wow-secret-lint 1.4.0 → 1.4.2

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 1.4.2 - 2026-08-31
+
+Data only. No rule, message or analysis behaviour changed.
+
+### Changed
+
+- Refreshed `data/api-snapshot.json` from `Gethe/wow-ui-source@live` so the published
+  package carries the current documentation. Two entries moved out of 10,099:
+  `UnitCanAssist` gained `canAssistImmunePC` and `canAssistUninteractable` arguments, and
+  `UnitIsPlayerControlledOrGroupMember` was added. Neither carries `SecretReturns`, neither
+  is conditionally secret, and neither appears in any 12.1 rule list.
+
+Verified inert rather than assumed: the full suite passes against the new snapshot, and the
+12-addon corpus produces the same 500 findings, identical on file, line, column, rule id and
+severity. No structures changed and no functions were removed.
+
+## 1.4.1 - 2026-08-31
+
+### Changed
+
+- **WSL016 now points at the migration, not just the rename.** Reporting the
+  `showCountdownFrame` bug to oUF ([#888](https://github.com/oUF-wow/oUF/issues/888)) got
+  it closed as not planned, with the reason that private auras are unofficially deprecated
+  as of 12.1 and the element is slated for removal. The bug was not disputed. Verified the
+  substance of the reply against Blizzard's live source: `Blizzard_AuraContainerSources.lua`
+  carries `AuraContainerPrivateAuraSource` and reaches private auras through
+  `C_UnitAurasPrivate.GetAllPrivateAuraInstanceIDs`, so an AuraContainer displays them with
+  no private aura anchor at all. The message and the README now say to migrate rather than
+  rename, and the rule stays a warning because of it.
+
 ## 1.4.0 - 2026-08-31
 
 Closes every item that was sitting in PROGRESS as a next step. Nothing in the 12.1 notes

package/README.md

@@ -177,7 +177,9 @@ A replacement is named only where the notes state the rename outright, or where
 
 `SecureAuraHeaderTemplate` is caught both in a `CreateFrame` template list and in an XML `inherits` attribute, including comma-separated lists. Referencing `UIParentLoadAddOn` without calling it is not flagged, because `if UIParentLoadAddOn then` is how you feature-detect the old client.
 
-**WSL016** exists because this one fails silently: `showCountdownFrame` was renamed `showCooldownFrame` in the private-aura anchor structures, the old field is ignored, and the cooldown swipe just stops appearing with no error to trace. It is caught both inline and through a local args table. oUF's `privateauras.lua` ships this bug today, as do the copies vendored into KkthnxUI and SpartanUI.
+**WSL016** exists because this one fails silently: `showCountdownFrame` was renamed `showCooldownFrame` in the private-aura anchor structures, the old field is ignored, and the cooldown swipe just stops appearing with no error to trace. It is caught both inline and through a local args table.
+
+The rename is the minimal fix, but it is probably not the one you want. Reporting this to oUF ([#888](https://github.com/oUF-wow/oUF/issues/888)) produced a useful answer: private auras are unofficially deprecated as of 12.1, the whole element is slated for removal, and existing private auras are now surfaced through aura containers anyway. Blizzard's `Blizzard_AuraContainerSources.lua` carries `AuraContainerPrivateAuraSource` and reaches them via `C_UnitAurasPrivate.GetAllPrivateAuraInstanceIDs`, so a container shows them without a private aura anchor at all. If you are touching this code, migrate rather than rename. The rule reports it as a warning for exactly that reason.
 
 **WSL018** is the one that catches code WSL012 cannot. The notes say the by-index, by-slot and by-instance-id aura APIs *"will Lua error when called by addons while auras are secret"*, so the call is the failure, not what you do with the result. It therefore fires even where the result is guarded perfectly. BigWigs is the worked example: it has zero WSL012 findings because it guards every aura it reads, and four WSL018 findings because it still reaches those auras through `GetAuraDataByIndex`. Guarding the result cannot save a call that already threw. The `C_TooltipInfo` aura calls are included, but their returns are not treated as secret vectors, because the notes make no claim about their shape.