Skip to main content
813 releases · 37 packages

Changelog

Every release across the ecosystem, newest first. Each entry links to the pull request that shipped it, and every published version carries the exact command to install it.

813 releases · page 1 of 41

eslint-plugin-node-security 5.7.0

  • Featuredetect-non-literal-fs-filename: new opt-in option reportWholeProcessValues (default false). Set to true, the rule reports a process.argv / process.env value used as the whole path, e.g. fs.readFileSync(process.argv[2]). That matches eslint-plugin-security's rule of the same name, so a drop-in for it loses no finding. The default is unchanged: whoever sets argv or the environment already chooses which files the process opens.

npm install --save-dev eslint-plugin-node-security@5.7.0

eslint-plugin-typeorm-security 1.0.1

  • Fixconfig-shape ownership covers the config, not the whole file
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.3

npm install --save-dev eslint-plugin-typeorm-security@1.0.1

eslint-plugin-knex-security 1.0.1

  • Fixconfig-shape ownership covers the config, not the whole file
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.3

npm install --save-dev eslint-plugin-knex-security@1.0.1

eslint-devkit 1.20.3

  • Fixconfig-shape ownership covers the config, not the whole file

npm install --save-dev @interlace/eslint-devkit@1.20.3

eslint-plugin-sequelize-security 1.0.1

  • Fixconfig-shape ownership covers the config, not the whole file
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.3

npm install --save-dev eslint-plugin-sequelize-security@1.0.1

eslint-plugin-postgresql-security 2.6.4

  • Fixno-hardcoded-credentials skips test files
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.3

npm install --save-dev eslint-plugin-postgresql-security@2.6.4

eslint-plugin-mongodb-security 9.1.6

  • Fixa Schema imported from another library is not Mongoose's
  • Fixrequire-schema-validation reads quoted option keys
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.3

npm install --save-dev eslint-plugin-mongodb-security@9.1.6

eslint-plugin-mcp-sdk-security 1.0.1

  • FixBound the parsed-module caches behind cross-file value following.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.2

npm install --save-dev eslint-plugin-mcp-sdk-security@1.0.1

eslint-plugin-postgresql-security 2.6.3

  • FixBound the parsed-module caches behind cross-file value following.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.2

npm install --save-dev eslint-plugin-postgresql-security@2.6.3

eslint-devkit 1.20.2

  • FixBound the parsed-module caches behind cross-file value following.

npm install --save-dev @interlace/eslint-devkit@1.20.2

eslint-plugin-jwt-security 3.5.3

  • FixBound the parsed-module caches behind cross-file value following.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.2

npm install --save-dev eslint-plugin-jwt-security@3.5.3

eslint-plugin-secure-coding 5.4.17

  • Fixwrong verdicts surfaced by Stryker mutation testing (batch 1)

npm install --save-dev eslint-plugin-secure-coding@5.4.17

eslint-plugin-browser-security 2.1.11

  • Fixwrong verdicts surfaced by Stryker mutation testing (batch 2)

npm install --save-dev eslint-plugin-browser-security@2.1.11

eslint-plugin-browser-security 2.1.10

  • Fixwrong verdicts surfaced by Stryker mutation testing (batch 1)

npm install --save-dev eslint-plugin-browser-security@2.1.10

eslint-devkit 1.20.1

  • FixresolveModuleBinding resolves a static computed destructuring key: const { ['promises']: fsp } = require('node:fs') names fs.promises like { promises: fsp } does. A runtime key ({ [k]: v }) still abstains. node-security's no-arbitrary-file-access, no-static-iv and no-unbounded-decompression now report that spelling; cli-floor drops its local copy of the same resolution.

npm install --save-dev @interlace/eslint-devkit@1.20.1

eslint-plugin-node-security 5.6.12

  • FixresolveModuleBinding resolves a static computed destructuring key: const { ['promises']: fsp } = require('node:fs') names fs.promises like { promises: fsp } does. A runtime key ({ [k]: v }) still abstains. node-security's no-arbitrary-file-access, no-static-iv and no-unbounded-decompression now report that spelling; cli-floor drops its local copy of the same resolution.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.20.1

npm install --save-dev eslint-plugin-node-security@5.6.12

eslint-plugin-node-security 5.6.11

  • Fixclose the FP/FN policy gaps left open by the 2026-10-18 audit

npm install --save-dev eslint-plugin-node-security@5.6.11

eslint-plugin-mongodb-security 9.1.5

  • Fixfive rules follow the 2026-10 owner decisions on what to report

npm install --save-dev eslint-plugin-mongodb-security@9.1.5

eslint-plugin-jwt-security 3.5.2

  • Fixrequire-expiration enforces maxExpirationSeconds; option docs say what is read

npm install --save-dev eslint-plugin-jwt-security@3.5.2

eslint-plugin-postgresql-security 2.6.2

  • Fixno-unsafe-query policy gaps decided after the 2026-10-18 audit
  • Fixleave postgres URLs in TypeORM configs to typeorm-security

npm install --save-dev eslint-plugin-postgresql-security@2.6.2