You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(deps): update all non-major dependencies - #151
#215915cf592 Thanks @ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.
react-x/no-duplicate-key: in .map() callbacks, all statically known keys are now treated as repeating, not only bare string literals.
react-jsx/no-leaked-semicolon: same-line leaked semicolons after an expression container are now detected (ex: <div>{x};</div>, <div>{cond && <span />};</div>).
🏗️ Internal
Removed the Vercel deploy step from the release workflow.
@eslint-react/eslint-plugin: added the all-type-checked preset, which extends all with the rules that require type information. (#2095)
@eslint-react/eslint-plugin: added the experimental @eslint-react/unstable-exhaustive-deps rule, forked from exhaustive-deps, with a hooks option modeled on Biome's useExhaustiveDependencies (closureIndex/dependenciesIndex for custom Hooks, and stableResult for stable results). The rule lives in the unified plugin's own src/rules while incubating and is enabled in the all preset (and thereby in all-type-checked). (#1698, #2078, #2095) Thanks to @dgesteves!
react-x/set-state-in-effect: reworked around explicit effect roots, recursive value resolution, and a synchronous call graph. Stable aliases, multi-level helpers, named setups, IIFEs, and useCallback/useMemo/useEffectEvent wrappers now share one resolution path; indirect diagnostics point at the effect-side trigger and dedupe by setter sink; async functions remain deferred. (#2075)
react-x/static-components: JSX member expression tags (ex: <Namespace.Bar />) are now analyzed. (#2114)
🐞 Fixes
react-x/error-boundaries: optional-chained createElement calls are recognized as JSX-like return values. (#2084)
react-x/no-direct-mutation-state: state assignments in nested constructor blocks (if, loops, try, and bare blocks) are no longer reported. (#2088)
react-x/no-duplicate-key: only keys that provably have a duplicate are now reported. Unique siblings in a partially duplicate group (ex: [A, B, B]) are no longer reported, and duplicates followed by a unique key (ex: [A, A, B]) are now correctly reported; keys collected through Children.toArray() and Children.map() are no longer reported; only elements returned by .map() callbacks are checked; literal keys are no longer overwritten by later keys; and .map() calls on array literals with at most one element are skipped. (#2108)
react-x/no-duplicate-key: the fast-path text check now matches bare key attributes and keys separated from = by whitespace (ex: <div key />, <div key = {id} />), so such elements are no longer silently skipped.
react-x/no-missing-component-display-name: memo components passed to generic HOCs are recognized, so anonymous ones require a display name. (#2084)
react-x/no-missing-context-display-name: the autofix now applies to exported contexts and no longer produces invalid syntax for multi-declarator declarations. (#2088, #2089)
react-x/no-missing-key: elements with a spread attribute are no longer reported as missing key, and TypeScript-wrapped iterator callbacks are unwrapped before checking. (#2086, #2088)
react-x/no-nested-component-definitions: array pattern element defaults and memopropsAreEqual comparators are no longer reported as nested components; optional-chained createElement returns are recognized. (#2084)
react-x/no-unstable-context-value and react-x/no-unstable-default-props: shadowed Boolean(), String(), and Number() calls are no longer reported. (#2089)
react-x/no-unused-class-component-members: statically resolvable computed member reads and destructuring are counted as usages. (#2088)
react-x/refs: non-null guards whose terminating branch is a try statement, an all-terminating switch with a default clause, or an all-terminating while (true)/for (;;)/do...while loop are now recognized, so ref writes reached only when the ref is null are no longer reported. (#2093, #2109)
react-x/set-state-in-effect: TypeScript-wrapped setups are resolved; zero-argument setters called directly in the setup are reported; timer or event callbacks nested in useCallback/useEffectEvent are no longer treated as synchronous setters; every possible setter is reported when the callee may resolve to more than one; the ref-derived exemption applies to any argument position of a custom state hook's setter; ref-derived early-return guards gate the following statements inside try/switch/bare blocks and loop bodies or update clauses; ref provenance follows IIFEs; nested and outer effect setups are analyzed independently; and setter calls reached through the same effect-side trigger are reported once per setter name. (#2075, #2082, #2083)
react-x/static-components: the render-boundary check now requires that at least one declaration of the component binding lives inside a render body, instead of only checking the first declaration. (#2110)
react-x/static-components: static components wrapped by useMemo or useCallback (ex: useMemo(() => External, [])) are no longer reported; the memoized value is traced instead of the hook call itself. (#2113, closes #1762) Thanks to @itisrmk!
react-x/use-state: calls in computed object property keys and JSX subtrees are now detected by the lazy-initialization check. (#2080)
react-jsx/no-children-prop-with-children: children supplied through a statically resolvable computed key in a createElement props object is now detected. (#2086)
react-jsx/no-children-prop: children supplied through a statically resolvable computed key in a createElement props object is now detected, and the suggestion to move children into element content is no longer offered when a following spread attribute could override it. (#2086, #2102)
react-jsx/no-leaked-semicolon: leaked semicolons between a JSX child and its parent's closing tag on the same line are now detected. (#2102)
react-jsx/no-useless-fragment: fragments with a spread attribute are no longer reported, and lone-CR whitespace, including &#​13;, is treated as formatting padding like LF and CRLF. (#2086, #2092)
react-dom/no-dangerously-set-innerhtml-with-children: empty expression containers and comment-only children no longer count as children; lone-CR whitespace, including &#​13;, no longer counts either. (#2086, #2092)
react-dom/no-hydrate and react-dom/no-render: autofixes now skip calls with extra or spread arguments and calls whose return values are used, and no longer prepend the new import at the top of the file — existing imports are reused, duplicates are skipped, and new imports are placed after file-level directives, header comments, and existing imports. (#2103, #2104)
react-dom/no-script-url: namespaced attributes such as xlink:href are now checked for javascript: URLs. (#2086)
react-dom/no-unsafe-iframe-sandbox: sandbox permissions are matched as whole whitespace-separated tokens, fixing false positives like sandbox="not-allow-scripts". (#2112)
react-dom/no-unsafe-target-blank: the suggestion for a missing rel attribute now inserts it after the last JSX attribute, so a spread attribute cannot override the suggested value. (#2086)
react-dom/no-use-form-state: autofix-added imports now reuse existing imports, avoid duplicates, and follow file-level directives, header comments, and existing imports. (#2104)
react-dom/no-void-elements-with-children: comment-only/empty containers, newline-only formatting whitespace, and lone-CR whitespace, including &#​13;, no longer count as children. (#2086, #2092)
react-web-api/no-leaked-event-listener: dot access and static computed access (including simple template-literal keys) now match as the same property; optional-chained listeners, event types, and receivers pair with their cleanup; string-literal and template-literal option keys are recognized; cyclic signal alias chains no longer recurse forever; and function-parameter callees are no longer mistaken for the enclosing function. (#2085, #2092, #2093, #2100)
react-web-api/no-leaked-fetch: signal option keys written as string literals or simple template literals are recognized. (#2093)
react-web-api/no-leaked-intersection-observer and react-web-api/no-leaked-resize-observer: observe(...) and unobserve(...) now pair on optional-chained elements. (#2093)
react-debug/function-component: only the first argument of memo/forwardRef is treated as the wrapped component; propsAreEqual comparators returning JSX are no longer reported, and functions in that position no longer inherit the surrounding binding or wrapper flags. Array pattern element defaults are no longer reported, and optional-chained createElement returns are recognized. (#2084)
🪄 Improvements
Added fast-path text checks so rules skip AST traversal when their target term is absent from the file. (#2088)
Affected rules:
react-x/no-children-count
react-x/no-children-for-each
react-x/no-children-map
react-x/no-children-only
react-x/no-children-to-array
react-x/no-clone-element
react-x/no-direct-mutation-state
react-x/no-implicit-children
react-x/no-implicit-key
react-x/no-implicit-ref
react-x/no-nested-lazy-component-declarations
react-x/no-unused-class-component-members
JSX and createElement rules no longer resolve spread props, since a spread's contents are unknown; only direct attributes and properties are inspected. (#2086)
react-x/no-unknown-property: attribute-tag, DOM-property, and standard-name lookups are cached per React version and resolved lazily. (#2086)
react-x/set-state-in-effect and react-x/set-state-in-render: setters are recognized only as the second element of a useState array destructuring; tuple-index access and object-pattern numeric keys are no longer detected. (#2075)
📝 Documentation
Added a TanStack Redact example and updated the website's community projects list. (#2079)
Added known-issues references for eslint-plugin-react-jsx (#2102), eslint-plugin-react-dom (#2103), eslint-plugin-react-web-api, and eslint-plugin-react-x, and removed their next-step sections.
Documented known limitations and workarounds for react-jsx/no-comment-textnodes, react-jsx/no-key-after-spread, and react-jsx/no-leaked-dollar. (#2102)
Synced the migration tables with rule features and updated the configuration and third-party plugin docs. (#2106)
Synced the website recipe snippets with the hardened sample rules, and corrected the noExplicitSpreadProps recipe to state that it provides no autofix. (#2089, #2107)
Updated the FAQ, glossary, examples pages, the contributing guide's monorepo architecture diagram and package/example listings, and the term-based rule implementation patterns.
🏗️ Internal
@eslint-react/ast, @eslint-react/core, and @local/testkit: added tests for AST tree types, core semantic interfaces, and type utilities.
@eslint-react/ast: added the Collect and Analyze namespaces and Traverse.simpleTraverse; Analyze.isUnconditionallyTerminating now handles try statements, terminating switch statements with a default clause, and terminating while (true)/for (;;)/do...while loops; Compare.isEqual now compares ChainExpression, regex literals, and member computed/optional flags; Collect now traverses for initializers and updates; renamed Check.isConditional to Check.isConditionalOrLoop; added Check.isArrayPatternElementDefault, Check.isObjectPatternElementDefault, Check.isLoopStatement, and Extract.getJSXName; improved private identifier handling; removed the general-purpose Extract.getMemberChain, Extract.getPropertyName, Extract.findProperty, and Extract.getAssignmentTargets helpers in favor of resolveAssignmentTargets from @eslint-react/var and rule-local traversal. (#2080, #2083, #2084, #2086, #2092, #2093, #2099, #2100)
@eslint-react/core: moved the createElement helpers to @eslint-react/jsx; component detection now checks wrapper argument positions and unwraps chain expressions; improved render-method detection and qualified type names; narrowed the accepted node types of hook/component detection helpers. (#2075, #2077, #2084, #2099)
@eslint-react/var: added resolveOriginChain, isProvenanceEqual, hasDefault, and resolveAssignmentTargets; expanded resolveObjectType and createImportLookup, which now exposes isModuleBinding instead of hasNamespace; made isValueEqual identity-only (use isProvenanceEqual for structural provenance); and removed resolveBindingTarget/BindingTarget, with binding targets now unwrapped inline. (#2085, #2086, #2088, #2100)
@local/samples: hardened the sample rules. (#2107)
@local/testkit: added a verifyAndFix helper for testing rules with autofixes. (#2078)
Bumped dependencies across the workspace, including eslint to 10.14.0, typescript-eslint to 8.72.1, next to 16.4.5, vitest to 5.1.0, tsdown to 0.23.7, nx to 24.0.4, oxlint to 1.91.0, vite to 8.3.6, effect to 4.1.2, and the fumadocs packages to 16.18.0.
Collapsed multi-line expressions in react-x/static-components origins; no behavioral changes.
Enforced a 1-day dependency maturity period; served README assets from the jsDelivr CDN; restricted website deployments to stable releases via a Vercel deploy hook; refactored the publish workflow trigger and pinned zizmor through its official action.
Removed the ko-fi sponsorship and funding configuration.
Removed the now-unused @typescript-eslint/typescript-estree dependency from @eslint-react/ast, @eslint-react/core, @eslint-react/var, and eslint-plugin-react-x. (#2080)
Removed the unused inlinedDependencies field from the monorepo package configuration.
Unified test language options and reorganized the test harness: tsconfig fixtures replace the per-JSX-emit tester factories, and untyped parsing disables typescript-estree's single-run inference. (#2105)
Unwrapped multi-line comments to single lines across packages, plugins, and scripts; no behavioral changes.
New Contributors
Diogo Esteves (@dgesteves) made their first contribution in #2078.
Rahul Kashyap (@itisrmk) made their first contribution in #2113.
react-x/purity: builtin member resolution no longer follows computed or unknown middle segments (ex: window[fetch], window.myLibrary.fetch), preventing false reports of non-builtin calls. (#2074)
🏗️ Internal
@eslint-react/eslint: added dual-purpose getText for direct or callback-style source text extraction, replacing repeated context.sourceCode.getText wrappers across packages. (#2073)
react-x/purity: now reports Date calls during render, including Date(), Date(arg), and window.Date(); unlike new Date(arg), Date(arg) ignores its arguments and always returns the current time. (#2071) Thanks to @aki05162525!
🏗️ Internal
Bumped effect and @effect/platform-node to 4.0.6, @tanstack/react-router to 1.170.46, @tanstack/react-start to 1.169.4, and eslint-plugin-de-morgan to 2.3.0.
react-x/set-state-in-effect: the ref-derived parameter exemption now also applies to helpers wrapped in useCallback (ex: measure(ref.current) where measure = useCallback((el) => { setWidth(el.offsetWidth); }, [])). (#2065) Thanks to @amhunt!
react-x/set-state-in-effect: a helper call behind a ref-derived guard (if, ternary, short-circuit, or early return) now exempts the setState calls it reaches, as a setState written in its place would be (ex: if (!anchorRef.current) return; commitPosition(0, true);); call sites are judged individually. (#2065) Thanks to @amhunt!
New Contributors
Andrew Hunt (@amhunt) made their first contribution in #2065.
react-dom/no-unsafe-target-blank: the suggested fix now adds rel="noreferrer" instead of rel="noreferrer noopener", since noreferrer already implies noopener per the HTML spec; values combining both tokens remain valid. (#2068)
Reverted the component-scope-bounded identifier resolution introduced in v5.28.3, including the per-component single-report attribution; class declarations in a component body remain recognized as per-render constructions. (#2062)
Affected rules:
react-x/no-unstable-context-value
react-x/no-unstable-default-props
📝 Documentation
Updated the AST Explorer links across the website docs and recipes.
🏗️ Internal
@eslint-react/var: removed the boundary option from resolve and resolveObjectType, and the ClassDeclaration resolution in resolveObjectType, following the revert. (#2062)
Renamed the Jsx-prefixed @eslint-react/core exports to all-caps JSX (ex: JsxConfig → JSXConfig, isJsxLike → isJSXLike). (#2061)
Identifier resolution is now bounded by the enclosing component scope, so render-scoped values referenced from nested callbacks (ex: items.map((item) => <Context.Provider value={foo}>)) are now detected, values declared outside the component (ex: module-level constants) are treated as stable, and nested components report each value only once, attributed to the innermost component. (#2060)
Affected rules:
react-x/no-unstable-context-value
react-x/no-unstable-default-props
Class declarations (ex: class Foo {} in a component body) are now recognized as per-render constructions, so using one as a context value or default prop is now reported. (#2060)
Affected rules:
react-x/no-unstable-context-value
react-x/no-unstable-default-props
🏗️ Internal
@eslint-react/var: resolve and resolveObjectType now accept a boundary option that bounds scope-chain traversal to an enclosing component or hook; resolveObjectType also resolves ClassDeclaration nodes. (#2060)
Bumped typescript-eslint to 8.72.0, fumadocs-core and fumadocs-ui to 16.17.7, fumadocs-mdx to 15.4.8, lucide-react to 1.60.0, and typedoc-plugin-markdown to 4.14.1.
Website: fixed a build failure caused by an unquoted : sequence in the YAML frontmatter description of the react-x/use-memo doc; the rule scaffold script now emits a YAML-safe quoted description so scaffolded rules cannot reintroduce the issue.
📝 Documentation
Aligned the react-debug/jsx rule doc messages with the actual JSON report format.
Corrected the documented minimum ESLint version to 10.0.0 in the READMEs and getting-started guides.
Documented per-layer isolated testing in the fact-based rule implementation patterns guide.
Generalized the isAPI/isAPICall docs and updated the custom rule samples to use is.APICall. (#2059)
🏗️ Internal
Added unit tests for the react-x immutability rule modules (collect, effects, helpers, origins). (#2056)
react-dom/no-unknown-property: fixed a false positive where the React camelCase SVG prop renderingIntent was reported as an unknown property, including on code produced by this rule's own autofix for rendering-intent. (#2055)
react-jsx/no-useless-fragment: the auto-fixer no longer unwraps fragments outside JSX whose children are all whitespace (ex: const x = <> </>; or return <>\n</> with allowExpressions: false); the previous fix produced syntactically invalid JavaScript such as const x = ;. These fragments are still reported, just without a fix. (#2055)
📝 Documentation
Aligned rule docs, comments, and diagnostic messages with actual behavior across the plugins. (#2055)
🏗️ Internal
Bumped eslint to 10.13.0, pnpm to 12.14.0, tsl-dx to 0.15.0, @effect/language-service to 0.87.5, and lucide-react to 1.59.0.
@eslint-react/eslint-plugin: the general-purpose presets now enable JSX syntax support via languageOptions.parserOptions.ecmaFeatures.jsx: true, so you no longer need to configure it yourself. (#2049)
Affected presets:
recommended
recommended-typescript
recommended-type-checked
strict
strict-typescript
strict-type-checked
🏗️ Internal
Bumped fumadocs-core and fumadocs-ui to 16.17.5, and lucide-react to 1.58.0.
@eslint-react/jsx: resolveAttributeValue now handles a parser-tolerated JSXFragment in attribute value position (ex: <a href=<></> />), reporting it as kind "element" instead of falling through to undefined; as a result, react-dom/no-missing-iframe-sandbox now reports <iframe sandbox=<></> /> instead of silently skipping it. (#2048)
react-jsx/no-key-after-spread: the fast-path text check now matches key assignments with whitespace around = (ex: <div {...props} key = {id} /> or a newline before =), so such elements are no longer silently skipped. (#2043) Thanks to @amir-rahmanii!
react-jsx/no-children-prop: a children prop alongside nested children content (ex: <div children="x">y</div>, createElement("div", { children: "x" }, "y")) is no longer reported by this rule — that conflict case belongs to react-jsx/no-children-prop-with-children — removing the unsafe merge suggestion and the duplicate diagnostics. (#2044) Thanks to @amir-rahmanii!
react-jsx/no-children-prop-with-children: empty expression containers (ex: {}, {/* comment */}) are no longer treated as meaningful children, so <div children="x">{/* comment */}</div> is no longer reported. (#2045) Thanks to @amir-rahmanii!
📝 Documentation
`re
[!IMPORTANT]
✂ PR body was truncated to here.
Configuration
📅 Schedule: (in timezone Europe/Zurich)
Branch creation
Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
Automerge
At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: pnpm-lock.yaml
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^2.31.0→^2.31.1^4.7.2→^4.8.1^5.8.9→^5.30.1^5.8.9→^5.30.1^8.0.2→^8.0.3^8.60.0→^8.72.2^8.60.0→^8.72.2>=6.1.5→>=6.1.7^10.4.1→^10.14.0^4.16.2→^4.18.1^3.2.0→^3.4.2^8.0.0→^8.1.0^5.5.6→^5.5.7^3.4.0→^3.10.0>=3.4.2→>=3.4.4^17.6.0→^17.14.0^3.1.4→^3.1.524→24.22.2^0.52.0→^0.78.0^1.0.0→^1.93.0>=4.0.4→>=4.0.711.5.0+sha512.dbfcc4f81cf48597afd4bc391ffdf12c11f1a9fb83a395bfa6b0a2d9cc2fd8ffebafdb1ccbd529632153f793904c2615b7f09fe1a345473fd1c35845172a8eb1→11.28.11^3.0.0→^3.9.10^3.8.3→^3.9.10^19.14.1→^19.17.2^8.60.0→^8.72.2^2.0.0→^2.1.0>=2.8.3→>=2.9.1Release Notes
changesets/changesets (@changesets/cli)
v2.31.1Compare Source
Patch Changes
15cf592Thanks @ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successfulnpm info --jsonoutput in an array. The unwrapped output madechangeset publishtreat every package as unpublished and fail attempting to republish existing versions.eslint-community/eslint-plugin-eslint-comments (@eslint-community/eslint-plugin-eslint-comments)
v4.8.1Compare Source
Bug Fixes
no-use,require-description: key directive-comment cache onadditionalDirectives(#329) (de11b0e)v4.8.0Compare Source
Features
no-use,require-description:additionalDirectivesoption (#267) (d9a7e4d)Rel1cx/eslint-react (@eslint-react/eslint-plugin)
v5.30.1Compare Source
🐞 Fixes
react-x/no-duplicate-key: in.map()callbacks, all statically known keys are now treated as repeating, not only bare string literals.react-jsx/no-leaked-semicolon: same-line leaked semicolons after an expression container are now detected (ex:<div>{x};</div>,<div>{cond && <span />};</div>).🏗️ Internal
Full Changelog: Rel1cx/eslint-react@v5.30.0...v5.30.1
v5.30.0Compare Source
✨ New
@eslint-react/eslint-plugin: added theall-type-checkedpreset, which extendsallwith the rules that require type information. (#2095)@eslint-react/eslint-plugin: added the experimental@eslint-react/unstable-exhaustive-depsrule, forked fromexhaustive-deps, with ahooksoption modeled on Biome'suseExhaustiveDependencies(closureIndex/dependenciesIndexfor custom Hooks, andstableResultfor stable results). The rule lives in the unified plugin's ownsrc/ruleswhile incubating and is enabled in theallpreset (and thereby inall-type-checked). (#1698, #2078, #2095) Thanks to @dgesteves!react-x/set-state-in-effect: reworked around explicit effect roots, recursive value resolution, and a synchronous call graph. Stable aliases, multi-level helpers, named setups, IIFEs, anduseCallback/useMemo/useEffectEventwrappers now share one resolution path; indirect diagnostics point at the effect-side trigger and dedupe by setter sink; async functions remain deferred. (#2075)react-x/static-components: JSX member expression tags (ex:<Namespace.Bar />) are now analyzed. (#2114)🐞 Fixes
react-x/error-boundaries: optional-chainedcreateElementcalls are recognized as JSX-like return values. (#2084)react-x/no-direct-mutation-state: state assignments in nested constructor blocks (if, loops,try, and bare blocks) are no longer reported. (#2088)react-x/no-duplicate-key: only keys that provably have a duplicate are now reported. Unique siblings in a partially duplicate group (ex:[A, B, B]) are no longer reported, and duplicates followed by a unique key (ex:[A, A, B]) are now correctly reported; keys collected throughChildren.toArray()andChildren.map()are no longer reported; only elements returned by.map()callbacks are checked; literal keys are no longer overwritten by later keys; and.map()calls on array literals with at most one element are skipped. (#2108)react-x/no-duplicate-key: the fast-path text check now matches barekeyattributes and keys separated from=by whitespace (ex:<div key />,<div key = {id} />), so such elements are no longer silently skipped.react-x/no-missing-component-display-name:memocomponents passed to generic HOCs are recognized, so anonymous ones require a display name. (#2084)react-x/no-missing-context-display-name: the autofix now applies to exported contexts and no longer produces invalid syntax for multi-declarator declarations. (#2088, #2089)react-x/no-missing-key: elements with a spread attribute are no longer reported as missingkey, and TypeScript-wrapped iterator callbacks are unwrapped before checking. (#2086, #2088)react-x/no-nested-component-definitions: array pattern element defaults andmemopropsAreEqualcomparators are no longer reported as nested components; optional-chainedcreateElementreturns are recognized. (#2084)react-x/no-unstable-context-valueandreact-x/no-unstable-default-props: shadowedBoolean(),String(), andNumber()calls are no longer reported. (#2089)react-x/no-unused-class-component-members: statically resolvable computed member reads and destructuring are counted as usages. (#2088)react-x/refs: non-null guards whose terminating branch is atrystatement, an all-terminatingswitchwith adefaultclause, or an all-terminatingwhile (true)/for (;;)/do...whileloop are now recognized, so ref writes reached only when the ref is null are no longer reported. (#2093, #2109)react-x/set-state-in-effect: TypeScript-wrapped setups are resolved; zero-argument setters called directly in the setup are reported; timer or event callbacks nested inuseCallback/useEffectEventare no longer treated as synchronous setters; every possible setter is reported when the callee may resolve to more than one; the ref-derived exemption applies to any argument position of a custom state hook's setter; ref-derived early-return guards gate the following statements insidetry/switch/bare blocks and loop bodies or update clauses; ref provenance follows IIFEs; nested and outer effect setups are analyzed independently; and setter calls reached through the same effect-side trigger are reported once per setter name. (#2075, #2082, #2083)react-x/static-components: the render-boundary check now requires that at least one declaration of the component binding lives inside a render body, instead of only checking the first declaration. (#2110)react-x/static-components: static components wrapped byuseMemooruseCallback(ex:useMemo(() => External, [])) are no longer reported; the memoized value is traced instead of the hook call itself. (#2113, closes #1762) Thanks to @itisrmk!react-x/use-state: calls in computed object property keys and JSX subtrees are now detected by the lazy-initialization check. (#2080)react-jsx/no-children-prop-with-children:childrensupplied through a statically resolvable computed key in acreateElementprops object is now detected. (#2086)react-jsx/no-children-prop:childrensupplied through a statically resolvable computed key in acreateElementprops object is now detected, and the suggestion to movechildreninto element content is no longer offered when a following spread attribute could override it. (#2086, #2102)react-jsx/no-leaked-semicolon: leaked semicolons between a JSX child and its parent's closing tag on the same line are now detected. (#2102)react-jsx/no-useless-fragment: fragments with a spread attribute are no longer reported, and lone-CR whitespace, including&#​13;, is treated as formatting padding like LF and CRLF. (#2086, #2092)react-dom/no-dangerously-set-innerhtml-with-children: empty expression containers and comment-only children no longer count as children; lone-CR whitespace, including&#​13;, no longer counts either. (#2086, #2092)react-dom/no-hydrateandreact-dom/no-render: autofixes now skip calls with extra or spread arguments and calls whose return values are used, and no longer prepend the new import at the top of the file — existing imports are reused, duplicates are skipped, and new imports are placed after file-level directives, header comments, and existing imports. (#2103, #2104)react-dom/no-script-url: namespaced attributes such asxlink:hrefare now checked forjavascript:URLs. (#2086)react-dom/no-unsafe-iframe-sandbox:sandboxpermissions are matched as whole whitespace-separated tokens, fixing false positives likesandbox="not-allow-scripts". (#2112)react-dom/no-unsafe-target-blank: the suggestion for a missingrelattribute now inserts it after the last JSX attribute, so a spread attribute cannot override the suggested value. (#2086)react-dom/no-use-form-state: autofix-added imports now reuse existing imports, avoid duplicates, and follow file-level directives, header comments, and existing imports. (#2104)react-dom/no-void-elements-with-children: comment-only/empty containers, newline-only formatting whitespace, and lone-CR whitespace, including&#​13;, no longer count as children. (#2086, #2092)react-web-api/no-leaked-event-listener: dot access and static computed access (including simple template-literal keys) now match as the same property; optional-chained listeners, event types, and receivers pair with their cleanup; string-literal and template-literal option keys are recognized; cyclicsignalalias chains no longer recurse forever; and function-parameter callees are no longer mistaken for the enclosing function. (#2085, #2092, #2093, #2100)react-web-api/no-leaked-fetch:signaloption keys written as string literals or simple template literals are recognized. (#2093)react-web-api/no-leaked-intersection-observerandreact-web-api/no-leaked-resize-observer:observe(...)andunobserve(...)now pair on optional-chained elements. (#2093)react-debug/function-component: only the first argument ofmemo/forwardRefis treated as the wrapped component;propsAreEqualcomparators returning JSX are no longer reported, and functions in that position no longer inherit the surrounding binding or wrapper flags. Array pattern element defaults are no longer reported, and optional-chainedcreateElementreturns are recognized. (#2084)🪄 Improvements
Added fast-path text checks so rules skip AST traversal when their target term is absent from the file. (#2088)
Affected rules:
react-x/no-children-countreact-x/no-children-for-eachreact-x/no-children-mapreact-x/no-children-onlyreact-x/no-children-to-arrayreact-x/no-clone-elementreact-x/no-direct-mutation-statereact-x/no-implicit-childrenreact-x/no-implicit-keyreact-x/no-implicit-refreact-x/no-nested-lazy-component-declarationsreact-x/no-unused-class-component-membersJSX and
createElementrules no longer resolve spread props, since a spread's contents are unknown; only direct attributes and properties are inspected. (#2086)Affected rules:
react-x/no-missing-keyreact-jsx/no-children-propreact-jsx/no-children-prop-with-childrenreact-jsx/no-useless-fragmentreact-dom/no-dangerously-set-innerhtmlreact-dom/no-dangerously-set-innerhtml-with-childrenreact-dom/no-missing-button-typereact-dom/no-missing-iframe-sandboxreact-dom/no-string-style-propreact-dom/no-unsafe-iframe-sandboxreact-dom/no-unsafe-target-blankreact-dom/no-void-elements-with-childrenreact-x/no-unknown-property: attribute-tag, DOM-property, and standard-name lookups are cached per React version and resolved lazily. (#2086)react-x/set-state-in-effectandreact-x/set-state-in-render: setters are recognized only as the second element of auseStatearray destructuring; tuple-index access and object-pattern numeric keys are no longer detected. (#2075)📝 Documentation
eslint-plugin-react-jsx(#2102),eslint-plugin-react-dom(#2103),eslint-plugin-react-web-api, andeslint-plugin-react-x, and removed their next-step sections.react-jsx/no-comment-textnodes,react-jsx/no-key-after-spread, andreact-jsx/no-leaked-dollar. (#2102)noExplicitSpreadPropsrecipe to state that it provides no autofix. (#2089, #2107)🏗️ Internal
@eslint-react/ast,@eslint-react/core, and@local/testkit: added tests for AST tree types, core semantic interfaces, and type utilities.@eslint-react/ast: added theCollectandAnalyzenamespaces andTraverse.simpleTraverse;Analyze.isUnconditionallyTerminatingnow handlestrystatements, terminatingswitchstatements with adefaultclause, and terminatingwhile (true)/for (;;)/do...whileloops;Compare.isEqualnow comparesChainExpression, regex literals, and membercomputed/optionalflags;Collectnow traversesforinitializers and updates; renamedCheck.isConditionaltoCheck.isConditionalOrLoop; addedCheck.isArrayPatternElementDefault,Check.isObjectPatternElementDefault,Check.isLoopStatement, andExtract.getJSXName; improved private identifier handling; removed the general-purposeExtract.getMemberChain,Extract.getPropertyName,Extract.findProperty, andExtract.getAssignmentTargetshelpers in favor ofresolveAssignmentTargetsfrom@eslint-react/varand rule-local traversal. (#2080, #2083, #2084, #2086, #2092, #2093, #2099, #2100)@eslint-react/core: moved thecreateElementhelpers to@eslint-react/jsx; component detection now checks wrapper argument positions and unwraps chain expressions; improved render-method detection and qualified type names; narrowed the accepted node types of hook/component detection helpers. (#2075, #2077, #2084, #2099)@eslint-react/var: addedresolveOriginChain,isProvenanceEqual,hasDefault, andresolveAssignmentTargets; expandedresolveObjectTypeandcreateImportLookup, which now exposesisModuleBindinginstead ofhasNamespace; madeisValueEqualidentity-only (useisProvenanceEqualfor structural provenance); and removedresolveBindingTarget/BindingTarget, with binding targets now unwrapped inline. (#2085, #2086, #2088, #2100)@local/samples: hardened the sample rules. (#2107)@local/testkit: added averifyAndFixhelper for testing rules with autofixes. (#2078)eslintto10.14.0,typescript-eslintto8.72.1,nextto16.4.5,vitestto5.1.0,tsdownto0.23.7,nxto24.0.4,oxlintto1.91.0,viteto8.3.6,effectto4.1.2, and thefumadocspackages to16.18.0.react-x/static-componentsorigins; no behavioral changes.@typescript-eslint/typescript-estreedependency from@eslint-react/ast,@eslint-react/core,@eslint-react/var, andeslint-plugin-react-x. (#2080)inlinedDependenciesfield from the monorepo package configuration.New Contributors
Full Changelog: Rel1cx/eslint-react@v5.28.8...v5.30.0
v5.28.8Compare Source
🐞 Fixes
react-x/purity: builtin member resolution no longer follows computed or unknown middle segments (ex:window[fetch],window.myLibrary.fetch), preventing false reports of non-builtin calls. (#2074)🏗️ Internal
@eslint-react/eslint: added dual-purposegetTextfor direct or callback-style source text extraction, replacing repeatedcontext.sourceCode.getTextwrappers across packages. (#2073)Full Changelog: Rel1cx/eslint-react@v5.28.7...v5.28.8
v5.28.7Compare Source
🐞 Fixes
react-x/purity: now reportsDatecalls during render, includingDate(),Date(arg), andwindow.Date(); unlikenew Date(arg),Date(arg)ignores its arguments and always returns the current time. (#2071) Thanks to @aki05162525!🏗️ Internal
effectand@effect/platform-nodeto4.0.6,@tanstack/react-routerto1.170.46,@tanstack/react-startto1.169.4, andeslint-plugin-de-morganto2.3.0.New Contributors
Full Changelog: Rel1cx/eslint-react@v5.28.6...v5.28.7
v5.28.6Compare Source
🐞 Fixes
react-x/set-state-in-effect: the ref-derived parameter exemption now also applies to helpers wrapped inuseCallback(ex:measure(ref.current)wheremeasure = useCallback((el) => { setWidth(el.offsetWidth); }, [])). (#2065) Thanks to @amhunt!react-x/set-state-in-effect: a helper call behind a ref-derived guard (if, ternary, short-circuit, or early return) now exempts thesetStatecalls it reaches, as asetStatewritten in its place would be (ex:if (!anchorRef.current) return; commitPosition(0, true);); call sites are judged individually. (#2065) Thanks to @amhunt!New Contributors
Full Changelog: Rel1cx/eslint-react@v5.28.5...v5.28.6
v5.28.5Compare Source
✨ New
react-dom/no-unsafe-target-blank: the suggested fix now addsrel="noreferrer"instead ofrel="noreferrer noopener", sincenoreferreralready impliesnoopenerper the HTML spec; values combining both tokens remain valid. (#2068)🏗️ Internal
viteto8.3.5andlucide-reactto1.61.0.Full Changelog: Rel1cx/eslint-react@v5.28.4...v5.28.5
v5.28.4Compare Source
🐞 Fixes
Reverted the component-scope-bounded identifier resolution introduced in v5.28.3, including the per-component single-report attribution; class declarations in a component body remain recognized as per-render constructions. (#2062)
Affected rules:
react-x/no-unstable-context-valuereact-x/no-unstable-default-props📝 Documentation
🏗️ Internal
@eslint-react/var: removed theboundaryoption fromresolveandresolveObjectType, and theClassDeclarationresolution inresolveObjectType, following the revert. (#2062)Jsx-prefixed@eslint-react/coreexports to all-capsJSX(ex:JsxConfig→JSXConfig,isJsxLike→isJSXLike). (#2061)fumadocs-mdxto15.4.9.Full Changelog: Rel1cx/eslint-react@v5.28.3...v5.28.4
v5.28.3Compare Source
✨ New
Identifier resolution is now bounded by the enclosing component scope, so render-scoped values referenced from nested callbacks (ex:
items.map((item) => <Context.Provider value={foo}>)) are now detected, values declared outside the component (ex: module-level constants) are treated as stable, and nested components report each value only once, attributed to the innermost component. (#2060)Affected rules:
react-x/no-unstable-context-valuereact-x/no-unstable-default-propsClass declarations (ex:
class Foo {}in a component body) are now recognized as per-render constructions, so using one as a context value or default prop is now reported. (#2060)Affected rules:
react-x/no-unstable-context-valuereact-x/no-unstable-default-props🏗️ Internal
@eslint-react/var:resolveandresolveObjectTypenow accept aboundaryoption that bounds scope-chain traversal to an enclosing component or hook;resolveObjectTypealso resolvesClassDeclarationnodes. (#2060)typescript-eslintto8.72.0,fumadocs-coreandfumadocs-uito16.17.7,fumadocs-mdxto15.4.8,lucide-reactto1.60.0, andtypedoc-plugin-markdownto4.14.1.Full Changelog: Rel1cx/eslint-react@v5.28.2...v5.28.3
v5.28.2Compare Source
🐞 Fixes
:sequence in the YAML frontmatter description of thereact-x/use-memodoc; the rule scaffold script now emits a YAML-safe quoted description so scaffolded rules cannot reintroduce the issue.📝 Documentation
react-debug/jsxrule doc messages with the actual JSON report format.10.0.0in the READMEs and getting-started guides.isAPI/isAPICalldocs and updated the custom rule samples to useis.APICall. (#2059)🏗️ Internal
react-ximmutability rule modules (collect,effects,helpers,origins). (#2056)postcssoverride to8.5.31.Full Changelog: Rel1cx/eslint-react@v5.28.1...v5.28.2
v5.28.1Compare Source
🐞 Fixes
react-dom/no-unknown-property: fixed a false positive where the React camelCase SVG proprenderingIntentwas reported as an unknown property, including on code produced by this rule's own autofix forrendering-intent. (#2055)react-jsx/no-useless-fragment: the auto-fixer no longer unwraps fragments outside JSX whose children are all whitespace (ex:const x = <> </>;orreturn <>\n</>withallowExpressions: false); the previous fix produced syntactically invalid JavaScript such asconst x = ;. These fragments are still reported, just without a fix. (#2055)📝 Documentation
🏗️ Internal
eslintto10.13.0,pnpmto12.14.0,tsl-dxto0.15.0,@effect/language-serviceto0.87.5, andlucide-reactto1.59.0.Full Changelog: Rel1cx/eslint-react@v5.28.0...v5.28.1
v5.28.0Compare Source
✨ New
@eslint-react/eslint-plugin: the general-purpose presets now enable JSX syntax support vialanguageOptions.parserOptions.ecmaFeatures.jsx: true, so you no longer need to configure it yourself. (#2049)Affected presets:
recommendedrecommended-typescriptrecommended-type-checkedstrictstrict-typescriptstrict-type-checked🏗️ Internal
fumadocs-coreandfumadocs-uito16.17.5, andlucide-reactto1.58.0.Full Changelog: Rel1cx/eslint-react@v5.27.4...v5.28.0
v5.27.4Compare Source
🐞 Fixes
@eslint-react/jsx:resolveAttributeValuenow handles a parser-toleratedJSXFragmentin attribute value position (ex:<a href=<></> />), reporting it as kind"element"instead of falling through toundefined; as a result,react-dom/no-missing-iframe-sandboxnow reports<iframe sandbox=<></> />instead of silently skipping it. (#2048)Full Changelog: Rel1cx/eslint-react@v5.27.3...v5.27.4
v5.27.3Compare Source
🐞 Fixes
react-jsx/no-key-after-spread: the fast-path text check now matcheskeyassignments with whitespace around=(ex:<div {...props} key = {id} />or a newline before=), so such elements are no longer silently skipped. (#2043) Thanks to @amir-rahmanii!react-jsx/no-children-prop: achildrenprop alongside nested children content (ex:<div children="x">y</div>,createElement("div", { children: "x" }, "y")) is no longer reported by this rule — that conflict case belongs toreact-jsx/no-children-prop-with-children— removing the unsafe merge suggestion and the duplicate diagnostics. (#2044) Thanks to @amir-rahmanii!react-jsx/no-children-prop-with-children: empty expression containers (ex:{},{/* comment */}) are no longer treated as meaningful children, so<div children="x">{/* comment */}</div>is no longer reported. (#2045) Thanks to @amir-rahmanii!📝 Documentation
Configuration
📅 Schedule: (in timezone Europe/Zurich)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.