search

mozilla / eslint-plugin-no-unsanitized

Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike
Mozilla Public License 2.0
231 stars 38 forks source link

The 4.1.0 version contains a BC break #252

Closed stof closed 1 month ago

stof commented 1 month ago

Extending plugin:no-unsanitized/DOM in .eslintrc does not work anymore when upgrading from 4.0.2 to 4.1.0 (which is supposed to be backward compatible according to semver)

mozfreddyb commented 1 month ago

More details would be cool and preferred instead of me looking into your CI failure logs (which are public, but hey...).

stof commented 1 month ago

Apparently, https://github.com/mozilla/eslint-plugin-no-unsanitized/commit/d9704a7e402c7f95e31b4f97a8c192afdcfe1994 mentions Rename configurations as an intended change of the commit. But this is a BC break.

@mozfreddyb my .eslintrc.json file was looking like that when using 4.0.2 (omitting the configuration of rules as it is not relevant in that case):

{
    "root": true,
    "extends": [
        "standard",
        "plugin:eslint-comments/recommended",
        "plugin:no-unsanitized/DOM",
        "plugin:unicorn/recommended"
    ],
    "rules": {}
}

when updating to 4.1.0, eslint reported an error saying that it could not find the configuration plugin:no-unsanitized/DOM. To make it work, I had to change that to plugin:no-unsanitized/recommended-legacy.

mozfreddyb commented 1 month ago

I see. Thank you. I'm pretty sure that's my mistake. It looks like I should have bumped the version to 5.x instead of 4.1.0 then, when including the that commit.

Sorry this is breaking for you. Can you rewrite your eslint config to fix this on your end? I currently do not have the cycles to undo the change in a 4.x bugfix release in the near future.

stof commented 1 month ago

My own config is already fixed (the PR referencing this issue in StackExchange is not my project, but another impacted project).

I might be great to make a bugfix release adding DOM as an alias for recommended-legacy config. And the release notes for 4.1.0 should at least be updated to mention that.

stof commented 1 month ago

@mozfreddyb I submitted a PR with a BC layer