in-render",
+		id: "no-ref-current-in-render",
+		source: "react-doctor",
+		originallyExternal: false,
+		rule: {
+			...noRefCurrentInRender,
+			framework: "global",
+			category: "Bugs",
+			requires: [...new Set(["react", ...noRefCurrentInRender.requires ?? []])]
+		}
+	},
 	{
 		key: "react-doctor/no-render-in-render",
 		id: "no-render-in-render",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.4-dev.593824d",
+  "version": "0.7.4-dev.5aa82e8",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",