oxlint-plugin-react-doctor 0.7.5-dev.3075e10 → 0.7.5-dev.3aef25a

package/dist/index.js

@@ -397,6 +397,7 @@ const isProductionFilePath = (relativePath, sourceFilePattern) => {
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-production-source-path.ts
 const isProductionSourcePath = (relativePath) => {
+	if (/\.d\.[cm]?[jt]s$/i.test(relativePath)) return false;
 	return isProductionFilePath(relativePath, SOURCE_FILE_PATTERN);
 };
 //#endregion
@@ -5178,8 +5179,10 @@ const STORAGE_GLOBALS = new Set([
 const SENSITIVE_KEY_PATTERN = /token|jwt|secret|password|passwd|credential|api[-_]?key|bearer|private[-_]?key/i;
 const NON_AUTH_TOKEN_PATTERN = /csrf|xsrf|device|fcm|apns|push|design|tokeniz|syntax|css|theme|color/i;
 const STRONG_AUTH_KEY_PATTERN = /jwt|secret|password|passwd|credential|private[-_]?key|api[-_]?key|bearer|access[-_]?token|refresh[-_]?token|auth[-_]?token|id[-_]?token|session/i;
+const PRODUCT_API_KEY_RECORDS_PATTERN = /(?:^|[._:-])(?:created|saved|integration|mailing)[-_]?api[-_]?keys$/i;
 const PRODUCT_API_KEY_COLLECTION_PATTERN = /[._:-](?:created|generated|saved)[-_]?api[-_]?keys$/i;
 const isAuthCredentialKey = (key) => {
+	if (PRODUCT_API_KEY_RECORDS_PATTERN.test(key)) return false;
 	if (!SENSITIVE_KEY_PATTERN.test(key)) return false;
 	if (PRODUCT_API_KEY_COLLECTION_PATTERN.test(key)) return false;
 	if (NON_AUTH_TOKEN_PATTERN.test(key) && !STRONG_AUTH_KEY_PATTERN.test(key)) return false;
@@ -5931,6 +5934,21 @@ const checkedRequiresOnchangeOrReadonly = defineRule({
 	}
 });
 //#endregion
+//#region src/plugin/utils/get-static-property-key-name.ts
+const getStaticPropertyKeyName = (node, options = {}) => {
+	if (!isNodeOfType(node, "Property")) return null;
+	if (node.computed) {
+		if (options.allowComputedString && isNodeOfType(node.key, "Literal") && typeof node.key.value === "string") return node.key.value;
+		return null;
+	}
+	if (isNodeOfType(node.key, "Identifier")) return node.key.name;
+	if (isNodeOfType(node.key, "Literal")) {
+		if (typeof node.key.value === "string") return node.key.value;
+		if (options.stringifyNonStringLiterals) return String(node.key.value);
+	}
+	return null;
+};
+//#endregion
 //#region src/plugin/utils/is-presentation-role.ts
 const isPresentationRole = (openingElement) => {
 	const roleAttribute = hasJsxPropIgnoreCase(openingElement.attributes, "role");
@@ -5975,6 +5993,21 @@ const isPureEventBlockerHandler = (attribute) => {
 	return false;
 };
 //#endregion
+//#region src/plugin/utils/resolve-const-identifier-alias.ts
+const resolveConstIdentifierAlias = (identifier, scopes) => {
+	if (!isNodeOfType(identifier, "Identifier")) return null;
+	const visitedSymbolIds = /* @__PURE__ */ new Set();
+	let symbol = scopes.symbolFor(identifier);
+	while (symbol?.kind === "const") {
+		if (visitedSymbolIds.has(symbol.id) || !symbol.initializer || !isNodeOfType(symbol.declarationNode, "VariableDeclarator") || symbol.declarationNode.id !== symbol.bindingIdentifier) return null;
+		visitedSymbolIds.add(symbol.id);
+		const initializer = stripParenExpression(symbol.initializer);
+		if (!isNodeOfType(initializer, "Identifier")) return symbol;
+		symbol = scopes.symbolFor(initializer);
+	}
+	return symbol;
+};
+//#endregion
 //#region src/plugin/rules/a11y/click-events-have-key-events.ts
 const MESSAGE$57 = "Keyboard users can't trigger this click handler because there's no keyboard one, so add `onKeyUp`, `onKeyDown`, or `onKeyPress`.";
 const KEY_HANDLERS = [
@@ -5985,6 +6018,63 @@ const KEY_HANDLERS = [
 	"onKeyDownCapture",
 	"onKeyPressCapture"
 ];
+const CLICK_HANDLERS = ["onClick", "onClickCapture"];
+const TRANSPARENT_SPREAD_EVENT_NAMES = new Set([...CLICK_HANDLERS, ...KEY_HANDLERS].map((eventName) => eventName.toLowerCase()));
+const CONSERVATIVE_SPREAD_PROP_NAMES = new Set([
+	"aria-hidden",
+	"onmouseenter",
+	"onmouseover",
+	"role"
+]);
+const resolveSpreadObjectExpression = (expression, scopes) => {
+	const innerExpression = stripParenExpression(expression);
+	if (isNodeOfType(innerExpression, "ObjectExpression")) return innerExpression;
+	if (!isNodeOfType(innerExpression, "Identifier")) return null;
+	const symbol = resolveConstIdentifierAlias(innerExpression, scopes);
+	if (symbol?.kind !== "const" || !symbol.initializer) return null;
+	const initializer = stripParenExpression(symbol.initializer);
+	return isNodeOfType(initializer, "ObjectExpression") ? initializer : null;
+};
+const collectTransparentSpreadEventNames = (expression, scopes, eventValues, visitedObjectExpressions) => {
+	const objectExpression = resolveSpreadObjectExpression(expression, scopes);
+	if (!objectExpression || visitedObjectExpressions.has(objectExpression)) return false;
+	visitedObjectExpressions.add(objectExpression);
+	let isTransparent = true;
+	for (const property of objectExpression.properties) {
+		if (isNodeOfType(property, "SpreadElement")) {
+			if (!collectTransparentSpreadEventNames(property.argument, scopes, eventValues, visitedObjectExpressions)) {
+				isTransparent = false;
+				break;
+			}
+			continue;
+		}
+		if (!isNodeOfType(property, "Property")) {
+			isTransparent = false;
+			break;
+		}
+		const propertyName = getStaticPropertyKeyName(property, { allowComputedString: true });
+		if (!propertyName) {
+			isTransparent = false;
+			break;
+		}
+		const normalizedPropertyName = propertyName.toLowerCase();
+		if (CONSERVATIVE_SPREAD_PROP_NAMES.has(normalizedPropertyName)) {
+			isTransparent = false;
+			break;
+		}
+		if (TRANSPARENT_SPREAD_EVENT_NAMES.has(normalizedPropertyName)) eventValues.set(normalizedPropertyName, property.value);
+	}
+	visitedObjectExpressions.delete(objectExpression);
+	return isTransparent;
+};
+const getTransparentSpreadEventValues = (attributes, scopes) => {
+	const eventValues = /* @__PURE__ */ new Map();
+	for (const attribute of attributes) {
+		if (!isNodeOfType(attribute, "JSXSpreadAttribute")) continue;
+		if (!collectTransparentSpreadEventNames(attribute.argument, scopes, eventValues, /* @__PURE__ */ new Set())) return null;
+	}
+	return eventValues;
+};
 const FOCUSLESS_CONTAINER_TAGS = new Set([
 	"tr",
 	"td",
@@ -6032,7 +6122,10 @@ const isFocusForwardingFunctionBody = (body) => {
 };
 const resolveHandlerFunction = (attribute) => {
 	if (!attribute.value || !isNodeOfType(attribute.value, "JSXExpressionContainer")) return null;
-	let expression = attribute.value.expression;
+	return resolveHandlerFunctionExpression(attribute.value.expression);
+};
+const resolveHandlerFunctionExpression = (handlerExpression) => {
+	let expression = handlerExpression;
 	if (isNodeOfType(expression, "Identifier")) {
 		const binding = findVariableInitializer(expression, expression.name);
 		if (!binding?.initializer) return null;
@@ -6131,18 +6224,22 @@ const clickEventsHaveKeyEvents = defineRule({
 			if (!HTML_TAGS.has(tag)) return;
 			if (tag === "label") return;
 			if (!FOCUSLESS_CONTAINER_TAGS.has(tag) && isInteractiveElement(tag, node)) return;
+			const spreadEventValues = getTransparentSpreadEventValues(node.attributes, context.scopes);
+			if (!spreadEventValues) return;
 			const onClick = hasJsxPropIgnoreCase(node.attributes, "onClick") ?? hasJsxPropIgnoreCase(node.attributes, "onClickCapture");
-			if (!onClick) return;
-			if (isPureEventBlockerHandler(onClick)) return;
-			if (isFocusForwardingHandler(onClick)) return;
-			if (hasJsxSpreadAttribute$1(node.attributes)) return;
+			const spreadOnClickExpression = CLICK_HANDLERS.map((name) => spreadEventValues.get(name.toLowerCase())).find((expression) => expression !== void 0);
+			if (!onClick && !spreadOnClickExpression) return;
+			if (onClick && isPureEventBlockerHandler(onClick)) return;
+			if (onClick && isFocusForwardingHandler(onClick)) return;
+			const spreadHandlerFunction = spreadOnClickExpression ? resolveHandlerFunctionExpression(spreadOnClickExpression) : null;
+			if (spreadHandlerFunction && (isFocusForwardingFunctionBody(spreadHandlerFunction.body ?? null) || containsBackdropDismissComparison(spreadHandlerFunction.body ?? null))) return;
 			if (hasCompositeItemRole(node)) return;
 			if (isHoverSelectionListItem(tag, node)) return;
-			if (isBackdropDismissHandler(onClick)) return;
+			if (onClick && isBackdropDismissHandler(onClick)) return;
 			if (containsKeyboardActivatableDescendant(node.parent)) return;
 			if (isHiddenFromScreenReader(node, context.settings)) return;
 			if (isPresentationRole(node)) return;
-			if (KEY_HANDLERS.some((handler) => hasJsxPropIgnoreCase(node.attributes, handler))) return;
+			if (KEY_HANDLERS.some((handler) => hasJsxPropIgnoreCase(node.attributes, handler) || spreadEventValues.has(handler.toLowerCase()))) return;
 			context.report({
 				node: node.name,
 				message: MESSAGE$57
@@ -6868,11 +6965,10 @@ const getTemplateInterpolations = (valueTail) => {
 	const interpolations = valueTail.slice(1, closingBacktickIndex).match(/\$\{[^}]*\}/g);
 	return interpolations === null ? "" : interpolations.join(" ");
 };
-const getIdentifierDeclarationInitializer = (identifier, fileContent) => {
-	const declarationMatch = new RegExp(`(?:const|let|var)\\s+${escapeRegExp(identifier)}\\s*(?::[^=\\n]{0,120})?=\\s*`).exec(fileContent);
-	if (declarationMatch === null) return null;
-	const initializerStartIndex = declarationMatch.index + declarationMatch[0].length;
-	return fileContent.slice(initializerStartIndex, initializerStartIndex + STATIC_TEMPLATE_MAX_CHARS);
+const getIdentifierDeclarationInitializer = (identifier, sinkIndex, fileContent) => {
+	const declaration = findVisibleIdentifierDeclaration(identifier, sinkIndex, fileContent);
+	if (declaration === null) return null;
+	return fileContent.slice(declaration.initializerStartIndex, declaration.initializerStartIndex + STATIC_TEMPLATE_MAX_CHARS);
 };
 const isPureStringLiteralConcat = (initializerText) => {
 	if (!/^["']/.test(initializerText)) return false;
@@ -6942,6 +7038,153 @@ const isAllOperandsDomContentConcat = (valueExpression) => {
 		return !HTML_TAINT_PATTERN.test(withoutCast.replace(DOM_CONTENT_SOURCE_VALUE_PATTERN, ""));
 	});
 };
+const findMatchingBraceIndex = (fileContent, openingBraceIndex) => {
+	let depth = 0;
+	let quote = null;
+	for (let index = openingBraceIndex; index < fileContent.length; index += 1) {
+		const character = fileContent[index];
+		if (quote !== null) {
+			if (character === quote && fileContent[index - 1] !== "\\") quote = null;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			quote = character;
+			continue;
+		}
+		if (character === "{") depth += 1;
+		if (character === "}") {
+			depth -= 1;
+			if (depth === 0) return index;
+		}
+	}
+	return fileContent.length;
+};
+const findContainingBlockEndIndex = (fileContent, targetIndex) => {
+	const openingBraceIndexes = [];
+	let quote = null;
+	let isLineComment = false;
+	let isBlockComment = false;
+	for (let index = 0; index < targetIndex; index += 1) {
+		const character = fileContent[index];
+		const nextCharacter = fileContent[index + 1];
+		if (isLineComment) {
+			if (character === "\n") isLineComment = false;
+			continue;
+		}
+		if (isBlockComment) {
+			if (character === "*" && nextCharacter === "/") {
+				isBlockComment = false;
+				index += 1;
+			}
+			continue;
+		}
+		if (quote !== null) {
+			if (character === quote && fileContent[index - 1] !== "\\") quote = null;
+			continue;
+		}
+		if (character === "/" && nextCharacter === "/") {
+			isLineComment = true;
+			index += 1;
+			continue;
+		}
+		if (character === "/" && nextCharacter === "*") {
+			isBlockComment = true;
+			index += 1;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			quote = character;
+			continue;
+		}
+		if (character === "{") openingBraceIndexes.push(index);
+		if (character === "}") openingBraceIndexes.pop();
+	}
+	const openingBraceIndex = openingBraceIndexes.at(-1);
+	return openingBraceIndex === void 0 ? fileContent.length : findMatchingBraceIndex(fileContent, openingBraceIndex);
+};
+const findVisibleIdentifierDeclaration = (identifier, sinkIndex, fileContent) => {
+	const initializerPattern = new RegExp(`(?:const|let|var)\\s+${escapeRegExp(identifier)}\\s*(?::[^=\\n]*)?=\\s*([^;\\n]+)`, "g");
+	let nearestDeclaration = null;
+	let nearestDeclarationIndex = -1;
+	for (const match of fileContent.matchAll(initializerPattern)) {
+		const declarationIndex = match.index;
+		if (declarationIndex === void 0 || declarationIndex >= sinkIndex || declarationIndex <= nearestDeclarationIndex || findContainingBlockEndIndex(fileContent, declarationIndex) < sinkIndex) continue;
+		nearestDeclarationIndex = declarationIndex;
+		const initializer = match[1];
+		if (initializer === void 0) continue;
+		nearestDeclaration = {
+			initializer,
+			initializerStartIndex: declarationIndex + match[0].length - initializer.length
+		};
+	}
+	return nearestDeclaration;
+};
+const findContainingFunctionParameterSource = (identifier, sinkIndex, fileContent) => {
+	const patterns = [/function\s+([\w$]+)\s*\(([^)]*)\)\s*\{/g, /(?:const|let|var)\s+([\w$]+)\s*=\s*(?:async\s*)?\(([^)]*)\)\s*=>\s*\{/g];
+	let closestSource = null;
+	let closestStartIndex = -1;
+	for (const pattern of patterns) for (const match of fileContent.matchAll(pattern)) {
+		const matchIndex = match.index;
+		if (matchIndex === void 0 || matchIndex >= sinkIndex || matchIndex < closestStartIndex) continue;
+		if (findMatchingBraceIndex(fileContent, matchIndex + match[0].lastIndexOf("{")) < sinkIndex) continue;
+		const parameterIndex = (match[2] ?? "").split(",").findIndex((parameter) => parameter.trim().match(/^(?:\.\.\.)?([\w$]+)/)?.[1] === identifier);
+		if (parameterIndex < 0) continue;
+		closestStartIndex = matchIndex;
+		closestSource = {
+			functionName: match[1] ?? "",
+			parameterIndex
+		};
+	}
+	return closestSource;
+};
+const splitTopLevelArguments = (argumentText) => {
+	const argumentsList = [];
+	let startIndex = 0;
+	let depth = 0;
+	let quote = null;
+	for (let index = 0; index < argumentText.length; index += 1) {
+		const character = argumentText[index];
+		if (quote !== null) {
+			if (character === quote && argumentText[index - 1] !== "\\") quote = null;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			quote = character;
+			continue;
+		}
+		if (character === "(" || character === "[" || character === "{") depth += 1;
+		if (character === ")" || character === "]" || character === "}") depth -= 1;
+		if (character === "," && depth === 0) {
+			argumentsList.push(argumentText.slice(startIndex, index).trim());
+			startIndex = index + 1;
+		}
+	}
+	argumentsList.push(argumentText.slice(startIndex).trim());
+	return argumentsList;
+};
+const isHtmlTainted = (expression, fileContent, sinkIndex, visitedIdentifiers) => {
+	const trimmedExpression = expression.trim();
+	if (STRING_LITERAL_VALUE_PATTERN.test(`${trimmedExpression};`)) return false;
+	if (MODULE_CONSTANT_VALUE_PATTERN.test(`${trimmedExpression};`)) return false;
+	if (SANITIZER_PATTERN.test(trimmedExpression)) return false;
+	if (ENV_CONFIG_VALUE_PATTERN.test(trimmedExpression)) return false;
+	if (I18N_VALUE_PATTERN.test(trimmedExpression)) return false;
+	if (ESCAPING_SERIALIZER_CALL_PATTERN.test(trimmedExpression)) return false;
+	if (HTML_TAINT_PATTERN.test(trimmedExpression)) return true;
+	const identifier = trimmedExpression.match(/^([\w$]+)\s*(?:[;,})\n]|$)/)?.[1];
+	if (identifier === void 0 || visitedIdentifiers.has(identifier)) return false;
+	visitedIdentifiers.add(identifier);
+	const declaration = findVisibleIdentifierDeclaration(identifier, sinkIndex, fileContent);
+	if (declaration !== null && isHtmlTainted(declaration.initializer, fileContent, sinkIndex, visitedIdentifiers)) return true;
+	const parameterSource = findContainingFunctionParameterSource(identifier, sinkIndex, fileContent);
+	if (parameterSource === null || parameterSource.functionName.length === 0) return false;
+	const callPattern = new RegExp(`\\b${escapeRegExp(parameterSource.functionName)}\\s*\\(([^)]*)\\)`, "g");
+	for (const callMatch of fileContent.matchAll(callPattern)) {
+		const argument = splitTopLevelArguments(callMatch[1] ?? "")[parameterSource.parameterIndex];
+		if (argument !== void 0 && isHtmlTainted(argument, fileContent, sinkIndex, new Set(visitedIdentifiers))) return true;
+	}
+	return false;
+};
 const dangerousHtmlSink = defineRule({
 	id: "dangerous-html-sink",
 	title: "HTML injection sink with dynamic content",
@@ -6968,6 +7211,7 @@ const dangerousHtmlSink = defineRule({
 			const valueTail = fullValueTail.slice(0, VALUE_EXPRESSION_MAX_CHARS);
 			const terminatorIndex = valueTail.search(/[;}]/);
 			const valueExpression = terminatorIndex >= 0 ? valueTail.slice(0, terminatorIndex + 1) : valueTail;
+			const sinkIndex = lines.slice(0, lineIndex).join("\n").length + (lineIndex > 0 ? 1 : 0) + line.search(DANGEROUS_HTML_PATTERN);
 			if (STRING_LITERAL_VALUE_PATTERN.test(valueExpression)) continue;
 			if (MODULE_CONSTANT_VALUE_PATTERN.test(valueExpression)) continue;
 			if (DOM_CONTENT_SOURCE_VALUE_PATTERN.test(valueExpression) && !valueExpression.includes("+")) {
@@ -6979,7 +7223,7 @@ const dangerousHtmlSink = defineRule({
 			let templateInterpolations = getTemplateInterpolations(longValueTail ?? fullValueTail);
 			const valueIdentifier = BARE_IDENTIFIER_VALUE_PATTERN.test(valueExpression) || MEMBER_OR_INDEX_ACCESS_VALUE_PATTERN.test(valueExpression) || IDENTIFIER_WITH_LITERAL_FALLBACK_PATTERN.test(valueExpression) ? valueExpression.match(/^[\w$]+/)?.[0] : void 0;
 			if (templateInterpolations === null && valueIdentifier !== void 0 && BARE_IDENTIFIER_VALUE_PATTERN.test(valueExpression)) {
-				const declarationInitializer = getIdentifierDeclarationInitializer(valueIdentifier, file.content);
+				const declarationInitializer = getIdentifierDeclarationInitializer(valueIdentifier, sinkIndex, file.content);
 				if (declarationInitializer !== null) {
 					if (isPureStringLiteralConcat(declarationInitializer)) continue;
 					templateInterpolations = getTemplateInterpolations(declarationInitializer);
@@ -6990,7 +7234,7 @@ const dangerousHtmlSink = defineRule({
 			if (SANITIZER_PATTERN.test(judgedExpression)) continue;
 			if (ENV_CONFIG_VALUE_PATTERN.test(judgedExpression)) continue;
 			if (I18N_VALUE_PATTERN.test(judgedExpression)) continue;
-			if (!HTML_TAINT_PATTERN.test(judgedExpression)) continue;
+			if (!isHtmlTainted(judgedExpression, file.content, sinkIndex, /* @__PURE__ */ new Set())) continue;
 			if (ESCAPING_SERIALIZER_CALL_PATTERN.test(valueExpression)) continue;
 			if (/highlighted/i.test(valueExpression)) continue;
 			if (/highlight/i.test(valueExpression) && HIGHLIGHTER_LIBRARY_PATTERN.test(file.content)) continue;
@@ -7468,7 +7712,7 @@ const isCreateClassLikeCall = (node) => {
 	if (isNodeOfType(callee, "MemberExpression")) return getStaticMemberName$2(callee) === "createClass";
 	return false;
 };
-const isCreateContextCall = (node) => {
+const isCreateContextCall$1 = (node) => {
 	if (!isNodeOfType(node, "CallExpression")) return false;
 	const callee = node.callee;
 	if (isNodeOfType(callee, "Identifier")) return callee.name === "createContext";
@@ -7645,7 +7889,7 @@ const displayName = defineRule({
 				}
 			},
 			CallExpression(node) {
-				if (settings.checkContextObjects && isReactVersionAtLeast$1(settings.reactVersion, 16, 3) && isCreateContextCall(node)) {
+				if (settings.checkContextObjects && isReactVersionAtLeast$1(settings.reactVersion, 16, 3) && isCreateContextCall$1(node)) {
 					const assignedName = getAssignedName(node);
 					if (assignedName) {
 						const programRoot = findProgramRoot(node);
@@ -7692,21 +7936,6 @@ const displayName = defineRule({
 	}
 });
 //#endregion
-//#region src/plugin/utils/get-static-property-key-name.ts
-const getStaticPropertyKeyName = (node, options = {}) => {
-	if (!isNodeOfType(node, "Property")) return null;
-	if (node.computed) {
-		if (options.allowComputedString && isNodeOfType(node.key, "Literal") && typeof node.key.value === "string") return node.key.value;
-		return null;
-	}
-	if (isNodeOfType(node.key, "Identifier")) return node.key.name;
-	if (isNodeOfType(node.key, "Literal")) {
-		if (typeof node.key.value === "string") return node.key.value;
-		if (options.stringifyNonStringLiterals) return String(node.key.value);
-	}
-	return null;
-};
-//#endregion
 //#region src/plugin/utils/read-static-boolean.ts
 const readStaticBoolean = (node) => {
 	if (!node) return null;
@@ -7715,21 +7944,6 @@ const readStaticBoolean = (node) => {
 	return unwrappedNode.value;
 };
 //#endregion
-//#region src/plugin/utils/resolve-const-identifier-alias.ts
-const resolveConstIdentifierAlias = (identifier, scopes) => {
-	if (!isNodeOfType(identifier, "Identifier")) return null;
-	const visitedSymbolIds = /* @__PURE__ */ new Set();
-	let symbol = scopes.symbolFor(identifier);
-	while (symbol?.kind === "const") {
-		if (visitedSymbolIds.has(symbol.id) || !symbol.initializer || !isNodeOfType(symbol.declarationNode, "VariableDeclarator") || symbol.declarationNode.id !== symbol.bindingIdentifier) return null;
-		visitedSymbolIds.add(symbol.id);
-		const initializer = stripParenExpression(symbol.initializer);
-		if (!isNodeOfType(initializer, "Identifier")) return symbol;
-		symbol = scopes.symbolFor(initializer);
-	}
-	return symbol;
-};
-//#endregion
 //#region src/plugin/utils/is-react-api-call.ts
 const includesApiName = (apiNames, apiName) => typeof apiNames === "string" ? apiNames === apiName : apiNames.has(apiName);
 const isImportedFromReact = (symbol) => {
@@ -7737,9 +7951,9 @@ const isImportedFromReact = (symbol) => {
 	const importDeclaration = symbol.declarationNode.parent;
 	return Boolean(importDeclaration && isNodeOfType(importDeclaration, "ImportDeclaration") && typeof importDeclaration.source.value === "string" && REACT_RUNTIME_MODULE_SOURCES.has(importDeclaration.source.value));
 };
-const isNamedReactApiImport = (identifier, apiNames, scopes) => {
+const isNamedReactApiImport = (identifier, apiNames, scopes, resolveAliases) => {
 	if (!isNodeOfType(identifier, "Identifier")) return false;
-	const symbol = scopes.symbolFor(identifier);
+	const symbol = resolveAliases ? resolveConstIdentifierAlias(identifier, scopes) : scopes.symbolFor(identifier);
 	if (!symbol || !isImportedFromReact(symbol)) return false;
 	const importedName = getImportedName(symbol.declarationNode);
 	return Boolean(importedName && includesApiName(apiNames, importedName));
@@ -7753,7 +7967,7 @@ const isReactApiCall = (node, apiNames, scopes, options = {}) => {
 	if (!isNodeOfType(node, "CallExpression")) return false;
 	const callee = stripParenExpression(node.callee);
 	if (isNodeOfType(callee, "Identifier")) {
-		if (isNamedReactApiImport(callee, apiNames, scopes)) return true;
+		if (isNamedReactApiImport(callee, apiNames, scopes, Boolean(options.resolveNamedAliases))) return true;
 		return Boolean(options.allowUnboundBareCalls && includesApiName(apiNames, callee.name) && scopes.isGlobalReference(callee));
 	}
 	if (!isNodeOfType(callee, "MemberExpression") || callee.computed || !isNodeOfType(callee.property, "Identifier") || !includesApiName(apiNames, callee.property.name)) return false;
@@ -8856,6 +9070,30 @@ const doMatchingNodesCoverEveryPathAfterUsage = (usageNode, matchingNodes, conte
 	}
 	return matchingBlocks.size > 0;
 };
+const doMatchingNodesCoverEveryPathFromFunctionEntry = (owner, matchingNodes, context) => {
+	const functionCfg = context.cfg.cfgFor(owner);
+	if (!functionCfg) return false;
+	const matchingBlocks = new Set(matchingNodes.flatMap((matchingNode) => {
+		if (context.cfg.enclosingFunction(matchingNode) !== owner) return [];
+		const matchingBlock = functionCfg.blockOf(matchingNode);
+		return matchingBlock ? [matchingBlock] : [];
+	}));
+	if (matchingBlocks.size === 0) return false;
+	const visitedBlocks = new Set([functionCfg.entry]);
+	const pendingBlocks = [functionCfg.entry];
+	while (pendingBlocks.length > 0) {
+		const currentBlock = pendingBlocks.pop();
+		if (!currentBlock) break;
+		if (matchingBlocks.has(currentBlock)) continue;
+		for (const edge of currentBlock.successors) {
+			if (edge.to === functionCfg.exit) return false;
+			if (visitedBlocks.has(edge.to)) continue;
+			visitedBlocks.add(edge.to);
+			pendingBlocks.push(edge.to);
+		}
+	}
+	return true;
+};
 const removeSynchronouslyReleasedUsages = (callback, usages, context) => {
 	if (!isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression")) return usages;
 	if (!isNodeOfType(callback.body, "BlockStatement")) return usages;
@@ -9056,6 +9294,83 @@ const doesCleanupFunctionReleaseUsage = (cleanupFunction, usage, context, visite
 	});
 	return didCleanupFunctionMatch;
 };
+const doesBoundCleanupReleaseUsage = (expression, usage, context) => {
+	const callExpression = stripParenExpression(expression);
+	if (!isNodeOfType(callExpression, "CallExpression")) return false;
+	const bindCallee = stripParenExpression(callExpression.callee);
+	if (!isNodeOfType(bindCallee, "MemberExpression") || bindCallee.computed || !isNodeOfType(bindCallee.property, "Identifier") || bindCallee.property.name !== "bind") return false;
+	const releaseMember = stripParenExpression(bindCallee.object);
+	if (!isNodeOfType(releaseMember, "MemberExpression") || releaseMember.computed || !isNodeOfType(releaseMember.property, "Identifier")) return false;
+	const releaseReceiverKey = resolveExpressionKey$1(releaseMember.object, context);
+	if (releaseReceiverKey === null || releaseReceiverKey !== resolveExpressionKey$1(callExpression.arguments?.[0], context)) return false;
+	const releaseVerbName = releaseMember.property.name;
+	if (usage.kind === "socket") return usage.handleKey === releaseReceiverKey && (SOCKET_RELEASE_VERB_NAMES.has(releaseVerbName) || UNIVERSAL_RELEASE_VERB_NAMES.has(releaseVerbName));
+	return usage.kind === "subscribe" && usage.handleKey === releaseReceiverKey && (releaseVerbName === "unsubscribe" || releaseVerbName === "unsub" || releaseVerbName === "close" || releaseVerbName === "unwatch" || releaseVerbName === "unlisten" || BOUND_RESOURCE_RELEASE_METHOD_NAMES.has(releaseVerbName));
+};
+const callbackReturnsCleanupForUsage = (callback, usage, context) => {
+	if (!isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression")) return false;
+	const doesReturnedValueReleaseUsage = (returnedValue) => {
+		if (doesBoundCleanupReleaseUsage(returnedValue, usage, context)) return true;
+		const cleanupFunction = resolveStableValue(returnedValue, context);
+		if (cleanupFunction && doesBoundCleanupReleaseUsage(cleanupFunction, usage, context)) return true;
+		return Boolean(cleanupFunction && isFunctionLike$1(cleanupFunction) && doesCleanupFunctionReleaseUsage(cleanupFunction, usage, context));
+	};
+	if (!isNodeOfType(callback.body, "BlockStatement")) return doesReturnedValueReleaseUsage(stripParenExpression(callback.body));
+	const matchingCleanupReturns = [];
+	walkInsideStatementBlocks(callback.body, (child) => {
+		if (isNodeOfType(child, "ReturnStatement") && child.argument && doesReturnedValueReleaseUsage(stripParenExpression(child.argument))) matchingCleanupReturns.push(child);
+	});
+	return doMatchingNodesCoverEveryPathFromFunctionEntry(callback, matchingCleanupReturns, context);
+};
+const hasRerunReleaseBeforeUsage = (callback, usage, context) => {
+	if (!isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression") || !isNodeOfType(callback.body, "BlockStatement")) return false;
+	const functionCfg = context.cfg.cfgFor(callback);
+	const usageBlock = functionCfg?.blockOf(usage.node);
+	const usageStart = getRangeStart(usage.node);
+	if (!functionCfg || !usageBlock || usageStart === null) return false;
+	const findHandleGuard = (releaseCall) => {
+		if (usage.handleKey === null) return null;
+		let ancestor = releaseCall.parent;
+		while (ancestor && ancestor !== callback.body) {
+			if (isNodeOfType(ancestor, "IfStatement")) return ancestor.alternate === null && resolveExpressionKey$1(ancestor.test, context) === usage.handleKey && getRangeStart(ancestor) !== null && (getRangeStart(ancestor) ?? usageStart) < usageStart ? ancestor : null;
+			ancestor = ancestor.parent;
+		}
+		return null;
+	};
+	const matchingReleaseAnchors = [];
+	walkInsideStatementBlocks(callback.body, (child) => {
+		if (!isNodeOfType(child, "CallExpression")) return;
+		const releaseStart = getRangeStart(child);
+		const handleGuard = findHandleGuard(child);
+		if (releaseStart === null || releaseStart >= usageStart || functionCfg.blockOf(child) !== usageBlock && !handleGuard) return;
+		if (doesReleaseCallMatchUsage(child, usage, context)) {
+			matchingReleaseAnchors.push(handleGuard ?? child);
+			return;
+		}
+		const helperFunction = resolveStableValue(child.callee, context);
+		if (helperFunction && isFunctionLike$1(helperFunction) && doesCleanupFunctionReleaseUsage(helperFunction, usage, context)) matchingReleaseAnchors.push(handleGuard ?? child);
+	});
+	return doMatchingNodesCoverEveryPathFromFunctionEntry(callback, matchingReleaseAnchors, context);
+};
+const hasStableUnmountCleanupForUsage = (callback, usage, context) => {
+	const componentFunction = findEnclosingFunction(callback);
+	if (!componentFunction || !isNodeOfType(componentFunction, "ArrowFunctionExpression") && !isNodeOfType(componentFunction, "FunctionExpression") && !isNodeOfType(componentFunction, "FunctionDeclaration")) return false;
+	let didFindUnmountCleanup = false;
+	walkAst(componentFunction.body, (child) => {
+		if (didFindUnmountCleanup) return false;
+		if (!isNodeOfType(child, "CallExpression") || findEnclosingFunction(child) !== componentFunction) return;
+		if (!isHookCall$2(child, CLEANUP_EFFECT_HOOK_NAMES)) return;
+		const dependencyList = child.arguments?.[1];
+		if (!isNodeOfType(dependencyList, "ArrayExpression") || dependencyList.elements.length > 0) return;
+		const cleanupCallback = getEffectCallback(child);
+		if (cleanupCallback && cleanupCallback !== callback && callbackReturnsCleanupForUsage(cleanupCallback, usage, context)) {
+			didFindUnmountCleanup = true;
+			return false;
+		}
+	});
+	return didFindUnmountCleanup;
+};
+const hasSplitLifecycleCleanup = (callback, usage, context) => usage.handleKey !== null && hasRerunReleaseBeforeUsage(callback, usage, context) && hasStableUnmountCleanupForUsage(callback, usage, context);
 const effectHasCleanupForUsage = (callback, usage, context) => {
 	if (!isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression")) return false;
 	if (usage.kind === "subscribe" && findEnclosingFunction(usage.node) === callback && doesResourceResultEscape(usage.node, true) && isCleanupReturningSubscribeLikeCallExpression(usage.node)) return true;
@@ -9068,6 +9383,10 @@ const effectHasCleanupForUsage = (callback, usage, context) => {
 		if (returnStart !== null && usageStart !== null && returnStart < usageStart) return;
 		const returnedValue = child.argument ? stripParenExpression(child.argument) : null;
 		if (!returnedValue) return;
+		if (doesBoundCleanupReleaseUsage(returnedValue, usage, context)) {
+			matchingCleanupReturns.push(child);
+			return;
+		}
 		if (usage.kind === "subscribe" && (returnedValue === usage.node || getRangeStart(returnedValue) !== null && getRangeStart(returnedValue) === getRangeStart(usage.node)) && isCleanupReturningSubscribeLikeCallExpression(returnedValue)) {
 			matchingCleanupReturns.push(child);
 			return;
@@ -9083,13 +9402,17 @@ const effectHasCleanupForUsage = (callback, usage, context) => {
 			if (!context.scopes.symbolFor(returnedValue)?.initializer) return;
 		}
 		const cleanupFunction = resolveStableValue(returnedValue, context);
+		if (cleanupFunction && doesBoundCleanupReleaseUsage(cleanupFunction, usage, context)) {
+			matchingCleanupReturns.push(child);
+			return;
+		}
 		if (!cleanupFunction || !isFunctionLike$1(cleanupFunction)) return;
 		if (doesCleanupFunctionReleaseUsage(cleanupFunction, usage, context)) matchingCleanupReturns.push(child);
 	});
 	return doMatchingNodesCoverEveryPathAfterUsage(resolveCleanupPathAnchor(usage.node, callback, context), matchingCleanupReturns, context);
 };
 const findFirstUsageWithoutCleanup = (callback, usages, context) => {
-	for (const usage of usages) if (!effectHasCleanupForUsage(callback, usage, context)) return usage;
+	for (const usage of usages) if (!effectHasCleanupForUsage(callback, usage, context) && !hasSplitLifecycleCleanup(callback, usage, context)) return usage;
 	return null;
 };
 const isLocalAbortControllerExpression = (expression, context, visitedSymbolIds = /* @__PURE__ */ new Set()) => {
@@ -10962,6 +11285,11 @@ If the missing value is recreated every render, move it inside the hook or stabi
 		return { CallExpression(node) {
 			const hookName = getHookName(node.callee, context.scopes);
 			if (!hookName || !isHookOfInterest(hookName, node.callee)) return;
+			if (HOOKS_REQUIRING_DEPS_MATCH.has(hookName) && !isReactApiCall(node, HOOKS_REQUIRING_DEPS_MATCH, context.scopes, {
+				allowGlobalReactNamespace: true,
+				allowUnboundBareCalls: true,
+				resolveNamedAliases: true
+			})) return;
 			const callbackArgumentIndex = getCallbackArgumentIndex(hookName);
 			const depsArgumentIndex = getDepsArgumentIndex(hookName);
 			const callbackArgument = node.arguments[callbackArgumentIndex];
@@ -22889,61 +23217,73 @@ const PURE_GLOBAL_CALLEE_NAMES = new Set([
 	"Array",
 	"BigInt",
 	"Boolean",
+	"encodeURIComponent",
 	"Number",
 	"Object",
 	"String",
 	"parseFloat",
-	"parseInt"
+	"parseInt",
+	"structuredClone"
+]);
+const PURE_GLOBAL_CONSTRUCTOR_NAMES = new Set(["Date", "Set"]);
+const PURE_HELPER_NAMESPACE_MEMBER_NAMES = new Map([
+	["Array", new Set(["from"])],
+	["JSON", new Set([
+		"isRawJSON",
+		"parse",
+		"rawJSON",
+		"stringify"
+	])],
+	["Math", new Set([
+		"abs",
+		"acos",
+		"acosh",
+		"asin",
+		"asinh",
+		"atan",
+		"atan2",
+		"atanh",
+		"cbrt",
+		"ceil",
+		"clz32",
+		"cos",
+		"cosh",
+		"exp",
+		"floor",
+		"fround",
+		"hypot",
+		"imul",
+		"log",
+		"log10",
+		"log1p",
+		"log2",
+		"max",
+		"min",
+		"pow",
+		"round",
+		"sign",
+		"sin",
+		"sinh",
+		"sqrt",
+		"tan",
+		"tanh",
+		"trunc"
+	])],
+	["Object", new Set(["assign"])]
 ]);
-const PURE_GLOBAL_NAMESPACE_NAMES = new Set(["JSON", "Math"]);
-const PURE_HELPER_NAMESPACE_MEMBER_NAMES = new Map([["JSON", new Set([
-	"isRawJSON",
-	"parse",
-	"rawJSON",
-	"stringify"
-])], ["Math", new Set([
-	"abs",
-	"acos",
-	"acosh",
-	"asin",
-	"asinh",
-	"atan",
-	"atan2",
-	"atanh",
-	"cbrt",
-	"ceil",
-	"clz32",
-	"cos",
-	"cosh",
-	"exp",
-	"floor",
-	"fround",
-	"hypot",
-	"imul",
-	"log",
-	"log10",
-	"log1p",
-	"log2",
-	"max",
-	"min",
-	"pow",
-	"round",
-	"sign",
-	"sin",
-	"sinh",
-	"sqrt",
-	"tan",
-	"tanh",
-	"trunc"
-])]]);
 const PURE_MEMBER_TRANSFORM_NAMES = new Set([
 	"concat",
 	"filter",
+	"flatMap",
 	"join",
 	"map",
+	"reduce",
+	"replace",
+	"slice",
 	"split",
 	"toLowerCase",
 	"toString",
+	"toSorted",
 	"toUpperCase",
 	"trim"
 ]);
@@ -23325,6 +23665,11 @@ const analyzeHelperExpression = (expression, environment, usedParameterIndices)
 		const callbackSummary = analyzeHelperStatements(node.body.body ?? [], callbackEnvironment, usedParameterIndices, analyzeHelperExpression);
 		return callbackSummary.isValid && !callbackSummary.canContinue;
 	}
+	if (isNodeOfType(node, "NewExpression")) {
+		const callee = stripParenExpression(node.callee);
+		if (!isNodeOfType(callee, "Identifier") || !PURE_GLOBAL_CONSTRUCTOR_NAMES.has(callee.name) || environment.parameterIndices.has(callee.name) || environment.recursiveNames.has(callee.name) || environment.shadowedGlobalNames.has(callee.name)) return false;
+		return (node.arguments ?? []).every((argument) => analyzeHelperExpression(argument, environment, usedParameterIndices));
+	}
 	if (isNodeOfType(node, "CallExpression")) {
 		const callee = stripParenExpression(node.callee);
 		const calleeRoot = getMemberRoot(callee);
@@ -23527,7 +23872,7 @@ const collectValueEvidence = (analysis, expression, frame, remainingCallFrames,
 		}
 		const callee = stripParenExpression(node.callee);
 		const calleeRoot = getMemberRoot(callee);
-		const isPureGlobalCall = isNodeOfType(callee, "Identifier") && PURE_GLOBAL_CALLEE_NAMES.has(callee.name) && getIdentifierBindingIdentity(analysis, callee) === null || isNodeOfType(calleeRoot, "Identifier") && PURE_GLOBAL_NAMESPACE_NAMES.has(calleeRoot.name) && getIdentifierBindingIdentity(analysis, calleeRoot) === null;
+		const isPureGlobalCall = isNodeOfType(callee, "Identifier") && PURE_GLOBAL_CALLEE_NAMES.has(callee.name) && getIdentifierBindingIdentity(analysis, callee) === null || isNodeOfType(callee, "MemberExpression") && isNodeOfType(calleeRoot, "Identifier") && getIdentifierBindingIdentity(analysis, calleeRoot) === null && PURE_HELPER_NAMESPACE_MEMBER_NAMES.get(calleeRoot.name)?.has(getStaticMemberName$1(callee) ?? "") === true;
 		const isPureMemberTransform = isNodeOfType(callee, "MemberExpression") && PURE_MEMBER_TRANSFORM_NAMES.has(getStaticMemberName$1(callee) ?? "");
 		if (isPureGlobalCall || isPureMemberTransform) {
 			if (isPureMemberTransform && isNodeOfType(callee, "MemberExpression")) mergeEvidence(evidence, collectValueEvidence(analysis, callee.object, frame, remainingCallFrames, new Set(visitedBindings)));
@@ -23580,6 +23925,15 @@ const collectValueEvidence = (analysis, expression, frame, remainingCallFrames,
 		}
 		return evidence;
 	}
+	if (isNodeOfType(node, "NewExpression")) {
+		const callee = stripParenExpression(node.callee);
+		if (!isNodeOfType(callee, "Identifier") || !PURE_GLOBAL_CONSTRUCTOR_NAMES.has(callee.name) || getIdentifierBindingIdentity(analysis, callee) !== null) {
+			evidence.hasUnknownSource = true;
+			return evidence;
+		}
+		for (const argument of node.arguments ?? []) mergeEvidence(evidence, collectValueEvidence(analysis, argument, frame, remainingCallFrames, new Set(visitedBindings)));
+		return evidence;
+	}
 	if (isFunctionLike$1(node) || isNodeOfType(node, "AwaitExpression")) {
 		evidence.hasUnknownSource = true;
 		return evidence;
@@ -23998,6 +24352,26 @@ const STATEFUL_HTML_DESCENDANT_TAGS = new Set([
 	"dialog",
 	"canvas"
 ]);
+const STATEFUL_HTML_ATTRIBUTE_NAMES = new Set([
+	"autofocus",
+	"contenteditable",
+	"draggable",
+	"tabindex"
+]);
+const isStaticallyFalseAttributeValue = (attribute) => {
+	if (!isNodeOfType(attribute, "JSXAttribute") || !attribute.value) return false;
+	const value = isNodeOfType(attribute.value, "JSXExpressionContainer") ? attribute.value.expression : attribute.value;
+	return isNodeOfType(value, "Literal") && (value.value === false || value.value === "false");
+};
+const hasStatefulHtmlAttribute = (openingElement) => {
+	if (!isNodeOfType(openingElement, "JSXOpeningElement")) return false;
+	return openingElement.attributes.some((attribute) => {
+		if (!isNodeOfType(attribute, "JSXAttribute") || !isNodeOfType(attribute.name, "JSXIdentifier")) return false;
+		const attributeName = attribute.name.name.toLowerCase();
+		if (!STATEFUL_HTML_ATTRIBUTE_NAMES.has(attributeName)) return false;
+		return attributeName === "tabindex" || !isStaticallyFalseAttributeValue(attribute);
+	});
+};
 const STATEFUL_DESCENDANT_SCAN_BUDGET = 200;
 const rootIdentifierNameOf = (expression) => {
 	let object = expression;
@@ -24015,7 +24389,8 @@ const containsStatefulDescendant = (jsxElement, options = {}) => {
 		budget -= 1;
 		const node = stack.pop();
 		if (isNodeOfType(node, "JSXElement")) {
-			const name = node.openingElement.name;
+			const opening = node.openingElement;
+			const name = opening.name;
 			if (name && isNodeOfType(name, "JSXIdentifier")) {
 				const tagName = name.name;
 				const firstChar = tagName.charCodeAt(0);
@@ -24023,6 +24398,7 @@ const containsStatefulDescendant = (jsxElement, options = {}) => {
 				if (STATEFUL_HTML_DESCENDANT_TAGS.has(tagName)) return true;
 			}
 			if (name && isNodeOfType(name, "JSXMemberExpression")) return true;
+			if (hasStatefulHtmlAttribute(opening)) return true;
 			const children = node.children ?? [];
 			for (const child of children) stack.push(child);
 			continue;
@@ -24582,6 +24958,14 @@ const templateHasOuterMemberIdentity = (template, bindingFunction) => {
 	}
 	return false;
 };
+const findBareItemNamesReferencedByTemplate = (template, itemNames) => {
+	const referencedItemNames = /* @__PURE__ */ new Set();
+	for (const expression of template.expressions ?? []) {
+		const unwrappedExpression = stripParenExpression(expression);
+		if (isNodeOfType(unwrappedExpression, "Identifier") && itemNames.has(unwrappedExpression.name)) referencedItemNames.add(unwrappedExpression.name);
+	}
+	return referencedItemNames;
+};
 const forLoopTestReadsDataLength = (test) => {
 	let didFindLengthRead = false;
 	walkAst(test, (child) => {
@@ -24718,9 +25102,11 @@ const noArrayIndexAsKey = defineRule({
 				} else if (STATELESS_HTML_LEAF_TAGS.has(elementName.name)) {
 					const jsxElement = openingElement.parent;
 					if (jsxElement && isNodeOfType(jsxElement, "JSXElement")) {
+						const isInlineTextRun = INLINE_TEXT_LEAF_TAGS.has(elementName.name);
+						const primitiveItemNames = keyTemplate ? findBareItemNamesReferencedByTemplate(keyTemplate, itemNames) : EMPTY_NAME_SET;
 						if (!containsStatefulDescendant(jsxElement, {
-							memberRootNames: INLINE_TEXT_LEAF_TAGS.has(elementName.name) ? itemNames : EMPTY_NAME_SET,
-							bareIdentifierNames: derivedNames
+							memberRootNames: isInlineTextRun ? itemNames : EMPTY_NAME_SET,
+							bareIdentifierNames: primitiveItemNames.size > 0 ? new Set([...derivedNames, ...primitiveItemNames]) : derivedNames
 						})) return;
 					}
 				}
@@ -24888,7 +25274,11 @@ const noAsyncEffectCallback = defineRule({
 	severity: "warn",
 	recommendation: "Don't make the effect callback `async`. Define an async function inside the effect and call it, then return a real cleanup function if you need one.",
 	create: (context) => ({ CallExpression(node) {
-		if (!isHookCall$2(node, EFFECT_HOOK_NAMES$1)) return;
+		if (!isReactApiCall(node, EFFECT_HOOK_NAMES$1, context.scopes, {
+			allowGlobalReactNamespace: true,
+			allowUnboundBareCalls: true,
+			resolveNamedAliases: true
+		})) return;
 		const callback = getEffectCallback(node);
 		if (!callback) return;
 		if (!isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression")) return;
@@ -26086,6 +26476,19 @@ const noCloneElement = defineRule({
 	} })
 });
 //#endregion
+//#region src/plugin/utils/get-call-method-name.ts
+/**
+* Returns the static method name of a call's callee when it's a
+* non-computed MemberExpression (`obj.method` → `"method"`), or
+* `null` otherwise. Used by `no-pass-data-to-parent` and
+* `no-pass-live-state-to-parent` to match the receiver-bound
+* method-call shape against an allow/block list.
+*/
+const getCallMethodName = (callee) => {
+	if (isNodeOfType(callee, "MemberExpression") && !callee.computed && isNodeOfType(callee.property, "Identifier")) return callee.property.name;
+	return null;
+};
+//#endregion
 //#region src/plugin/rules/state-and-effects/no-create-context-in-render.ts
 const MESSAGE$31 = "createContext() builds a new context every render, so every consumer gets cut off & resets.";
 const CONTEXT_MODULES = [
@@ -26093,23 +26496,35 @@ const CONTEXT_MODULES = [
 	"use-context-selector",
 	"react-tracked"
 ];
-const isCreateContextCallee = (callee) => {
+const getSupportedContextImportSource = (symbol) => {
+	if (symbol?.kind !== "import") return null;
+	const importDeclaration = symbol.declarationNode.parent;
+	if (!importDeclaration || !isNodeOfType(importDeclaration, "ImportDeclaration") || typeof importDeclaration.source.value !== "string" || !CONTEXT_MODULES.includes(importDeclaration.source.value)) return null;
+	return importDeclaration.source.value;
+};
+const isSupportedNamespaceSymbol = (symbol) => getSupportedContextImportSource(symbol) !== null && Boolean(symbol && (isNodeOfType(symbol.declarationNode, "ImportDefaultSpecifier") || isNodeOfType(symbol.declarationNode, "ImportNamespaceSpecifier")));
+const isDestructuredCreateContextBinding = (identifier, scopes) => {
+	if (!isNodeOfType(identifier, "Identifier")) return false;
+	const symbol = scopes.symbolFor(identifier);
+	if (symbol?.kind !== "const" || !symbol.initializer || !isNodeOfType(symbol.declarationNode, "VariableDeclarator") || !isNodeOfType(symbol.declarationNode.id, "ObjectPattern")) return false;
+	const property = symbol.bindingIdentifier.parent;
+	if (!property || !isNodeOfType(property, "Property") || getStaticPropertyKeyName(property, { allowComputedString: true }) !== "createContext") return false;
+	const initializer = stripParenExpression(symbol.initializer);
+	return isNodeOfType(initializer, "Identifier") && isSupportedNamespaceSymbol(resolveConstIdentifierAlias(initializer, scopes));
+};
+const isCreateContextCall = (node, scopes) => {
+	const callee = stripParenExpression(node.callee);
 	if (isNodeOfType(callee, "Identifier")) {
-		const binding = getImportBindingForName(callee, callee.name);
-		return binding !== null && binding.exportedName === "createContext" && CONTEXT_MODULES.includes(binding.source);
+		if (isDestructuredCreateContextBinding(callee, scopes)) return true;
+		const symbol = resolveConstIdentifierAlias(callee, scopes);
+		return getSupportedContextImportSource(symbol) !== null && Boolean(symbol && getImportedName(symbol.declarationNode) === "createContext");
 	}
-	if (isNodeOfType(callee, "MemberExpression") && !callee.computed) {
-		const namespaceIdentifier = callee.object;
-		const propertyIdentifier = callee.property;
-		if (!isNodeOfType(namespaceIdentifier, "Identifier")) return false;
-		if (!isNodeOfType(propertyIdentifier, "Identifier")) return false;
-		if (propertyIdentifier.name !== "createContext") return false;
-		const namespaceName = namespaceIdentifier.name;
-		if (isCanonicalReactNamespaceName(namespaceName)) return true;
-		const importSource = getImportSourceForName(namespaceIdentifier, namespaceName);
-		return importSource !== null && CONTEXT_MODULES.includes(importSource);
-	}
-	return false;
+	if (!isNodeOfType(callee, "MemberExpression")) return false;
+	if ((getCallMethodName(callee) ?? (callee.computed && isNodeOfType(callee.property, "Literal") && typeof callee.property.value === "string" ? callee.property.value : null)) !== "createContext") return false;
+	const receiver = stripParenExpression(callee.object);
+	if (!isNodeOfType(receiver, "Identifier")) return false;
+	if (receiver.name === "React" && scopes.isGlobalReference(receiver)) return true;
+	return isSupportedNamespaceSymbol(resolveConstIdentifierAlias(receiver, scopes));
 };
 const noCreateContextInRender = defineRule({
 	id: "no-create-context-in-render",
@@ -26118,7 +26533,7 @@ const noCreateContextInRender = defineRule({
 	category: "Correctness",
 	recommendation: "Move `createContext(...)` outside the component, to the top level of the file, so it stays the same on every render.",
 	create: (context) => ({ CallExpression(node) {
-		if (!isCreateContextCallee(node.callee)) return;
+		if (!isCreateContextCall(node, context.scopes)) return;
 		const componentOrHookName = enclosingComponentOrHookName(node);
 		if (!componentOrHookName) return;
 		context.report({
@@ -28068,20 +28483,31 @@ const noDocumentStartViewTransition = defineRule({
 	} })
 });
 //#endregion
+//#region src/plugin/utils/get-static-property-name.ts
+const getStaticPropertyName = (memberExpression) => {
+	const property = memberExpression.property;
+	if (!memberExpression.computed && isNodeOfType(property, "Identifier")) return property.name;
+	if (memberExpression.computed && isNodeOfType(property, "Literal")) return typeof property.value === "string" ? property.value : null;
+	if (memberExpression.computed && isNodeOfType(property, "TemplateLiteral") && property.expressions.length === 0) return property.quasis[0]?.value.cooked ?? property.quasis[0]?.value.raw ?? null;
+	return null;
+};
+//#endregion
 //#region src/plugin/rules/js-performance/no-document-write.ts
 const MESSAGE$24 = "`document.write()` blocks parsing, is ignored (or wipes the page) after load, and is flagged by browsers as a performance anti-pattern. Build DOM nodes or set `innerHTML`/`textContent` on a target element instead.";
 const WRITE_METHODS = new Set(["write", "writeln"]);
+const isGlobalDocumentReference = (node, context) => node.name === "document" && context.scopes.isGlobalReference(node);
 const noDocumentWrite = defineRule({
 	id: "no-document-write",
 	title: "document.write/writeln",
 	severity: "warn",
 	recommendation: "Don't use `document.write()`/`document.writeln()`. Append DOM nodes or set `innerHTML`/`textContent` on a specific element instead.",
 	create: (context) => ({ CallExpression(node) {
-		const callee = node.callee;
-		if (!isNodeOfType(callee, "MemberExpression") || callee.computed) return;
+		const callee = stripParenExpression(node.callee);
+		if (!isNodeOfType(callee, "MemberExpression")) return;
 		const receiver = stripParenExpression(callee.object);
-		if (!isNodeOfType(receiver, "Identifier") || receiver.name !== "document") return;
-		if (!isNodeOfType(callee.property, "Identifier") || !WRITE_METHODS.has(callee.property.name)) return;
+		if (!isNodeOfType(receiver, "Identifier") || !isGlobalDocumentReference(receiver, context)) return;
+		const methodName = getStaticPropertyName(callee);
+		if (methodName === null || !WRITE_METHODS.has(methodName)) return;
 		context.report({
 			node,
 			message: MESSAGE$24
@@ -28888,6 +29314,14 @@ const noEffectWithFreshDeps = defineRule({
 //#endregion
 //#region src/plugin/rules/security/no-eval.ts
 const SANDBOX_SURFACE_PATH_PATTERN = /(?:^|[/-])sandbox(?:$|[/-])|(?:^|\/)[\w.]+-sandbox(?:\/|\.[cm]?[jt]sx?$)/i;
+const getExecutableGlobalName = (node, context) => {
+	const expression = stripParenExpression(node);
+	if (isNodeOfType(expression, "Identifier")) return context.scopes.isGlobalReference(expression) ? expression.name : null;
+	if (!isNodeOfType(expression, "MemberExpression")) return null;
+	const receiver = stripParenExpression(expression.object);
+	if (!isNodeOfType(receiver, "Identifier") || receiver.name !== "globalThis" || !context.scopes.isGlobalReference(receiver)) return null;
+	return getStaticPropertyName(expression);
+};
 const noEval = defineRule({
 	id: "no-eval",
 	title: "eval() runs untrusted code strings",
@@ -28897,20 +29331,21 @@ const noEval = defineRule({
 		if (SANDBOX_SURFACE_PATH_PATTERN.test(normalizeFilename(context.filename ?? ""))) return {};
 		return {
 			CallExpression(node) {
-				if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "eval") {
+				const executableGlobalName = getExecutableGlobalName(node.callee, context);
+				if (executableGlobalName === "eval") {
 					context.report({
 						node,
 						message: "eval() is a code-injection vulnerability: it runs any string as code."
 					});
 					return;
 				}
-				if (isNodeOfType(node.callee, "Identifier") && (node.callee.name === "setTimeout" || node.callee.name === "setInterval") && isNodeOfType(node.arguments?.[0], "Literal") && typeof node.arguments[0].value === "string") context.report({
+				if ((executableGlobalName === "setTimeout" || executableGlobalName === "setInterval") && isNodeOfType(node.arguments?.[0], "Literal") && typeof node.arguments[0].value === "string") context.report({
 					node,
-					message: `Passing a string to ${node.callee.name}() is a code-injection vulnerability, since it runs that string as code.`
+					message: `Passing a string to ${executableGlobalName}() is a code-injection vulnerability, since it runs that string as code.`
 				});
 			},
 			NewExpression(node) {
-				if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "Function") {
+				if (getExecutableGlobalName(node.callee, context) === "Function") {
 					const onlyArgument = node.arguments.length === 1 ? node.arguments[0] : void 0;
 					if (isNodeOfType(onlyArgument, "Literal") && typeof onlyArgument.value === "string" && onlyArgument.value.trim() === "return this") return;
 					context.report({
@@ -30169,7 +30604,11 @@ const noFetchInEffect = defineRule({
 	severity: "warn",
 	recommendation: "Use a data-fetching layer or Server Component so fetches do not race, double-fire, or leak from `useEffect`.",
 	create: (context) => ({ CallExpression(node) {
-		if (!isHookCall$2(node, EFFECT_HOOK_NAMES$1)) return;
+		if (!isReactApiCall(node, EFFECT_HOOK_NAMES$1, context.scopes, {
+			allowGlobalReactNamespace: true,
+			allowUnboundBareCalls: true,
+			resolveNamedAliases: true
+		})) return;
 		const callback = getEffectCallback(node);
 		if (!callback) return;
 		const analysisFunctions = collectEffectAnalysisFunctions(callback, context);
@@ -34379,19 +34818,6 @@ const DATA_SINK_METHOD_NAMES = new Set([
 	"deserialize"
 ]);
 //#endregion
-//#region src/plugin/utils/get-call-method-name.ts
-/**
-* Returns the static method name of a call's callee when it's a
-* non-computed MemberExpression (`obj.method` → `"method"`), or
-* `null` otherwise. Used by `no-pass-data-to-parent` and
-* `no-pass-live-state-to-parent` to match the receiver-bound
-* method-call shape against an allow/block list.
-*/
-const getCallMethodName = (callee) => {
-	if (isNodeOfType(callee, "MemberExpression") && !callee.computed && isNodeOfType(callee.property, "Identifier")) return callee.property.name;
-	return null;
-};
-//#endregion
 //#region src/plugin/rules/state-and-effects/no-pass-data-to-parent.ts
 const isUseStateIdentifier = (identifier) => {
 	if (!isNodeOfType(identifier, "Identifier")) return false;
@@ -35017,6 +35443,30 @@ const guardsRenderShape = (comparison) => {
 	}
 	return false;
 };
+const isPropsChildrenLength = (node, scopes) => {
+	const unwrappedNode = stripParenExpression(node);
+	return isNodeOfType(unwrappedNode, "MemberExpression") && !unwrappedNode.computed && isNodeOfType(unwrappedNode.property, "Identifier") && unwrappedNode.property.name === "length" && resolvesToPropsChildren(stripParenExpression(unwrappedNode.object), scopes);
+};
+const isLargeTextLengthComparison = (node, scopes) => {
+	const unwrappedNode = stripParenExpression(node);
+	if (!isNodeOfType(unwrappedNode, "BinaryExpression")) return false;
+	const leftIsLength = isPropsChildrenLength(unwrappedNode.left, scopes);
+	const rightIsLength = isPropsChildrenLength(unwrappedNode.right, scopes);
+	const thresholdNode = leftIsLength ? unwrappedNode.right : unwrappedNode.left;
+	if (!leftIsLength && !rightIsLength || !isNodeOfType(thresholdNode, "Literal")) return false;
+	if (typeof thresholdNode.value !== "number" || thresholdNode.value < 1e3) return false;
+	return leftIsLength ? unwrappedNode.operator === ">" || unwrappedNode.operator === ">=" : unwrappedNode.operator === "<" || unwrappedNode.operator === "<=";
+};
+const isLargeStringOptimizationGuard = (comparison, scopes) => {
+	let current = findTransparentExpressionRoot(comparison);
+	while (current.parent) {
+		const parent = current.parent;
+		if (!isNodeOfType(parent, "LogicalExpression") || parent.operator !== "&&") return false;
+		if (isLargeTextLengthComparison(parent.left === current ? parent.right : parent.left, scopes)) return true;
+		current = findTransparentExpressionRoot(parent);
+	}
+	return false;
+};
 const noPolymorphicChildren = defineRule({
 	id: "no-polymorphic-children",
 	title: "Children type checked at runtime",
@@ -35030,6 +35480,7 @@ const noPolymorphicChildren = defineRule({
 		const isStringLiteral = (operand) => isNodeOfType(operand, "Literal") && operand.value === "string";
 		if (!isStringLiteral(node.left) && !isStringLiteral(node.right)) return;
 		if (!guardsRenderShape(node)) return;
+		if (isLargeStringOptimizationGuard(node, context.scopes)) return;
 		context.report({
 			node,
 			message: "Your users hit inconsistent behavior because `typeof children === \"string\"` makes this component switch on what callers pass, so add clear subcomponents like `<Button.Text>` instead."
@@ -54455,12 +54906,6 @@ const webhookSignatureRisk = defineRule({
 //#region src/plugin/rules/zod/utils/zod-ast.ts
 const ZOD_MODULE = "zod";
 const ZOD_MODULE_SOURCES = [ZOD_MODULE];
-const getStaticPropertyName = (member) => {
-	const property = member.property;
-	if (!member.computed && isNodeOfType(property, "Identifier")) return property.name;
-	if (member.computed && isNodeOfType(property, "Literal") && typeof property.value === "string") return property.value;
-	return null;
-};
 const importInfoCache = /* @__PURE__ */ new WeakMap();
 const getImportInfoForIdentifier = (identifier) => {
 	if (importInfoCache.has(identifier)) return importInfoCache.get(identifier) ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.5-dev.3075e10",
+  "version": "0.7.5-dev.3aef25a",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",