oxlint-plugin-react-doctor

Patch Changes

• Match API Platform subscription IDs to the provider's resource-and-IDs unsubscribe contract.

• Do not infer React hooks from relative helper imports in Angular component classes. Continue to check React and React ecosystem imports.

• Do not classify a local state transition as a prop-driven adjustment when its only prop dependencies are called notifications. Keep checks for prop values used in guards, results, or reset dependencies.

• Do not recommend lazy state initialization for cheap primitive toString calls, including numeric React Native Dimensions values. Keep warnings for unproven receivers and nested expensive calls.

• Report inaccessible parent click actions when descendant handlers stop keyboard-generated clicks from reaching them.

• Match listener cleanup when both branches of conditional options have the same capture value. Keep warnings for differing capture values, changed options, and missing cleanup.

  Recognize exhaustive listener-removal loops extracted into a synchronous helper when the cleanup only invokes that helper.

• Add the opt-in --scope contextual reporting mode. Selected rules report existing findings when their owning function, JSX element, or file changes. Other rules retain line filtering. Support deletion-only edits, staged scans, untracked files, and separate result-cache entries while preserving existing scope defaults and diagnostic locations.

• Preserve count-based placeholder identity through a local array before mapping wrappers.

• Preserve numeric placeholder-loop identity through local key aliases, including constant-prefix keys. Continue reporting index aliases for loops over array data.

• Keep browser reads in helpers defined inside React effects out of server-render diagnostics. Preserve warnings for render callbacks and shadowed effect functions.

• Do not classify zero-argument effect notifications as state payloads sent to a parent. Continue to report callbacks that pass local state.

• ESLint adapter now respects rule requires gates. Rules that require capabilities the project doesn't have (like ssr or react-router:8) are now correctly skipped when capabilities are declared, matching the CLI behavior. Fixes false errors on dependency bumps when using the ESLint adapter with explicit capabilities.

• Fix async-defer-await warnings on compound guards that compare function parameters with mutable state after an await. Keep these checks after the await so they can detect stale responses. Fixes #1895.

• effect-needs-cleanup: accept Promise timer that resets its own handle in callback

  Fixes #1882. The rule no longer flags a timer created in a Promise callback when the timer's own callback resets the handle to null or undefined. This is safe because the timer has already fired when the reset happens, so no live handle is lost.

• Recognize stable functions rendered as JSX components in the same file, including components that return imported exhaustive matchers. Preserve warnings for mixed utility exports, shadowed JSX names, and reassigned bindings.

• Accept observer cleanup after tuple loops and a single animation-frame retry chain when cleanup disconnects the observer and cancels the pending frame. Require observer cleanup on every path and keep target-specific unobserve() checks.

• Recognize JSX handlers passed to stable local dispatchers with an explicit React return type. Keep reporting callback registries with unknown or non-rendering return types.

• Use constant Boolean initializers before treating numeric-looking JSX guard names as numbers. Preserve warnings for mutable bindings, destructuring defaults, and numeric values.

• Require root route error boundaries only for data routers, since declarative useRoutes configurations do not use data-router error handling.

• Recognize legacy React.createClass components so render callbacks retain their instance this instead of being treated as function components.

• Accept direct anchor children owned by an imported Next Link component, including the legacy Link child API.

• Allow state updater callbacks to reassign their local parameter while still reporting writes to prior-state properties and captured values.

• Respect the installed or declared React Native version before reporting removed AsyncStorage and WebView exports. Reuse package-version resolution and track manifests for diagnostic cache invalidation.

• deprecated

  Stop reporting the core SafeAreaView export as removed. It remains implemented even where it is deprecated.

• Restrict App Router path checks to the project app or src/app directory so nested Pages Router paths do not trigger App Router rules.

• Recognize optional-chain and TypeScript-wrapped response status guards before fetch body reads.

• Avoid treating promise-returning query APIs as array find calls. Keep reports for known arrays and known predicates.

• Recognize static import and require paths wrapped in TypeScript assertions, while retaining warnings for dynamic paths inside those wrappers.

• Preserve state used by a render-phase throw, including Suspense promises and errors, instead of recommending a ref.

• Recognize either global timer-clear API as releasing a matching timeout or interval handle, including exhaustive retained timer collections.

• Allow author-provided accessible names on the tooltip role. Preserve naming restrictions on roles that prohibit them and warnings for unsupported tooltip states.

• Skip missing image sizes advice when next/image explicitly disables optimization, since that path does not generate responsive source candidates.

• A native wrapping or associated label can give a control its accessible name through its title. Recognize that name while keeping warnings for empty labels, unrelated labels, and custom wrappers.

• A returned scalar formatter can use JSX only when its scalar input is null. React component props do not follow that path. Exclude these formatters while keeping warnings when JSX is reachable for normal props, a reassigned parameter, or another return path.

• Avoid missing-key warnings for JSX arrays returned as data by module-level object factories with no local use. Keep warnings for component and render methods, local factory uses, and arrays rendered directly as children.

• A class render helper can receive indices from a numeric Array.from placeholder list. Accept these keys only when every visible use proves that placeholder source and the helper does not escape. Keep warnings for mutable data lists and unknown callers.

• A focusable action revealed by group hover also becomes visible when it receives keyboard focus. Accept its own focus or focus-visible opacity reveal when that reveal covers the hover scope. Keep warnings for hidden, invisible, non-focusable, and mismatched-scope controls.

• An updater may copy each state element before a local helper changes those fresh copies. Track that ownership through helper parameters and for-of loops. Keep warnings for shared objects, nested shared fields, replaced elements, and aliases that add shared values.

• An icon button with a screen-reader-only label is not a text button for visual padding. Ignore hidden label text, but keep visible text and not-sr-only overrides in the check.

• A stable local factory that returns a component or forwardRef component is a valid component export. Inspect the factory return paths and keep warnings for mixed returns, reassigned factories, and unknown factory outputs.

• Report array-index keys passed as React cloneElement overrides, including imported aliases and static computed keys.

• Allow updater callbacks to mutate a local container when both branches of its conditional initializer create a fresh container. Continue reporting mutations of prior state and shared collections.

• Ignore unreachable fresh fallbacks inside a controlled-state selection when the value type excludes null.

• Use the properties read by a resolved local helper when checking object argument dependencies.

• Accept positional keys for immutable arrays of identical literal placeholders. Keep checks for distinct values, records, spreads, and mutated arrays.

• Detect fresh cleanup callbacks through local imported wrappers of DOM event listener APIs.

• Track subscriptions pushed into arrays that already contain other owned handles.

• Do not classify paired Layer.extend lifecycle methods as React event handlers.

• Recognize deterministic lazy ref initialization through an immediately preceding local assignment. Check the resolved value for non-deterministic initialization hidden by aliases.

• Avoid parent-notification warnings when a local memoized loader only reads props and updates local state. Keep warnings for actual parent callback calls, including asynchronous and direct callback wrappers.

• Recognize named functions passed to React memo and forwardRef as render scopes in rules-of-hooks, including nonstandard internal names. Keep conditional and nested hook checks active.

• Recognize object URL cleanup returned on every path after URL creation, including effects that return early before they allocate a URL.

• Prevent boolean-toggle cleanup analysis from crashing when an effect omits its dependency array. Preserve the existing toggle diagnostic and functional-update exemption.

• Follow guarded observer setup helpers invoked by effect-owned listeners.

• Recognize loading-set resets paired with cancellation of owned request-map entries.

• Recognize react_ujs useContext and useContexts as component registration methods rather than React hooks. Support stable CommonJS and ES module bindings.

• Do not classify an imported use-prefixed function as a React hook when its resolved implementation only returns static data.

• Accept positional keys for plain text rows from string splitting and Boolean filtering. Keep checks for stateful children, unknown split methods, and changed token arrays.

• Recognize portal readiness state after DOM container discovery.

• Accept index keys for identical map slots that ignore the item and collection values and use the index only as a key. Keep warnings when output depends on an item or an indexed record.

• Recognize fresh const aliases of effect cancellation guards after await. Keep warnings when a snapshot was captured before suspension or another await can make it stale.

• Recognize primitive cumulative labels in stateless index-keyed rows.

• Accept positional keys for Array.from slots whose count comes from a property or expression. Keep checks when the index reads external records or the source has record entries.

• Detect unstable nested components created inside React forwardRef and memo render callbacks, including import aliases and TypeScript wrappers.

• Recognize request ownership predicates and loading resets on proven view, close, and unmount paths. Keep warnings when an invalidated request can leave the loading flag set.

• Keep React hook ordering checks out of files that use a proven non-React JSX runtime. Mixed React files retain the checks.

• Recognize object URLs retained in React refs when replacement and unmount both revoke the owned value.

• Recognize clearing the state handle of an object URL after revocation.

• Follow synchronous cleanup helpers that invoke a retained listener disposer on unmount.

• Do not treat directly returned component functions as JSX rendered by their factory. Keep detecting direct component calls and executed render callbacks.

• Avoid cleanup warnings for local functions and state setters named setInterval or setTimeout. Require a global timer or a matching Node timers import before classifying these calls as timer allocations.

• Recognize the stable send result of XState React v1 useService when its interpreter is a module singleton.

Patch Changes

• Avoid sequential-await warnings when local helpers read the same cache entry or delegate to the same imported operation with matching stable arguments. Follow bounded imported helpers to guarded, module-owned Map/WeakMap caches keyed by unchanged function parameters, with dependency fingerprints for cache invalidation. Preserve warnings for distinct imported operations sharing an input, and bound the diagnostic's parallelization advice.

  Keep diagnostics when a helper computes a cache key with an unknown call or property read. These values can change between calls.

• Recognize convergent last-item equality guards in no-self-updating-effect, including literal tail replacements and appends with tail-preserving deferred trims.

• Avoid no-derived-state false positives when custom hooks return draft state setters through immutable aliases.

• Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

• Fix cache/navigation binding resolution and unsafe mutation parallelization (issue #1810)

  • server-cache-with-object-literal: Properly resolve React.cache imports through aliases and check all argument positions for fresh objects/arrays. Shadowed or non-React cache functions no longer trigger false positives.

  • nextjs-no-redirect-in-try-catch: Recognize Next.js unstable_rethrow(error) as a valid error forwarding pattern, suppressing the diagnostic when the caught error is correctly rethrown.

  • server-sequential-independent-await and async-parallel: Detect mutating HTTP requests (POST, PUT, PATCH, DELETE) and preserve their ordering, preventing incorrect parallelization suggestions for operations that must run sequentially.

• Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

• Resolve local Hook-shaped object methods before applying React Hook namespace heuristics, including inspection dispatchers and useEffectEvent.
  Preserve Hook diagnostics for unresolved invoked callbacks and bound Hook aliases, while resolving proven local callbacks at each call site.

• Avoid display-name diagnostics for data factories that return descriptors containing JSX icons.

  Preserve anonymous-component diagnostics for proven array maps and React useMemo callbacks that return render output.

• Recognize effect-owned timer replacements that clear the previous handle before assignment and release the final timer during teardown.

• Respect Solid JSX applicability in handler naming, DOM property, and module-scope helper advice while preserving React diagnostics in mixed-runtime files.

Patch Changes

• Upgrade oxlint to 1.81 and oxc-parser to 0.148.

• Avoid effect-needs-cleanup diagnostics for owned chained timers, guarded post-await timers, and listeners released through an abort handler.

• Fix an async-defer-await false positive on exact live and isLive liveness guards without exempting unrelated names that only contain the same text.

• Fix false positive in nextjs-no-side-effect-in-get-handler when locally-built Headers object is passed to a same-file helper that mutates it.

  The rule now transfers locally-created response object safety through the exact same-file helper call. Calls that pass external state to the same helper remain reportable.

  Fixes #1757

• Speed up large-repository scans: reuse warm oxlint worker processes across projects, overlap project discovery with linting, and trim rule hot paths (2.4–5.5x faster wall-clock on the large-repo corpus).

• Stop reporting local service .use() methods as React hooks. Preserve diagnostics for React namespace calls, including aliases and CommonJS imports.

  Only recommend setAnimationLoop when a recursive animation frame callback renders through a known Three.js renderer. Leave independent 2D canvas and DOM loops alone, including files that also import Three.js.

• respect "use no memo" directive in react-compiler-no-manual-memoization rule

  When a function or module has a React Compiler opt-out directive, the compiler skips optimization, so manual memoization can still be necessary. The rule now respects "use no memo", its "use no forget" alias, and local components passed to memo.

  Fixes #1749

• Exempt magic-link delivery mutations from query-mutation-missing-invalidation while keeping generic send, notification, and email mutations reportable.

• Retire 33 low-value rule IDs while keeping them registered as silent compatibility entries. Make 26 cleanup, migration, performance, and security-review rules opt-in. Existing rule configurations still load; default scans no longer report these recommendations as defects.

Patch Changes

• Upgrade the Oxc parser and Oxlint runtime while preserving hard failures for broken JS plugins.

• Keep ESLint presets on React Doctor's curated low-noise rule behavior and honor configured capabilities when a rule declares disabledWhen, including suppressing manual-memoization diagnostics for React Compiler projects.

• Keep the interactive score header intact in narrow split views and invalidate locally stale scan results when rule implementations change.

  Report standalone Three.js render loops that use requestAnimationFrame instead of the renderer-managed setAnimationLoop API.

  Include standalone Three.js, supported React framework, Remotion, and React Three Fiber ecosystem packages in automatic workspace project discovery.

• Avoid artifact-env-leak false positives from vendored source-map content and intentionally public token names.

• Fix rn-no-raw-text false positives in components that return only direct <fbt> or <fbs> elements.

• Classify fragment returns that contain only translation elements and static text as text-producing components.

• Prevent rn-no-raw-text reports for <fbt> content passed through verified React Native text wrappers.

• Prevent stack overflows while resolving deeply nested local function references. React Doctor now stops following a reference chain after a bounded number of steps instead of aborting the lint scan.

• Fix a rerender-state-only-in-handlers false positive when a member hook consumes state.

• Avoid false positives for loading resets in finally, animation duration utilities, and string message substring searches.

• Fix js-set-map-lookups false positives for substring checks on values returned by the global String constructor.

• Run test-noise rules in ambiguous product-named directories such as tools, demo, and migrations when they are below a recognized application source root. Explicit test surfaces and root-level tooling or example directories remain excluded.

• Ignore browser-global names in TypeScript-only positions so interface and type property keys are not reported as unsafe module-scope runtime access.

• Use the nearest workspace root when detecting Fast Refresh ownership so nested checkouts keep the correct rule coverage.

• Stop recommending flatMap as a guaranteed performance improvement for .map().filter(Boolean). The rule now suggests a single-pass reduce or for...of rewrite only for measured hot paths.

• Improve repeated effect analysis and deeply nested JSX performance, preserve derived-state detection through transparent TypeScript wrappers, and upgrade Oxc parser and linter dependencies.

• Make React cleanup a first-class part of React Doctor with diagnostics for complex React functions and repeated JSX composition. Keep whole-project unused file, export, type, dependency, and import-cycle analysis as explicit opt-in rules while removing the separate Deslop packages, experimental language server, and IDE extensions.

• Add component-composition and correctness rules for shadcn, Radix UI, Base UI, React Aria, TanStack Table, and TanStack Virtual behind six new project capabilities (shadcn from components.json; the rest from their package dependencies). Dialog surfaces that render no title part and carry no accessible name are reported across all three libraries (shadcn DialogContent/SheetContent/AlertDialogContent/DrawerContent, Radix Dialog.Content and AlertDialog.Content, Base UI Dialog.Popup and AlertDialog.Popup). Icon-sized shadcn Buttons with no accessible name, shadcn FormItem fields wrapping a FormControl without a FormLabel, and Base UI Field.Root controls without a Field.Label are reported as unlabeled. Raw Input, Textarea, and Button controls placed directly inside shadcn InputGroup are reported in favor of its InputGroupInput, InputGroupTextarea, and InputGroupAddon parts, and presence-only data-[selected]: / data-[disabled]: Tailwind variants on command items are reported because cmdk renders both attributes as "true" or "false". TanStack Form submit handlers that call the form's handleSubmit without event.preventDefault() are reported because the browser still performs a native full-page submission. Tabs triggers provably inside the root without the list part are reported for shadcn, Radix, and Base UI; the existing shadcn-tabs-trigger-requires-list rule is now enabled by default for shadcn projects through the capability gate and no longer risks false positives on extracted trigger subcomponents. React Aria Dialogs without a Heading or aria-label are reported as unnamed. TanStack Table data/columns options that provably get a new array identity every render (inline literals, render-scoped const arrays, fresh ?? fallbacks, inline .filter()/.map() transforms) are reported for rebuilding row and column models each render and looping auto-reset features, and elements measured by TanStack Virtual's measureElement without a data-index attribute are reported because the virtualizer drops the measurement.

• Avoid cleanup false positives for callback refs, observer iteration, and effect-local stored disposers.

Patch Changes

• Reduce false positives across Three.js, JavaScript performance, security, and async rules by recognizing stable lifecycle guards, intentional sequencing, non-escaping values, renderer aliases, and safe DOM data flows.

• Make every ported React and accessibility rule match its pinned upstream test contract while preserving React Doctor's lower-noise curated defaults.

• Trace hydration decisions through imported browser helpers, report passive media-capability branch flicker, preserve committed-DOM state synchronization through local helpers, and exclude test-only dependency stubs from production diagnostics.

• Upgrade the Oxc toolchain to the latest releases.

• Recognize every detected framework and library capability as a supported scan target, including plain Three.js projects and React-backed frameworks without direct React declarations, and anchor remote-installer diagnostics on the executable download command.

• Add precise Three.js and React Three Fiber diagnostics for missing custom-geometry UVs, normal-mapped geometry without normals, unlit PBR materials, and strongly metallic materials without environment lighting.

• Add comprehensive React Three Fiber, Three.js, WebGPU, GLSL, postprocessing, and GPU-computation diagnostics covering scene and camera setup, renderer lifecycle, resize behavior, loading, animation, controls, materials, uniforms, textures, lighting, shadows, render targets, buffer uploads, instancing, cleanup, and GPU-oriented performance patterns.

• Make react-doctor/no-multi-comp faithfully enforce Oxlint's one-component-per-file contract, and preserve React Doctor's lower-noise default behavior under react-doctor/no-multi-component-file.

Patch Changes

• Reduce default rule scan overhead by gating framework-specific visitors and skipping expensive analyses until their prerequisite syntax is present.

• Recognize callable listener disposers, exhaustive cleanup of mapped subscription collections, and guarded timers owned by effect-local helpers in effect-needs-cleanup.

• Avoid reporting callbacks passed to destructured Zustand imperative store methods as fresh-reference selectors.

• Preserve resource-lifecycle resets, controlled state fallbacks, and prop-originated synchronization without hiding genuine child-owned state handoffs.

• Fix benchmark-confirmed false positives in dependency, key, fetch, serialization, and effect rules, and detect request-scoped async ownership races and render-controlling mount state initialization.

Patch Changes

• Avoid treating a resource failure latch as an all-state prop reset.

• Limit missing button type diagnostics to form-owned buttons and report broken literal fragment links.

• Add an opt-in diagnostic for effects that let externally controlled selection changes move focus.

• Detect local state chains isolated from an effect's external resource cleanup path.

• Add an opt-in diagnostic for stale-request guards backed by passively synchronized owner refs.

• Detect stale async responses that clear error state owned by a newer request.

• Add Three.js and React Three Fiber rules that recommend instanced meshes for repeated meshes sharing geometry and material.

• Keep large workspace scans responsive by reducing TUI redraws, cooperatively enumerating source files, excluding source explicitly marked generated or vendored by repository attributes, precomputing workspace project file counts in one pass, reusing source listings for configured ignores, reusing repository cache fingerprints across workspace projects, running root-owned dead-code analysis once instead of again for every child project, sizing that shared pass from the full workspace tree, balancing lint batches, detecting cross-file renderer capabilities once before workers start, skipping unnecessary whole-project source indexes, capping automatic lint parallelism before its contention cliff, removing redundant binding-marker work from semantic analysis, and lowering lint subprocess priority so foreground applications remain responsive. Remove implicit lint and whole-scan deadlines while enforcing explicitly configured deadlines on active subprocesses, preserve partial security findings without marking disabled passes incomplete, list queued projects skipped at the deadline, show every incomplete-result warning, retry scores after a contended workspace pool settles, terminate every subprocess and clear the active TUI on cancellation or quit, suppress bundled Browserslist maintenance warnings, memoize module-resolution filesystem probes, path-compress config lookup walks, bound recursive helper analysis, index repeated class-member lookups, and visit each alias binding once. Project selection now uses a disposable terminal screen while bounded scan progress and the final report stay inline, workspace indexing is labeled immediately, scan progress uses a smoother spinner, long score fallbacks wrap within the terminal, incomplete analysis is no longer mislabeled as a score API outage, --no-cache disables every cache layer for the run, precomputed project counts remain accurate across discovery-cache hits, fixed command literals no longer trigger imported-metadata security findings, and extensionless module paths passed to dynamic loaders no longer produce unused-file findings.

• Recognize callable listener disposers, exhaustive cleanup of mapped subscription collections, and guarded timers owned by effect-local helpers in effect-needs-cleanup.

• Make effect cleanup analysis scale linearly across files with many retained timer and listener callbacks.

• Ignore TypeScript type-only identifiers when tracing data passed to parent callbacks.

• Apply React Native content-container checks to LegendList consistently with FlashList.

• Report symbol-only controls that lack a meaningful accessible name.

• Recognize callable subscription disposers, exhaustive disposer collections, and guarded effect-local timer cleanup paths.

• Avoid reporting rerender-lazy-ref-init for empty built-in registry constructors.

• Recognize image layout space reserved by imported CSS dimensions, aspect ratios, and definite parent sizing.

• Ignore resource-keyed media failure latch resets in no-adjust-state-on-prop-change.

• Recognize observer reconnect helpers that release each replacement and the latest observer on cleanup.

Patch Changes

• Detect Astro projects, run template design rules through Astro's compiler with source-mapped diagnostics, and keep Astro's default sharp image service out of unused-dependency findings.

• Recognize default-exported React HoC feature components in no-multi-comp.

• Detect index keys in dynamic React child arrays and data-indexed while loops.

• Suppress js-combine-iterations for statically small fixed arrays

• Detect props that overwrite defaults with undefined before reaching JSX attributes.

• Recognize exported Vite defineConfig callback configs when proving Fast Refresh integrations.

• Avoid reporting local effect helpers as live-state parent notifications when they only call prop-derived transforms or zero-argument lifecycle callbacks.

• Recognize compound and local stale-request guards after awaited effect work while rejecting mutated guards and conditional cleanup evidence.

• Recognize matching boolean capture modes when prefer-use-effect-event verifies paired event listener registration and cleanup.

• Recognize terminal promise catch blocks that recover effect state.

• Avoid loading-reset false positives when a finally reset is guarded by the current async operation or a cleanup-backed mounted ref.

• Recognize guarded Map member keys, nullable finder projections, and maximum-derived array lookups in no-non-null-assertion-on-maybe-undefined-result.

• Recognize callback-ref values and measured DOM state paired with mount flags as post-mount state sources.

• Resolve React useCallback-wrapped pointer-down handlers when checking pointer capture cancellation.

• Stop reporting user-facing API key alerts and structured parser token boundaries as hardcoded client secrets.

• Skip root test-prefixed JavaScript and TypeScript files in production security scans.

• Detect URLSearchParams location mirrors in prefer-use-sync-external-store.

• Reduce scan startup time and workspace contention by loading lightweight rule
  metadata, sharing Oxlint subprocess capacity across projects, and reusing
  semantic and filesystem analysis within each scan. Keep cached diagnostics
  correct when imported browser guards, Next.js manifests, nested project
  targets, or TypeScript path configuration change, and ignore explicitly
  disabled inline CSS animations and transitions in Remotion rules.

• server-auth-actions: skip credential-establishing actions via SDK detection

  The server-auth-actions rule now correctly skips server actions that perform credential-establishing operations (signup, signin, OTP verification, password reset) by detecting calls to auth SDK methods like supabase.auth.signUp(), auth.signInWithPassword(), and auth.verifyOtp(). These actions legitimately run for anonymous callers, so requiring authentication would be incorrect.

  This resolves the documented false positive where credential-establishing endpoints were incorrectly flagged as unauthenticated privileged operations.

  Closes #1538

• Upgrade the Oxc toolchain to the latest releases.

• Avoid reporting conditional wrappers whose click handler only forwards focus to a queried control.

• Avoid no-event-handler false positives for deferred ref focus and state-backed collection ref synchronization.

• Detect unescaped dynamic folder path segments in anchored RegExp patterns.

• Avoid reporting static wrappers whose click handler only forwards focus to a nested control.

• Avoid reporting parent callbacks used to synchronize external subscriptions, layout measurements, and imperative controllers.

• Keep no-create-ref-in-function-component quiet when createRef() values are initialized once behind a stable useRef().current guard.

• Detect browser-dependent hydration branches through render-time helpers, mutable aliases, state initializers, and compiled React output.

• Report zero-argument constructor allocations passed directly to useRef.

• Recognize stable previous/current transitions and exact convergence guards in componentDidUpdate.

• Recognize predictable guarded ref initialization while preserving diagnostics for render-dependent and externally mutable values.

• Detect external collection mutations, setter callbacks, persistence calls, and async update calls inside React state updater functions.

• Keep exhaustive-deps quiet for unconfigured custom Hooks without dependency arrays.

• Avoid reporting Intl formatters in plain utilities when their locale or options come from caller input.

• Require exported custom Hook callbacks to have same-file component prop provenance before reporting render-time callback invocations.

• Recognize source-proven listener and timer teardown across stable aliases, local loops, and callback-ref replacement.

• Avoid reporting parent notifications that forward an immutable snapshot from an imported external-subscription hook after also copying it into a comparison ref.

• Avoid flagging intentional JSON normalization at Next.js Pages Router props boundaries.

• Preserve sequential awaits when ordered operations mutate and observe one shared receiver.

• Detect hoistable helpers inside compiled forwardRef component wrappers.

• Recognize ref-owned one-shot timer reschedules with helper-based replacement and unmount cleanup.

• Recognize exact-client Supabase removeChannel and removeAllChannels cleanup for fluent Realtime subscriptions.

• Avoid reporting intentional uncontrolled state selected as the fallback to a controlled prop.

• Treat custom Hook calls as opaque in no-effect-with-fresh-deps.

• Avoid no-flush-sync false positives for Softmaple Awareness integrations that synchronize editor selections with committed text.

• Avoid reporting intentionally sequential async traversal that appends await-derived values to an ordered output array.

• Avoid array-lookup reports for fresh array transforms and generated rest helpers with only small fixed omission lists.

Patch Changes

• Detect TanStack Start root documents that omit client scripts and unsafe filesystem containment checks that compare resolved paths with a bare string prefix.

• Add opt-in diagnostics for auto-scrolling content, decorative radial effects, pulsing status dots, repeated container copy, and shape-assembled illustrations. Improve existing design and copy diagnostics with stricter visibility, cascade, motion, contrast, and structural analysis.

• Improve diagnostic precision for effect cleanup, derived state, parent callbacks, deferred state transitions, and KaTeX HTML rendering.

• Add parsed GLSL diagnostics for Three.js shader correctness, stage and uniform contracts, undefined constant operations, and GPU performance pitfalls. Detect per-frame material recompilation and variant-dependent onBeforeCompile patches without program cache keys.

• Avoid jsx-no-undef false positives for identifiers confirmed by an active unplugin-auto-import configuration and its current generated ESLint globals.

• Add React Native diagnostics for Reanimated 4 migrations, Gorhom Bottom Sheet integration, Expo platform tree shaking, Babel plugin order, and Android release shrinking. Expand recycler support to current Legend List and animated FlashList entrypoints, follow proven same-file renderer indirection, tighten heterogeneous recycler detection, and refresh outdated React Native recommendations.