chore(deps): update dependency @eslint-react/eslint-plugin to v5

[renovate-with-github-actions]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint-react/eslint-plugin (source)	4.2.3 → 5.20.8

---

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.20.8

🐞 Fixes

• @eslint-react/core: isJsxLike now recognizes JSX wrapped in TypeScript expressions (as, satisfies, type assertions, and non-null assertions) and await expressions.
• @eslint-react/jsx: isFragmentElement now requires the configured jsxFragmentFactory, avoiding an implicit React fragment factory for custom JSX runtimes.

🏗️ Internal

• @eslint-react/jsx: exported the AttributeValue type from the package entry point.
• @eslint-react/var: renamed the AssignmentTarget type to EnclosingAssignmentTarget and inlined getRequireExpressionArguments into its sole consumer.

Full Changelog: Rel1cx/eslint-react@v5.20.6...v5.20.8

v5.20.6

Compare Source

🐞 Fixes

• react-x/globals: for...in/for...of loop targets without a declaration (e.g. for (globalValue of items)) are now collected as writes instead of being missed.
• react-x/immutability: destructuring assignment targets (e.g. ({ a: props.x } = value)) and for...in/for...of loop targets without a declaration are now collected as mutations instead of being missed.
• react-x/purity: builtin alias resolution now preserves the property path, so aliases of impure builtins (const random = Math.random; random(), const { now } = Date; now(), window.Math.random()) are now detected instead of being missed; unknown-global roots are not followed, preventing speculative reports.
• react-x/refs: destructuring assignments, for-in/of loop targets, and delete operations on ref.current are now classified as writes instead of being misreported as reads.
• react-x/refs: refs passed to constructor calls (new Widget(ref)) and tagged templates are now checked for render-time exposure, same as refs passed to plain functions.
• react-x/refs: the mergeRefs exemption for passing refs now survives simple variable aliases (const combine = mergeRefs), resolved position-aware so reassigned aliases lose it again.
• react-x/use-memo: reassignments of outer variables through destructuring patterns and for...in/for...of loop targets inside useMemo callbacks are now reported instead of being missed; property mutation targets remain exempt, matching the React Compiler's StoreContext semantics.

🏗️ Internal

• @eslint-react/var: split resolve into a value-based resolve and a new origin-based resolveOrigin, and updated the consumers in react-web-api and react-x rules accordingly. (#​1964)
• Bumped fumadocs to 16.15.12, fumadocs-mdx to 15.4.3, tsl-dx to 0.13.6, eslint-plugin-de-morgan to 2.2.0, and eslint-plugin-regexp to 3.3.1.

Full Changelog: Rel1cx/eslint-react@v5.20.5...v5.20.6

v5.20.5

Compare Source

🐞 Fixes

• react-web-api/no-leaked-fetch: fixed a false positive where an abort call nested in a callback within the cleanup function (e.g. setTimeout(() => ctrl.abort())) was not recognized, causing a spurious expectedAbortInCleanup report; the abort lookup now finds the nearest enclosing setup/cleanup function instead of requiring the innermost one. (#​1962)

Full Changelog: Rel1cx/eslint-react@v5.20.4...v5.20.5

v5.20.4

Compare Source

🐞 Fixes

• react-web-api/no-leaked-event-listener: listeners that are only added inside the effect cleanup are now reported when the matching removeEventListener is in the setup (reversed setup/cleanup pairing), since a listener attached on unmount is never removed. (#​1961)

🏗️ Internal

• react-jsx and react-web-api rules: unified rule code style and variable naming across the plugins. (#​1960, #​1961)

Full Changelog: Rel1cx/eslint-react@v5.20.3...v5.20.4

v5.20.3

Compare Source

🏗️ Internal

• @eslint-react/ast: replaced getIdentifierAt with the new getMemberChain helper and moved getInnermostCall to its sole consumer in react-x/no-nested-component-definitions. (#​1959)
• react-dom rules: unified rule code style and variable naming across the plugin, and switched no-find-dom-node to import-aware detection via createImportLookup. (#​1958)

Full Changelog: Rel1cx/eslint-react@v5.20.2...v5.20.3

v5.20.2

Compare Source

🐞 Fixes

• Fixed false negatives in the JSX element resolver used by the react-dom rules: polymorphic components written as member expressions (e.g. <motion.div as="button">) were mistaken for host elements, so the polymorphic prop was ignored and these rules skipped them entirely; they are now resolved through the polymorphic prop and checked like the underlying DOM element. String values of the polymorphic prop are also normalized to lowercase, so as="BUTTON" is treated as button. Affected rules:
  • react-dom/no-missing-button-type
  • react-dom/no-missing-iframe-sandbox
  • react-dom/no-unsafe-iframe-sandbox
  • react-dom/no-unsafe-target-blank
  • react-dom/no-void-elements-with-children

🏗️ Internal

• The normalized polymorphicPropName setting type is corrected from string | null to string — it could never be null at runtime — and the unreachable null branch in the JSX element resolver used by the react-dom rules is removed.

Full Changelog: Rel1cx/eslint-react@v5.20.1...v5.20.2

v5.20.1

Compare Source

🐞 Fixes

• react-dom/no-flush-sync: flushSync calls are now detected by tracking react-dom imports directly instead of matching by name, so aliased named imports (e.g. import { flushSync as fs } from "react-dom") and default/namespace member calls (e.g. ReactDOM.flushSync()) are reported, while local functions, object methods, and same-named APIs from other packages (e.g. pino's destination().flushSync()) are no longer misreported. (#​1954, closes #​1943)

🏗️ Internal

• react-dom/no-flush-sync and react-dom/no-find-dom-node: API call checks now use core.isAPICall; core.isJsxLike now uses isCreateElementCall.
• Added Node types reference to all package tsl/tsdown configs.
• Bumped eslint to 10.11.0, eslint-plugin-jsdoc to 64.5.4, eslint-plugin-package-json to 1.9.0, typedoc-plugin-markdown to 4.13.1, @types/node to 26.6.2, pnpm to 12.5.1, and the dprint JSON plugin to 0.24.0.

New Contributors

• changbaebang (@​changbaebang) made their first contribution in #​1954.

Full Changelog: Rel1cx/eslint-react@v5.20.0...v5.20.1

v5.20.0

Compare Source

✨ New

• react-x/immutability: mutations on for...of iterator variables (e.g. for (const item of items) { item.done = true; }), including destructured iterator bindings, are now reported when the iterated collection resolves through its root identifier to a component's props, a state value, or a shallow copy of either, since the iterator variable is bound to each shared element of the original collection. Member-expression collections (for (const item of props.items)) are traced to their root; for...in loops and right sides without a root identifier are not traced. (#​1953, closes #​1764)

🏗️ Internal

• Bumped @types/node to 26.6.1, tsl-dx to 0.13.5, eslint-plugin-jsdoc to 64.5.2, lucide-react to 1.47.0, and pnpm to 12.4.2.

New Contributors

• Michael@​WCD (@​Michael-WhiteCapData) made their first contribution in #​1953.

Full Changelog: Rel1cx/eslint-react@v5.19.1...v5.20.0

v5.19.1

Compare Source

🐞 Fixes

• react-x/immutability: the first parameter of a function is now classified as props only when the function is a confirmed component — one that returns JSX or calls hooks — so mutating the first parameter of a function that merely looks like a component (e.g. an event-handler factory whose returned function never renders and calls no hooks) is no longer reported. (#​1952, closes #​1951)

🏗️ Internal

• react-x/immutability: renamed MUTATING_METHODS/NAVIGATION_HOOKS to KNOWN_MUTATING_METHODS/KNOWN_MUTATING_HOOKS and added precise behavior boundary tests.
• react-x/globals: restructured internals (split into collect, effects, and origins modules) to match the in-progress feat/environment-config implementation; no behavior change.
• Website: awaited the async llms.txt index generation and fixed the website data update step to run before building.
• CI: removed the generated file verification step.
• Bumped typescript-eslint to 8.70.0, react/react-dom to 19.3.0, next to 16.3.5, vite to 8.3.0, effect to 3.22.2, fumadocs to 16.15.10, eslint-plugin-jsdoc to 64.3.9, tailwind-merge to 3.7.0, ansis to 4.4.0, nx to 23.2.1, eslint-plugin-react-refresh to 0.5.6, eslint-plugin-package-json to 1.8.1, @types/node to 26.5.1, @types/react to 19.3.0, @types/react-dom to 19.3.0, and pnpm to 12.4.1.

Full Changelog: Rel1cx/eslint-react@v5.19.0...v5.19.1

v5.19.0

Compare Source

✨ New

• react-x/immutability: direct mutations of props and state are now reported — member assignments, updates, deletions, and mutating method calls are flagged when the mutated value resolves (through variable-declarator aliases) to a component's props, a useState/useReducer state value, or a custom hook matching the additionalStateHooks setting, independent of whether the mutation happens inside a function that reaches a freeze sink. (#​1948, closes #​1941)
• react-x/immutability: added shallow-copy awareness — nested mutations through an object/array literal built by spreading a props or state value (e.g. const copy = { ...state } / const copy = [...state]) are reported, since the nested values are still shared with the original; writes to the copy's own top-level slots are not reported. (#​1948)

Full Changelog: Rel1cx/eslint-react@v5.18.10...v5.19.0

v5.18.10

Compare Source

🐞 Fixes

• The remaining disable-* preset configs in react-x and react-rsc now also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #​1947, see #​1946)

🏗️ Internal

• Website: removed fumadocs-twoslash from serverExternalPackages to fix a prerender error.

Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10

v5.18.9

Compare Source

🏗️ Internal

• Bumped eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0, nx to 23.2.0, dprint to 0.57.4, @types/react-dom to 19.2.7, @eslint/compat to 2.1.1, and @nubjs/nub to 0.8.3.

Full Changelog: Rel1cx/eslint-react@v5.18.8...v5.18.9

v5.18.8

Compare Source

🐞 Fixes

• Preset configs (recommended, strict, etc.) now register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when the plugin is registered manually and a preset is extended at the same time. (#​1947, closes #​1946)

🏗️ Internal

• Re-enabled the import-integrity-lint plugin and patched its path prefix check so sibling directories like examples/preact and examples/preact-compat no longer collide.
• Pinned fast-uri to ^3.1.5 to fix CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7).
• Bumped @effect/language-service to 0.87.2, @effect/platform to 0.97.1, @effect/platform-node to 0.108.1, @nubjs/nub to 0.8.2, @types/node to 26.4.1, dprint to 0.57.0, and lucide-react to 1.39.0.

Full Changelog: Rel1cx/eslint-react@v5.18.7...v5.18.8

v5.18.7

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: no longer misattributes render-phase setState calls to effects when the state updater is passed through a prop function. (#​1945)

🏗️ Internal

• Bumped typescript-eslint to 8.69.0, eslint to 10.9.1, vitest to 4.1.11, @types/node to 26.4.0, @types/react-dom to 19.2.5, eslint-plugin-package-json to 1.8.0, import-integrity-lint to 1.3.0, nx to 23.1.3, publint to 0.3.24, typedoc-plugin-markdown to 4.13.0, and pnpm to 11.25.0.

New Contributors

• Anmol Sharma (@​cyclomati) made their first contribution in #​1945.

Full Changelog: Rel1cx/eslint-react@v5.18.6...v5.18.7

v5.18.6

Compare Source

🏗️ Internal

• @eslint-react/core: added createElement helper APIs (getCreateElementChildrenArguments, getCreateElementProp, getCreateElementPropsObject, getCreateElementTypeArgument, isCreateElementChildrenArgument, and isInsideCreateElementProps) and reused them in react-x/no-children-prop-with-children, react-x/no-children-prop, react-x/no-array-index-key, and react-x/no-nested-component-definitions. (#​1937)

Full Changelog: Rel1cx/eslint-react@v5.18.5...v5.18.6

v5.18.5

Compare Source

📝 Documentation

• react-jsx/no-leaked-dollar: corrected the full rule name in the documentation from @eslint-react/no-leaked-dollar to @eslint-react/jsx-no-leaked-dollar. (#​1935)

🏗️ Internal

• @eslint-react/core: simplified function component detection logic.
• @eslint-react/core: added missing test cases for API exports, nested HOC init paths, named callback exclusion, displayName collection, indirect cleanup callbacks, and custom createElement heuristics.
• Added a script check that verifies rule docs include correct full name sections.
• Bumped typescript-eslint to 8.67.0, eslint-plugin-package-json to 1.7.1, and globals to 17.10.0.

Full Changelog: Rel1cx/eslint-react@v5.18.4...v5.18.5

v5.18.4

Compare Source

🐞 Fixes

• react-x/no-class-component: reports are now located on the class name (falling back to the class token for anonymous classes) instead of the entire class declaration. (#​1934, closes #​1932)

🏗️ Internal

• Bumped eslint to 10.8.1, @types/node to 26.2.0, eslint-plugin-package-json to 1.7.0, eslint-plugin-react-refresh to 0.5.4, fumadocs to 16.14.3, fumadocs-mdx to 15.2.3, lucide-react to 1.31.0, postcss to 8.5.26, and pnpm to 11.21.0.

New Contributors

• Ankit Soni (@​ankitprahladsoni) made their first contribution in #​1934.

Full Changelog: Rel1cx/eslint-react@v5.18.3...v5.18.4

v5.18.3

Compare Source

🐞 Fixes

• react-x/no-nested-component-definitions: narrowed the with* HOC detection in the fallback name resolution to well-known wrappers only (react-router v5's withRouter, Formik's withFormik, and recompose's withProps, withState, withHandlers, and withLifecycle) — custom HOCs following the with* naming convention are no longer treated as component wrappers. (#​1929)

🏗️ Internal

• Bumped typescript-eslint to 8.66.0 and next to 16.3.0.

Full Changelog: Rel1cx/eslint-react@v5.18.2...v5.18.3

v5.18.2

Compare Source

🐞 Fixes

• react-x/no-nested-component-definitions: fixed a regression where nested components wrapped in useCallback (e.g. const C = useCallback(() => <div />, []);) were no longer reported — the rule now resolves the component name through well-known component wrappers (memo, forwardRef, useCallback, observer, react-redux's connect, Relay's create*Container helpers, Apollo's graphql, and with* HOCs, including curried forms like connect(...)(Component)) up to the enclosing variable declarator, and no longer misreports array method callbacks (flatMap, forEach, reduce, etc.) in list rendering patterns. (#​1928, closes #​1927)

🏗️ Internal

• Bumped effect to 3.22.1, eslint-plugin-jsdoc to 63.3.3, textlint to 15.8.0, js-yaml to 4.3.1, axios to 1.19.0, nx to 23.1.1, vite to 8.2.0, @vitejs/plugin-react to 6.0.5, fumadocs to 16.14.0, fumadocs-mdx to 15.2.2, preact to 10.29.8, globals to 17.9.0, lucide-react to 1.28.0, @types/react to 19.2.18, @types/react-dom to 19.2.4, and pnpm to 11.20.0.

Full Changelog: Rel1cx/eslint-react@v5.18.1...v5.18.2

v5.18.1

Compare Source

🐞 Fixes

• The remaining disable-* preset configs in react-x and react-rsc now also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #​1947, see #​1946)

🏗️ Internal

• Website: removed fumadocs-twoslash from serverExternalPackages to fix a prerender error.

Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10

v5.18.0

Compare Source

✨ New

• @eslint-react/core: added isUseRefLikeCall and a new additionalRefHooks setting for declaring custom ref-creating hooks; the following rules now recognize them: (#​1922, closes #​1904)
  • react-x/refs
  • react-x/immutability
  • react-x/set-state-in-effect
  • react-naming-convention/ref-name
  • react-debug/is-from-ref

📝 Documentation

• Updated rule docs to match current rule sources. (#​1920)

🏗️ Internal

• @local/testkit: simplified internals.
• react-x: extracted a shared createImplicitPropListener helper used by no-implicit-children, no-implicit-key, and no-implicit-ref. (#​1923)
• Bumped tsdown to 0.22.13, typescript-eslint to 8.65.0, eslint-plugin-jsdoc to 63.2.0, import-integrity-lint to 1.2.0, react to 19.2.8, next to 16.2.11, and postcss to 8.5.21.
• Replaced vite-node with nub for running workspace scripts. (#​1919)
• Unified JSDoc comment style of exported APIs in @eslint-react/ast and @eslint-react/core.

Full Changelog: Rel1cx/eslint-react@v5.17.3...v5.18.0

v5.17.3

Compare Source

🏗️ Internal

• @eslint-react/ast: reworked the Extract API — replaced getRootIdentifier with the position-based getIdentifierAt, renamed getStaticPropertyName to getPropertyName (with a min/max effort option), and added findProperty for finding properties in nested object expressions; added Check.isConditional for matching conditional expressions and control flow statements. (#​1918)
• Bumped eslint-plugin-jsdoc to 63.1.0, expect-type to 1.4.0, @preact/preset-vite to 2.10.6, and pnpm to 11.15.0.

Full Changelog: Rel1cx/eslint-react@v5.17.2...v5.17.3

v5.17.2

Compare Source

📝 Documentation

• @eslint-react/kit: added a README with quick start and API overview.

🏗️ Internal

• @eslint-react/core: migrated JsxDetectionHint and related JSX detection helpers from @eslint-react/jsx. (#​1913)
• @eslint-react/jsx: consolidated helpers into focused attribute, children, element, and text modules. (#​1914)
• @eslint-react/var: renamed computeObjectType to resolveObjectType.
• @local/testkit: extracted shared test helpers into a new local package. (#​1915)
• Bumped tsdown to 0.22.9, eslint-plugin-jsdoc to 63.0.14, and pnpm to 11.13.1.

Full Changelog: Rel1cx/eslint-react@v5.17.1...v5.17.2

v5.17.1

Compare Source

🏗️ Internal

• react-jsx/no-key-after-spread: reworked the attribute scan to a pipeline style using dropWhile and not from @local/eff, Check.is from @eslint-react/ast, and the new isAttribute helper from @eslint-react/jsx. (#​1912)
• @eslint-react/jsx: added isAttribute for matching JSX attributes by name.
• @local/eff: added dropWhile and takeWhile.
• Bumped tsdown to 0.22.8, tsl-dx to 0.13.3, import-integrity-lint to 1.1.4, fumadocs to 16.11.5, and fumadocs-mdx to 15.2.0.

Full Changelog: Rel1cx/eslint-react@v5.17.0...v5.17.1

v5.17.0

Compare Source

🐞 Fixes

• react-jsx/no-leaked-dollar: the intentional-$ exemption (e.g. <div>${price}</div>) is no longer defeated by surrounding whitespace or empty siblings — a lone $ before a single expression is now allowed whenever all other siblings are non-substantive. (#​1911)
• react-jsx/no-leaked-semicolon: consecutive leaked semicolons (e.g. ;;) at the start of a JSX text node are now detected. (#​1911)

📝 Documentation

• react-x/no-unnecessary-use-prefix: reorganized the rule examples.

🏗️ Internal

• react-jsx: extracted the shared find-create-element-children-prop and remove-jsx-attribute rule helpers, removed dead Literal visitors from no-comment-textnodes and no-leaked-semicolon, simplified the no-key-after-spread attribute scan, and hoisted no-useless-fragment detection and fix helpers to module level. (#​1911)
• @local/eff: synced the Function module with effect and added missing @category tags.
• Unified JSDoc comment style across packages.

Full Changelog: Rel1cx/eslint-react@v5.16.1...v5.17.0

v5.16.1

Compare Source

🐞 Fixes

• react-jsx/no-children-prop: React.createElement calls whose props argument is wrapped in a TypeScript type assertion (e.g. { children: "x" } as Props) are now reported; computed property keys written as template literals (e.g. { [children]: "x" }) are now recognized as the children prop; fixed a false positive where a computed identifier key in a createElement props object (e.g. { [propName]: "Children" }) was treated as the static children prop; the suggestion fix now escapes JSX-sensitive characters (<, >, {, }, &) when moving a string children prop value into element content. (#​1910)
• react-jsx/no-children-prop-with-children: same createElement edge-case fixes as no-children-prop. (#​1910)
• react-jsx/no-useless-fragment: allowExpressions: false now only flags fragments with a single expression child, matching the option's documented behavior, instead of flagging any fragment inside a JSX element; fragments with spread attributes (e.g. <Fragment {...props}>) are no longer auto-fixed; the auto-fixer now removes leading indentation when collapsing whitespace-only fragments. (#​1910)
• react-jsx/no-leaked-dollar: $ character references (&#​36;, $) are no longer treated as leaked dollar signs; only a literal $ in the source is reported. (#​1910)
• react-jsx/no-leaked-semicolon: leaked semicolons followed by spaces or tabs before a newline, including CRLF line endings, are now detected. (#​1910)
• react-x/immutability: added useHistory to known navigation hooks, so navigation methods such as .push() are not treated as in-place mutations inside frozen callbacks.

🏗️ Internal

• @eslint-react/ast: added Extract.getStaticPropertyName for resolving static property names from object properties. (#​1910)

Full Changelog: Rel1cx/eslint-react@v5.16.0...v5.16.1

v5.16.0

Compare Source

✨ New

• @eslint-react/core: added support for hook calls written as tagged template literals. (#​1909)

  const x = useMotionValue(100);
  const transform = useMotionTemplate`transform(${x}px)`;
  //                ^^^ tagged template literal hook call

• @eslint-react/jsx: findAttribute now resolves nested spread identifiers and nested object expression spreads. (#​1908)

🏗️ Internal

• Added tests and per-rule changelogs for tagged template literal hook calls. (#​1909)

Full Changelog: Rel1cx/eslint-react@v5.15.0...v5.16.0

v5.15.0

Compare Source

📝 Documentation

• Added a FAQ entry on improving analyzer accuracy to the website. (#​1907)
• Fixed inconsistencies and omissions in internal documentation.

🏗️ Internal

• Bumped typescript-eslint to 8.64.0, nx to 23.1.0, eslint-plugin-package-json to 1.6.0, and pnpm to 11.13.0.
• Enabled strictBooleanExpressions in TSL and synchronized sample rule configurations. (#​1907)
• Removed the website-specific changelog file.
• Switched CI workflows to use pnpm/action-setup instead of installing pnpm globally via npm.

Full Changelog: Rel1cx/eslint-react@v5.14.10...v5.15.0

v5.14.10

Compare Source

🐞 Fixes

• @eslint-react/ast: Extract.getCalleeName now returns null for computed member expressions (e.g. obj[foo](), obj["foo"](), obj[foo]()) instead of the property name, so callers don't treat dynamically chosen methods as static method names. (#​1906)

🏗️ Internal

• Added unit tests for Extract.getCalleeName.

Full Changelog: Rel1cx/eslint-react@v5.14.9...v5.14.10

v5.14.9

Compare Source

🐞 Fixes

• @eslint-react/ast: removed Extract.getPropertyName and added Extract.getCalleeName for simpler callee name resolution. (#​1905)
• Rules that match calls by method name no longer treat computed string-literal property access as a static match (e.g. obj["foo"]() is no longer resolved to "foo"). This avoids relying on the runtime value of computed keys and aligns callee matching across the codebase. Affected rules:
  • react-dom/no-dangerously-set-innerhtml
  • react-dom/no-find-dom-node
  • react-dom/no-flush-sync
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
  • react-x/globals
  • react-x/immutability
• core.isJsxLike: no longer treats React['createElement'] calls as JSX-like, since the callee is accessed through a computed member expression.

🏗️ Internal

• Simplified callee name checks across core, react-dom, react-web-api, and react-x rules using Extract.getCalleeName.
• Bumped @effect/platform, effect, fumadocs-core, fumadocs-mdx, fumadocs-ui, postcss, pnpm, and tsdown.

Full Changelog: Rel1cx/eslint-react@v5.14.8...v5.14.9

v5.14.8

Compare Source

📝 Documentation

• react-x: refreshed the React Compiler diff reports. (#​1903)

🏗️ Internal

• react-x: moved the purity and refs resolvers into lib.ts. (#​1902)
• Bumped tsdown, postcss, and fumadocs.

Full Changelog: Rel1cx/eslint-react@v5.14.7...v5.14.8

v5.14.7

Compare Source

🐞 Fixes

• react-x/immutability: ignore navigation hook methods (e.g. useNavigate, useNavigation) as mutations. (#​1901)

🏗️ Internal

• Refreshed pnpm lockfile.

Full Changelog: Rel1cx/eslint-react@v5.14.6...v5.14.7

v5.14.6

Compare Source

🐞 Fixes

• react-x/immutability: ignore useRouter() navigation methods (e.g. .push()) as mutations when they appear inside frozen callbacks; aliases created through variable declarators are also recognized. (#​1898)

🏗️ Internal

• Added Check.isExpression to @eslint-react/ast along with unit tests.
• Bumped eslint, nx, dompurify, and pnpm.
• Restored standalone quality workflows.
• Simplified react-x/immutability analysis helpers by sharing initializer provenance checks for useRef() and useRouter() and using AST parent traversal for function-boundary detection.
• Started running CI tests on Node.js 26.

Full Changelog: Rel1cx/eslint-react@v5.14.5...v5.14.6

v5.14.5

Compare Source

📝 Documentation

• Temporarily disabled the Bluesky embed on the community page to avoid API rate limits.

🏗️ Internal

• Consolidated the check:configs and check:docs scripts into a single check:rules script.

Full Changelog: Rel1cx/eslint-react@v5.14.4...v5.14.5

v5.14.2

Compare Source

🐞 Fixes

• react-x/globals: added detection for global writes through destructuring assignments and property deletion with delete. (#​1896)
• react-x/globals: propagated render-time global mutation effects through directly called helpers and stable local aliases. (#​1896)

🏗️ Internal

• Expanded behavior-boundary coverage for react-debug component and source detection, react-naming-convention naming rules, and react-x/immutability React Compiler fixtures.
• Strengthened documentation verification and added formatting, configuration, architecture, MDX, website type, and production build checks to CI.
• Gated publishing on the check, test, and workflow security jobs, including for application, example, and configuration changes.

Full Changelog: Rel1cx/eslint-react@v5.14.1...v5.14.2

v5.14.1

Compare Source

🐞 Fixes

• @eslint-react/ast: Extract.getCalleeName now returns null for computed member expressions (e.g. obj[foo](), obj["foo"](), obj[foo]()) instead of the property name, so callers don't treat dynamically chosen methods as static method names. (#​1906)

🏗️ Internal

• Added unit tests for Extract.getCalleeName.

Full Changelog: Rel1cx/eslint-react@v5.14.9...v5.14.10

v5.14.0

Compare Source

✨ New

• react-x/refs: added render-reachability support for function declarations, IIFEs, synchronous array callbacks, and render-time callbacks passed to useMemo and useReducer. (#​1895)
• react-x/refs: added lazy-initialization support for explicit undefined guards and for null guards enclosing additional nested conditions. (#​1895)

🐞 Fixes

• react-x/refs: reworked render-time call analysis as an unbounded fixed-point propagation, removing the previous 50-iteration cap. (#​1895)
• react-x/refs: tightened inverted lazy-initialization handling so the non-null branch must unconditionally return or throw. (#​1895)
• react-x/refs: stopped treating !ref.current as a null guard because initialized refs may contain falsy values. (#​1895)

🏗️ Internal

• react-x/refs: refactored ref aliases, function bindings, JSX refs, and duplicate initialization tracking to use scoped ESLint variable identities and position-aware binding events instead of file-wide identifier names. (#​1895)
• Added behavior-boundary tests for react-x/immutability and documented them in the spec diff report.
• Updated build scripts.
• Bumped @effect/language-service to ^0.86.5.
• Bumped preact to ^10.29.7.
• Bumped vite to ^8.1.4 in example apps.
• Bumped dprint JSON plugin to ^0.23.0.

Full Changelog: Rel1cx/eslint-react@v5.13.2...v5.14.0

v5.13.2

Compare Source

🐞 Fixes

• react-x/immutability: fixed false positive on ref.current write inside useEffect. (#​1894)

🏗️ Internal

• Bumped @types/node to ^26.1.1.
• Bumped preact to ^10.29.6.
• Bumped tsdown to ^0.22.4.

Full Changelog: Rel1cx/eslint-react@v5.13.1...v5.13.2

v5.13.1

Compare Source

🐞 Fixes

• react-x/refs: aligned error message wording for readDuringRender, writeDuringRender, and refPassedToFunction with the React Compiler specification.

Full Changelog: Rel1cx/eslint-react@v5.13.0...v5.13.1

v5.13.0

Compare Source

✨ New

• react-x/refs now detects nested property writes on a ref's value (e.g. ref.current.inner = value), which are now reported as writeDuringRender instead of being misclassified as a read.
• react-x/refs now tracks functions bound to (and called through) simple object-member-expression targets (e.g. object.foo = () => ref.current; object.foo();), closing a gap in the render-reachability analysis that previously only covered plain variable bindings.
• react-x/refs now detects ref.current accesses inside the lazy initializer function passed directly as useState's first argument, since it runs synchronously during the initial render unlike other hook-callback arguments.
• react-x/refs now exempts calls to a function named render (e.g. props.render(ref), a common render-prop pattern) from the refPassedToFunction diagnostic, alongside the existing mergeRefs/hook exemptions.

🐞 Fixes

• Improved react-x/refs lazy-init guard-block detection so it is direction-aware: inside the branch of an if (ref.current == null)-style guard that is guaranteed to see ref.current as null, only a direct write is treated as the (single) valid initialization; reads or values passed to a function there are still reported.

🏗️ Internal

• Refactored react-x/refs internals, replacing isRefCurrentNullCheck with getRefCurrentNullCheckBranch in lib.ts.
• Upgraded fumadocs packages and preact.
• Cleaned up redundant code in the react-debug/jsx rule.

Full Changelog: Rel1cx/eslint-react@v5.12.2...v5.13.0

v5.12.1

Compare Source

📝 Documentation

• Fixed react-x/immutability rule description in docs.

🏗️ Internal

• Cleaned up redundant code in some rules.

Full Changelog: Rel1cx/eslint-react@v5.12.0...v5.12.1

v5.12.0

Compare Source

✨ New

• Reworked react-x/immutability to align with the React Compiler's ValidateNoFreezingKnownMutableFunctions validation pass: it now detects functions that (transitively) mutate a captured local variable and reports them when passed as a JSX prop, passed as a hook argument, or returned from a hook. (#​1891)

📝 Documentation

• Cleaned up the rule relations table.

🏗️ Internal

• Bumped typescript-eslint packages to ^8.63.0.
• Bumped eslint-plugin-perfectionist to ^5.10.0.

Full Changelog: Rel1cx/eslint-react@v5.11.3...v5.12.0

v5.11.3

Compare Source

🐞 Fixes

• Fixed FunctionComponentDetectionHint.DoNotIncludeFunctionDefinedAsClassProperty checking for object Property nodes instead of class PropertyDefinition nodes, so functions defined as class fields are now correctly excluded when the hint is set. (#​1890)

🏗️ Internal

• Renamed fix helpers and formatted MessageID types.
• Inlined local string constants in rule implementations.
• Bumped eslint-plugin-jsdoc, typedoc, undici and pnpm.

Full Changelog: Rel1cx/eslint-react@v5.11.2...v5.11.3

v5.11.2

Compare Source

📝 Documentation

• Updated rule documentation for React introspection APIs (react-x/no-children-count, react-x/no-children-for-each, react-x/no-children-map, react-x/no-children-only, react-x/no-children-to-array, and react-x/no-clone-element) with clearer guidance on why child introspection creates fragile component coupling and links to Astryx's no-react-introspection rule. (#​1889)
• Updated the function-component collector sequence diagram on the website.
• Updated THIRD-PARTY-LICENSE file.

Full Changelog: Rel1cx/eslint-react@v5.11.0...v5.11.2

v5.11.0

Compare Source

✨ New

• react-x/refs now detects ref mutations/reads inside helper functions that are called (directly, or through a simple variable alias) during render, closing a gap where any nested function was previously treated as a safe boundary regardless of whether it was actually invoked during render.
• react-x/refs now reports a second guarded ref initialization: only a single if (ref.current == null) { ref.current = ... } guarded initialization is allowed per ref per component/hook, and a second guarded write (in the same or a different if block) is reported as duplicateRefInit.
• react-x/refs now supports .current accesses whose base is a member expression that looks like a ref (e.g. props.ref.current), not just a plain identifier.

🏗️ Internal

• Added unit tests for packages/ast/src/check.ts.
• Bumped @effect/language-service to ^0.86.4 and preact to ^10.29.4.
• Refactored react-x/static-components internals without changing behavior: findVariableForIdentifier now delegates to @typescript-eslint/utils/ast-utils's findVariable instead of a hand-rolled scope-chain walk, resolveDynamicValue was split into findDynamicCreationSite and findReassignmentCreationSite, and render-boundary/JSX-candidate handling was extracted into dedicated helpers.
• Unified the signatures of Check.isDirective and Check.isIdentifier in @eslint-react/ast: both now take the node as the first argument and an optional name as the second, replacing the previous curried (name) => (node) => boolean shape. Removed Check.isStringLiteral; use ts-pattern's isMatching or an inline type guard instead.

Full Changelog: Rel1cx/eslint-react@v5.10.4...v5.11.0

v5.10.4

Compare Source

🐞 Fixes

• Fixed react-x/no-misused-capture-owner-stack not recognizing process.env.NODE_ENV checks wrapped in TypeScript type expressions such as (process.env as any).NODE_ENV. (#​1813)
• Fixed Extract.getFullyQualifiedName to unwrap TSAsExpression, TSTypeAssertion, TSNonNullExpression, and ChainExpression before resolving names. This improves name resolution for rules that identify React APIs or collect component/hook names through type-wrapped expressions.

Full Changelog: Rel1cx/eslint-react@v5.10.3...v5.10.4

v5.10.3

Compare Source

🏗️ Internal

• Bumped typescript-eslint packages to ^8.62.1.
• Bumped @effect/language-service to ^0.86.3.
• Bumped undici and undici-types to ^8.6.0.
• Updated the @eslint-react/eslint-plugin package description.

Full Changelog: Rel1cx/eslint-react@v5.10.2...v5.10.3

v5.10.2

Compare Source

🐞 Fixes

• Fixed an issue where several rules treated computed identifier keys in spread props (e.g. <div {...{ [key]: value }} />) as static prop names. The actual property name is the runtime value of the variable; computed string literal keys are still recognized. Affected rules:
  • react-x/no-missing-key
  • react-jsx/no-children-prop-with-children
  • react-jsx/no-children-prop
  • react-jsx/no-useless-fragment
  • react-dom/no-dangerously-set-innerhtml-with-children
  • react-dom/no-dangerously-set-innerhtml
  • react-dom/no-missing-button-type
  • react-dom/no-missing-iframe-sandbox
  • react-dom/no-string-style-prop
  • react-dom/no-unsafe-iframe-sandbox
  • react-dom/no-unsafe-target-blank
  • react-dom/no-void-elements-with-children
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
• Fixed react-x/unsupported-syntax to no longer report IIFEs in JSX. This makes the rule consistent with the upstream react-hooks/unsupported-syntax and removes the iife message.

✨ New

• react-x/unsupported-syntax now detects eval calls via globalThis.eval, globalThis["eval"], and type assertions like (globalThis as any).eval.

🏗️ Internal

• Added an optional resolve parameter to Extract.getPropertyName so callers can control how identifier and private identifier property names are resolved.
• Added unit tests for Extract.getPropertyName.

Full Changelog: Rel1cx/eslint-react@v5.10.1...v5.10.2

v5.10.1

Compare Source

🐞 Fixes

• Added the missing static-components rule to disable-conflict-eslint-plugin-react-hooks, closes #​1884.

📝 Documentation

• Rewrote the noCircularEffect recipe sample to use @eslint-react/kit collectors and simpleTraverse, and updated the recipe overview accordingly.
• Removed the under construction brand assets page from the website.

🏗️ Internal

• Bumped typescript-eslint, @types/node, vite, and tailwindcss.
• Bumped fumadocs, lucide-react, and postcss in the website.

Full Changelog: Rel1cx/eslint-react@v5.10.0...v5.10.1

v5.10.0

Compare Source

📝 Documentation

• Added status emoji markers to recipe and rule documentation code examples (#​1882).
• Fixed the v5.7.2 changelog entry for react-x/no-unused-state.
• Updated the community projects list.

🏗️ Internal

• Bumped eslint to ^10.6.0.
• Bumped js-yaml workspace override to ^4.3.0.

Full Changelog: Rel1cx/eslint-react@v5.9.5...v5.10.0

v5.9.5

Compare Source

🐞 Fixes

• Compare.isEqual now recognizes structurally identical CallExpression nodes. This fixes false positives in the following rules when the compared target (event target, controller, or observed element) is derived from a function call such as window.matchMedia('…') or getEl():
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
  • react-web-api/no-leaked-resize-observer
  • react-web-api/no-leaked-intersection-observer

Full Changelog: Rel1cx/eslint-react@v5.9.4...v5.9.5

v5.9.4

Compare Source

🐞 Fixes

• The following rules now detect member expression calls made with computed string property access (e.g. obj["foo"]()):
  • react-x/no-array-index-key
  • react-x/no-duplicate-key
  • react-x/no-unnecessary-use-prefix
  • react-x/set-state-in-effect
  • `react-x/set-state-i

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.