react-doctor

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 0.9.18

   12 October 2026
   Record the GitHub Action clean-comment preference in anonymized scan telemetry and document the workflow input.

   Patch Changes

   • Record the GitHub Action clean-comment preference in anonymized scan telemetry and document the workflow input.

   • Match API Platform subscription IDs to the provider's resource-and-IDs unsubscribe contract.

   • Do not infer React hooks from relative helper imports in Angular component classes. Continue to check React and React ecosystem imports.

   • Do not classify a local state transition as a prop-driven adjustment when its only prop dependencies are called notifications. Keep checks for prop values used in guards, results, or reset dependencies.

   • Do not recommend lazy state initialization for cheap primitive toString calls, including numeric React Native Dimensions values. Keep warnings for unproven receivers and nested expensive calls.

   • Report inaccessible parent click actions when descendant handlers stop keyboard-generated clicks from reaching them.

   • Match listener cleanup when both branches of conditional options have the same capture value. Keep warnings for differing capture values, changed options, and missing cleanup.

     Recognize exhaustive listener-removal loops extracted into a synchronous helper when the cleanup only invokes that helper.

   • Add the opt-in --scope contextual reporting mode. Selected rules report existing findings when their owning function, JSX element, or file changes. Other rules retain line filtering. Support deletion-only edits, staged scans, untracked files, and separate result-cache entries while preserving existing scope defaults and diagnostic locations.

   • Preserve count-based placeholder identity through a local array before mapping wrappers.

   • Preserve numeric placeholder-loop identity through local key aliases, including constant-prefix keys. Continue reporting index aliases for loops over array data.

   • Keep browser reads in helpers defined inside React effects out of server-render diagnostics. Preserve warnings for render callbacks and shadowed effect functions.

   • Do not classify zero-argument effect notifications as state payloads sent to a parent. Continue to report callbacks that pass local state.

   • Install and manage GitHub Actions workflows at the repository root when invoked from a nested package or linked worktree.

   • Exclude .cloudflare build output directory from source file discovery. Cloudflare's cf CLI stores compiled Worker bundles and cache state there, mirroring the existing .wrangler exclusion.

   • Honor explicit rules settings of "warn" or "error" for ported rules when customRulesOnly is enabled. Current and legacy rule keys both work. Other ported rules and the React Compiler plugin stay disabled, and project requirements and tag exclusions still apply.

   • fix(effect-needs-cleanup): accept Promise timer that resets its own handle in callback

     Fixes #1882. The rule no longer flags a timer created in a Promise callback when the timer's own callback resets the handle to null or undefined. This is safe because the timer has already fired when the reset happens, so no live handle is lost.

   • Fix --staged refusing to scan in linked git worktrees when GIT_DIR is set. Clear the inherited GIT_DIR environment variable in the staged divergence check so git status resolves paths correctly, matching the fix for scoped scans in #1516.

   • Use constant Boolean initializers before treating numeric-looking JSX guard names as numbers. Preserve warnings for mutable bindings, destructuring defaults, and numeric values.

   • Require root route error boundaries only for data routers, since declarative useRoutes configurations do not use data-router error handling.

   • Tha

2. 0.9.17

   5 October 2026
   Fix false new findings in --baseline and --scope changed after formatting or editing existing flagged code. Compare finding counts per file and rule, then use fingerprints, messages, and Git line shifts to identify added findings. Skip location matching when counts do not increase. Apply portable config filters to saved baseline findings and reject reports with missing or incompatible source-dependent filter settings; regenerate those base reports with the current version and settings.

   Patch Changes

   • Fix false new findings in --baseline and --scope changed after formatting or editing existing flagged code. Compare finding counts per file and rule, then use fingerprints, messages, and Git line shifts to identify added findings. Skip location matching when counts do not increase. Apply portable config filters to saved baseline findings and reject reports with missing or incompatible source-dependent filter settings; regenerate those base reports with the current version and settings.

   • Updated dependencies []:

     • oxlint-plugin-react-doctor@0.9.17

3. 0.9.16

   4 October 2026
   Fix changed-scope scans to compare findings for uncommitted changes and use flagged source spans instead of whole lines. Match duplicate findings by count and limit cross-file matches to Git renames.Add --baseline <report.json> to reuse a saved scan. JSON reports now include stable finding fingerprints, the source revision, the comparison source, and the number of matched base findings. Gates and summary counts use only new findings.

   Patch Changes

   • Fix changed-scope scans to compare findings for uncommitted changes and use flagged source spans instead of whole lines. Match duplicate findings by count and limit cross-file matches to Git renames.

     Add --baseline <report.json> to reuse a saved scan. JSON reports now include stable finding fingerprints, the source revision, the comparison source, and the number of matched base findings. Gates and summary counts use only new findings.

   • Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

   • Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

   • Updated dependencies:

     • oxlint-plugin-react-doctor@0.9.16

4. 0.9.14

   12 September 2026
   Upgrade oxlint to 1.81 and oxc-parser to 0.148.

   Patch Changes

   • Upgrade oxlint to 1.81 and oxc-parser to 0.148.

   • Detect React Compiler when @vitejs/plugin-react is called with an enabled compiler option (react({ compiler: true }) or react({ compiler: { ... } })), including aliased, namespace, and CommonJS forms of the default export. compiler: false and unrelated objects with a compiler property stay undetected, so rules disabled under React Compiler now switch off for these Vite projects.

   • Skip source files that Git still tracks but that no longer exist in the working tree (for example a deleted root index.html in a TanStack Start app) instead of failing the scan with ENOENT while preparing lint sources.

   • Exclude every discovered nested workspace project from an ancestor scan, whether or not it was selected. Scanning only the root of a monorepo previously pulled a nested app's files into the root scan and judged them against the root's framework and React Compiler settings, so a compiler-enabled Expo app inside a Vite workspace reported compiler-gated rules like prefer-module-scope-pure-function that its own config suppresses. A nested project's files are now only checked by that project's scan, matching what selecting both projects already did.

   • Keep --scope changed in baseline mode when the change set deletes a source file. A deleted file that cannot be read or linted at the base commit no longer degrades the whole comparison to a plain diff; only an unreadable or unlinted base file that still exists at head does, since that is the only gap that could surface a pre-existing finding as new.

   • Speed up large-repository scans: reuse warm oxlint worker processes across projects, overlap project discovery with linting, and trim rule hot paths (2.4–5.5x faster wall-clock on the large-repo corpus).

   • Stop reporting local service .use() methods as React hooks. Preserve diagnostics for React namespace calls, including aliases and CommonJS imports.

     Only recommend setAnimationLoop when a recursive animation frame callback renders through a known Three.js renderer. Leave independent 2D canvas and DOM loops alone, including files that also import Three.js.

   • security

     Retire 33 low-value rule IDs while keeping them registered as silent compatibility entries. Make 26 cleanup, migration, performance, and security-review rules opt-in. Existing rule configurations still load; default scans no longer report these recommendations as defects.

   • Skip TypeScript files without JSX support (.ts, .mts, and .cts, including declarations) before applying JSX duplication analysis budgets. Large generated type files no longer make the maintainability scan incomplete or consume its source-file budget. JSX-capable files retain the existing limits.

   • Increase runtime trace finalization timeout from 10 to 60 seconds to handle large traces from longer recording sessions

   • Updated dependencies:

     • oxlint-plugin-react-doctor@0.9.14

5. 0.9.13

   2 September 2026
   Add bippy as a runtime dependency.

   Patch Changes

   • Add bippy as a runtime dependency.

   • Preserve plugin settings when React Doctor adopts an existing lint config.

   • Upgrade the Oxc parser and Oxlint runtime while preserving hard failures for broken JS plugins.

   • Use pnpm's strict dependency layout and declare the runtime dependencies that the CLI imports directly.

   • Keep the interactive score header intact in narrow split views and invalidate locally stale scan results when rule implementations change.

     Report standalone Three.js render loops that use requestAnimationFrame instead of the renderer-managed setAnimationLoop API.

     Include standalone Three.js, supported React framework, Remotion, and React Three Fiber ecosystem packages in automatic workspace project discovery.

   • Clean leading npm messages from GitHub Action JSON reports before later steps read them.

   • Stop multi-project scans from recommending GitHub Actions when the root workflow is already configured.

   • Fix rn-no-raw-text false positives in components that return only direct <fbt> or <fbs> elements.

   • Prevent rn-no-raw-text reports for <fbt> content passed through verified React Native text wrappers.

   • Show an npm-native recovery command when an incomplete npx installation is missing Ajv meta-schema files.

   • Fix js-set-map-lookups false positives for substring checks on values returned by the global String constructor.

   • Run test-noise rules in ambiguous product-named directories such as tools, demo, and migrations when they are below a recognized application source root. Explicit test surfaces and root-level tooling or example directories remain excluded.

   • Make generated GitHub workflows explain how to pin the action to an immutable commit SHA.

   • Improve repeated effect analysis and deeply nested JSX performance, preserve derived-state detection through transparent TypeScript wrappers, and upgrade Oxc parser and linter dependencies.

   • Run installed Claude Code and Cursor hooks once at the end of an agent turn, include untracked files in the changed-file scan, and migrate existing per-tool React Doctor hooks automatically.

   • Accept source file paths as positional CLI arguments.

   • Make React cleanup a first-class part of React Doctor with diagnostics for complex React functions and repeated JSX composition. Keep whole-project unused file, export, type, dependency, and import-cycle analysis as explicit opt-in rules while removing the separate Deslop packages, experimental language server, and IDE extensions.

   • Add an interactive URL scan and /performance skill that record Chrome DevTools traces, flash live component render outlines, and return agent-readable React performance context.

   • Add component-composition and correctness rules for shadcn, Radix UI, Base UI, React Aria, TanStack Table, and TanStack Virtual behind six new project capabilities (shadcn from components.json; the rest from their package dependencies). Dialog surfaces that render no title part and carry no accessible name are reported across all three libraries (shadcn DialogContent/SheetContent/AlertDialogContent/DrawerContent, Radix Dialog.Content and AlertDialog.Content, Base UI Dialog.Popup and AlertDialog.Popup). Icon-sized shadcn Buttons with no accessible name, shadcn FormItem fields wrapping a FormControl without a FormLabel, and Base UI Field.Root controls without a Field.Label are reported as unlabeled. Raw Input, Textarea, and Button controls placed directly inside shadcn InputGroup are reported in favor of its InputGroupInput, InputGroupTextarea, and InputGroupAddon parts, and presence-only data-[selected]: / data-[disabled]: Tailwind variants on command items are reported because cmdk renders both attributes as "true" or "false". TanStack Form submit handlers that call the form's handleSubmit without event.preventDefault() are reported because the browser still performs a native full-page submission. Tabs triggers provably inside the

6. 0.9.12

   13 August 2026
   Restore the option to copy the full fix prompt from the interactive report.

   Patch Changes

   • Restore the option to copy the full fix prompt from the interactive report.

   • Ignore Git-ignored configuration files when checking staged scan snapshot divergence.

   • Upgrade the Oxc toolchain to the latest releases.

   • Recognize every detected framework and library capability as a supported scan target, including plain Three.js projects and React-backed frameworks without direct React declarations, and anchor remote-installer diagnostics on the executable download command.

   • Avoid crashing when oxlint emits a code-less diagnostic while scanning Astro files.

   • Make react-doctor/no-multi-comp faithfully enforce Oxlint's one-component-per-file contract, and preserve React Doctor's lower-noise default behavior under react-doctor/no-multi-component-file.

   • Reduce the CLI dependency graph by replacing narrow code-frame and terminal-symbol helpers with local implementations.

   • Updated dependencies:

     • oxlint-plugin-react-doctor@0.9.12

     • deslop-js@0.9.12

7. 0.9.11

   9 August 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • oxlint-plugin-react-doctor@0.9.11

     • deslop-js@0.9.11

8. 0.9.10

   9 August 2026
   Send traces and metrics to Axiom instead of Sentry. Sentry keeps crash reporting,

   Patch Changes

   • Send traces and metrics to Axiom instead of Sentry. Sentry keeps crash reporting, where its source-map symbolication, issue grouping, and quotable event ids have no Axiom equivalent — so error reports are unchanged, and the JSON report's sentryEventId field keeps its meaning.

     Two user-visible changes: --debug now prints the run's Axiom trace id (crash reports carry the same id as a tag, so one id resolves in both backends), and REACT_DOCTOR_NO_TELEMETRY is now honored by the CLI as well as the language server. --no-score and --no-telemetry are unchanged and still disable everything.

   • Updated dependencies []:

     • oxlint-plugin-react-doctor@0.9.10

     • deslop-js@0.9.10

9. 0.9.9

   8 August 2026
   Updated dependencies:

   Patch Changes

   • Updated dependencies:

     • oxlint-plugin-react-doctor@0.9.9

     • deslop-js@0.9.9

10. 0.9.8

    8 August 2026
    Harden scan orchestration and cache persistence, modernize the Effect runtime, simplify package boundaries and analyzers, share cycle and suppression analysis, keep workflow paths inside the repository, and remove unused internals.

    Patch Changes

    • Harden scan orchestration and cache persistence, modernize the Effect runtime, simplify package boundaries and analyzers, share cycle and suppression analysis, keep workflow paths inside the repository, and remove unused internals.

    • Updated dependencies:

      • oxlint-plugin-react-doctor@0.9.8

      • deslop-js@0.9.8