# Changelog

## 3.1.0

- Added the `bn-safety` rules: eight lint rules that report when a project is missing the controls
  that keep its tests away from real data. They detect, they do not protect - the network guard is
  `@bonniernews/stayput`, the environment pin is the import-free file your test runner loads first,
  and database roles are what ultimately hold. No new dependency.

  - `bn-safety/require-test-guards` - nothing the project loads before its tests brings in the
    network guard, or pins `NODE_CONFIG_ENV` to `"test"`. Works out the runner from the dependencies
    and the npm test script, and reads mocha, jest, vitest, ava, tap or `node --test`. A runner it
    cannot read means silence, never a warning.
  - `bn-safety/gitignore-env` - no `.gitignore` up to the repository root excludes `.env`.
  - `bn-safety/env-pin-must-not-import` - the file that pins the test environment also imports
    something, which then runs before the pin. Node's own modules are exempt, and only a top-level
    assignment counts as the pin, so a test toggling `NODE_ENV` inside a hook is left alone.
  - `bn-safety/no-env-pin-tampering` - a stayput escape hatch, or `ALLOW_TEST_ENV_OVERRIDE`,
    switched on from code instead of from the workflow file.
  - `bn-safety/no-remote-db-target` - a test names a database host outside this machine, or turns
    off TLS certificate verification.
  - `bn-safety/no-credentials-in-source` - a credential, private key or secret written into a
    source file. A placeholder word anywhere in the value (`fake-access-token`, `REPLACED_BY_ENV`)
    marks a fixture, and the warning says how to mark one.
  - `bn-safety/no-widened-nock` - `enableNetConnect()` called with no allow list, or with one that
    allows every host.
  - `bn-safety/no-dotenv-override` - dotenv loaded with `override: true`, which replaces a pin that
    has already been applied.

  The first two look at the project rather than at the file being linted. They stay silent unless
  `package.json` depends on a database, cache or message broker client, and they report once per
  project rather than once per test file.

  All eight are warnings on purpose, so that a Dependabot bump cannot turn a fleet of repos red. The
  intention is to make them errors in the next major version. See
  [Safety rules](./README.md#safety-rules) for what each rule flags, with examples, and for what
  they cannot see.
- The test configs now also apply to `tests/`, `spec/` and `__tests__/` directories and to
  `*.test.js` / `*.spec.js` files, not only to `test/`. Without this the safety rules above would
  miss whole repos, and the mocha globals and chai-friendly rules now reach those files too.

## 3.0.0

- Updated all dependencies to latest versions:
  - `@bonniernews/eslint-plugin-typescript-rules` to ^1.0.2
  - `@stylistic/eslint-plugin` to ^5.6.1
  - `@typescript-eslint/eslint-plugin` to ^8.51.0
  - `@typescript-eslint/parser` to ^8.51.0
  - `eslint-plugin-chai-friendly` to ^1.1.0
  - `eslint-plugin-import` to ^2.32.0
  - `eslint-plugin-n` to ^17.23.1
  - `eslint-plugin-react` to ^7.37.5
  - `globals` to ^17.0.0
  - `chai` to ^6.2.2 (dev)
  - `eslint` to ^9.39.2 (dev)
  - `mocha` to ^11.7.5 (dev)
  - `typescript` to ^5.9.3 (dev)
- Converted package to ESM (`"type": "module"`); all configs use `import`/`export default`.
- Converted test setup to ESM (`test/helpers/setup.mjs`) for `chai` v6 compatibility; updated `.mocharc.json` accordingly.

**Breaking change:** This package is now published as an ES Module. CommonJS projects must switch from `require` to `await import`. See [README](./README.md#migrating-from-2x-to-3x).

**Dependency updates impact:**
- **@stylistic/eslint-plugin (v3 → v5)**: The major version updates were for packaging changes (removing sub-packages), not rule behavior. This package only uses the `@stylistic/no-extra-semi` rule, which has not changed behavior.
- **@typescript-eslint (8.22 → 8.51)**: Minor version bump with bug fixes and new optional rules. No changes to currently configured rules.
- **globals (v15 → v17)**: Minor version bump adding more global variable definitions. Existing globals unchanged.
- **Other plugins**: Bug fixes and minor improvements with no user-facing impact.

## 2.0.2

- Fixed bad docs.

## 2.0.1

- Switched to released 1.0.0 of `@bonniernews/eslint-plugin-typescript-rules`.

## 2.0.0

- Breaking change: switch from eslint 8 to eslint 9 and adapt to the new flat file config format.
- Breaking change: removed `all`, `test` and `typescript-react` configs. Just importing the index config
  will enable all configs. For just the specific configs import `@bonniernews/eslint-config/js`,
  `@bonniernews/eslint-config/ts`, `@bonniernews/eslint-config/jsx`, `@bonniernews/eslint-config/test-js`,
  `@bonniernews/eslint-config/test-ts`, or `@bonniernews/eslint-config/tsx`. When creating your own set of
  rules different globals (as an example `globals.browser`) is available from `@bonniernews/eslint-config/globals`.

## 1.2.0

- Bumped `typescript` to 5.4.3 and `@typescript-eslint` to 7.4.0.

## 1.1.1

- Include lowercase `describe` and `context` blocks in `no-only-tests/no-only-tests`.

## 1.1.0

- Add rule `react/jsx-curly-spacing` to align jsx curly with js curly.
- Bumped `eslint-plugin-react`, `eslint-plugin-import` and `eslint-plugin-n`.
- Moved TypeScript restricted syntax to a seperate package `@bonniernews/typescript-rules`.
- Uses `@bonniernews/typescript-rules` for TypeScript.
- Added `@bonniernews/typescript-rules/disallow-class-extends` also for non-typescript.

## 1.0.2

- Run tests on all supported node versions
- Bump `@typescript-eslint/eslint-plugin` and `@typescript-eslint/parser`.
- Use typescript 5.3 for tests

## 1.0.1

- Loosen react/jsx-max-props-per-line to allow as many props the developer wants on
  a single line but enforce 1 prop per line if using multiple lines.

## 1.0.0

- Renamed to @bonniernews/eslint-config

## 0.8.3

- fixed typescript-react rules to actually check .ts files
- disabled import/named for typescript

## 0.8.2

- bump typescript deps

## 0.8.1

- fixed broken release

## 0.8.0

- tsx support by using `exp/typescript-react`
- removed warning for explicit anys

## 0.7.0

- TypeScript rules.
- Bumped major version of `eslint-plugin-n` to 16.
- Bumped major version of `eslint-plugin-no-only-tests` to 3.
- Bumped required node version to 16.
- Added TypeScript as an optional peer dependency.

## 0.6.2

- Allow deprecated url.resolve and url.parse since new URL has unacceptable performance regressions, see <https://github.com/nodejs/node/issues/30334>.

## 0.6.1

- Added `"react/jsx-indent-props": [2, 2]` as a rule for react to make indenting jsx props look nice.

## 0.6.0

- Added support for react using `exp/react`.

## 0.5.0

Add deprecated rules for node.

## 0.4.0

- Replace `eslint-plugin-node` with `eslint-plugin-n` as the former is no longer maintained.

## 0.3.0

Added missing afterEachFeature & beforeEachFeature globals for `mocha-cakes-2`.

## 0.2.0

- Added support for ES6 module linting, which is activated if `"type": "module"` in your `package.json`
- For Node versions 16 and above, the ES2022 environment will be activated
- A new configuration `exp/all` has been added, which adds the test configuration directly in the main `.eslintrc.json`

## 0.1.1

Consistent spacing for functions and code blocks.

## 0.1.0

New rules to format objects: either all properties on the same line OR use multiline.

## 0.0.9

Updated `eslint` peer dependency to v8.

## 0.0.8

`eslint-plugin-node` is now included in the package and has migrated the following rules:

- `node/handle-callback-err`
- `node/no-path-concat`
- `node/no-process-exit`

Behavior remains unchanged.

## 0.0.7

`function` is now exempt from the `comma-dangle` rule.

## 0.0.6

Add the `comma-dangle` rule with `always-multiline`.

## 0.0.5

Add the switch-colon-spacing rule.

## 0.0.4

Remove some ignorePatterns that shouldn't be ignored.

## 0.0.3

No changes. Fixes bad publish.

## 0.0.2

Use new-cap in standard configuration.

## 0.0.1

Initial working version.