prodlint 0.10.4 → 0.10.5

package/README.md

@@ -13,7 +13,7 @@ npx prodlint
 ```
 
 ```
-  prodlint v0.10.4
+  prodlint v0.10.5
   Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts
@@ -145,10 +145,10 @@ npm i -g prodlint     # Global install
 
 prodlint avoids common false positives:
 
-- **AST parsing** — Babel-based analysis for 13 rules (imports, catch blocks, redirects, redirects in try/catch, SSRF, path traversal, JWT, HTML injection, hydration, transactions, env leaks, loops, SQL) with regex fallback
+- **AST parsing** — Babel-based analysis for 14 rules (imports, catch blocks, redirects, redirects in try/catch, SSRF, path traversal, JWT, HTML injection, hydration, transactions, env leaks, loops, SQL, route handlers) with regex fallback
 - **Monorepo support** — npm/yarn/pnpm workspace dependencies resolved automatically
 - **Framework awareness** — Prisma, Drizzle, Supabase, Knex, and Sequelize whitelists prevent false SQL injection flags
-- **Middleware detection** — Clerk, NextAuth, Supabase middleware detected — auth findings downgraded
+- **Middleware detection** — Clerk, NextAuth, Supabase middleware (`middleware.ts`, or `proxy.ts` on Next.js 16) detected — auth findings downgraded
 - **Block comment awareness** — patterns inside `/* */` are ignored
 - **Path alias support** — `@/`, `~/`, and tsconfig paths aren't flagged as hallucinated imports
 - **Route exemptions** — auth, webhook, health, and cron routes are exempt from auth/rate-limit checks

package/action.yml

@@ -64,7 +64,7 @@ runs:
         # pinning the action — @v1, a version tag or a commit SHA — also pins the scanner.
         # It exits 1 when it finds criticals and 2 when the scan fails; "Check results" decides.
         EXIT_CODE=0
-        npx -y prodlint@0.10.4 "${CMD_ARGS[@]}" > "$RUNNER_TEMP/prodlint-result.json" || EXIT_CODE=$?
+        npx -y prodlint@0.10.5 "${CMD_ARGS[@]}" > "$RUNNER_TEMP/prodlint-result.json" || EXIT_CODE=$?
         echo "exit-code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
         node "$GITHUB_ACTION_PATH/scripts/action-check.cjs" outputs "$RUNNER_TEMP/prodlint-result.json" >> "$GITHUB_OUTPUT"