chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

deslop-cli@0.9.3

Patch Changes

• Updated dependencies [83f3ff8, 3728102]:
  • deslop-js@0.9.3

deslop-js@0.9.3

Patch Changes

• #1519 83f3ff8 Thanks @aidenybai! - Detect Astro projects, run template design rules through Astro's compiler with source-mapped diagnostics, and keep Astro's default sharp image service out of unused-dependency findings.

• #1467 3728102 Thanks @aidenybai! - Upgrade the Oxc toolchain to the latest releases.

eslint-plugin-react-doctor@0.9.3

Patch Changes

• #1511 fb5f881 Thanks @aidenybai! - Treat custom Hook calls as opaque in no-effect-with-fresh-deps.

• Updated dependencies [83f3ff8, 3d67ca1, 1098b9c, c126684, 992205a, 8402820, de6d280, 0cc5efb, d81eeda, 16972ae, 5f23826, c6bdd2d, 57743f8, 1938763, 29e35d5, 01ca0b3, 69d19b5, 2db2a97, 5268cb4, 3728102, b10cd4c, 9418a1c, 444e177, 8170ba2, 65539af, b07af9d, d6f02bb, 9512488, adcee58, 1f6e181, 6b64dfa, c672551, a81b3d6, 660200e, 8715808, 3a0b9a0, 2992a03, 443082a, bf470d5, b479d7d, a9a1f40, 5dc936e, fb5f881, a8115b8, 3bc63ea, 811a2ff]:

  • oxlint-plugin-react-doctor@0.9.3

oxlint-plugin-react-doctor@0.9.3

Patch Changes

• #1519 83f3ff8 Thanks @aidenybai! - Detect Astro projects, run template design rules through Astro's compiler with source-mapped diagnostics, and keep Astro's default sharp image service out of unused-dependency findings.

• #1489 3d67ca1 Thanks @aidenybai! - Recognize default-exported React HoC feature components in no-multi-comp.

• #1475 1098b9c Thanks @aidenybai! - Detect index keys in dynamic React child arrays and data-indexed while loops.

• #1493 c126684 Thanks @aidenybai! - Suppress js-combine-iterations for statically small fixed arrays

• #1526 992205a Thanks @aidenybai! - Detect props that overwrite defaults with undefined before reaching JSX attributes.

• #1531 8402820 Thanks @aidenybai! - Recognize exported Vite defineConfig callback configs when proving Fast Refresh integrations.

• #1512 de6d280 Thanks @aidenybai! - Avoid reporting local effect helpers as live-state parent notifications when they only call prop-derived transforms or zero-argument lifecycle callbacks.

• #1499 0cc5efb Thanks @aidenybai! - Recognize compound and local stale-request guards after awaited effect work while rejecting mutated guards and conditional cleanup evidence.

• #1527 d81eeda Thanks @aidenybai! - Recognize matching boolean capture modes when prefer-use-effect-event verifies paired event listener registration and cleanup.

• #1496 16972ae Thanks @aidenybai! - Recognize terminal promise catch blocks that recover effect state.

• #1494 5f23826 Thanks @aidenybai! - Avoid loading-reset false positives when a finally reset is guarded by the current async operation or a cleanup-backed mounted ref.

• #1491 c6bdd2d Thanks @aidenybai! - Recognize guarded Map member keys, nullable finder projections, and maximum-derived array lookups in no-non-null-assertion-on-maybe-undefined-result.

• #1506 57743f8 Thanks @aidenybai! - Recognize callback-ref values and measured DOM state paired with mount flags as post-mount state sources.

• #1524 1938763 Thanks @aidenybai! - Resolve React useCallback-wrapped pointer-down handlers when checking pointer capture cancellation.

• #1513 29e35d5 Thanks @aidenybai! - Stop reporting user-facing API key alerts and structured parser token boundaries as hardcoded client secrets.

• #1505 01ca0b3 Thanks @aidenybai! - Skip root test-prefixed JavaScript and TypeScript files in production security scans.

• #1528 69d19b5 Thanks @aidenybai! - Detect URLSearchParams location mirrors in prefer-use-sync-external-store.

• #1533 2db2a97 Thanks @aidenybai! - Reduce scan startup time and workspace contention by loading lightweight rule
  metadata, sharing Oxlint subprocess capacity across projects, and reusing
  semantic and filesystem analysis within each scan. Keep cached diagnostics
  correct when imported browser guards, Next.js manifests, nested project
  targets, or TypeScript path configuration change, and ignore explicitly
  disabled inline CSS animations and transitions in Remotion rules.

• #1540 5268cb4 Thanks @skoshx! - fix(server-auth-actions): skip credential-establishing actions via SDK detection

  The server-auth-actions rule now correctly skips server actions that perform credential-establishing operations (signup, signin, OTP verification, password reset) by detecting calls to auth SDK methods like supabase.auth.signUp(), auth.signInWithPassword(), and auth.verifyOtp(). These actions legitimately run for anonymous callers, so requiring authentication would be incorrect.

  This resolves the documented false positive where credential-establishing endpoints were incorrectly flagged as unauthenticated privileged operations.

  Closes #1538

• #1467 3728102 Thanks @aidenybai! - Upgrade the Oxc toolchain to the latest releases.

• #1504 b10cd4c Thanks @aidenybai! - Avoid reporting conditional wrappers whose click handler only forwards focus to a queried control.

• #1523 9418a1c Thanks @aidenybai! - Avoid no-event-handler false positives for deferred ref focus and state-backed collection ref synchronization.

• #1474 444e177 Thanks @aidenybai! - Detect unescaped dynamic folder path segments in anchored RegExp patterns.

• #1515 8170ba2 Thanks @aidenybai! - Avoid reporting static wrappers whose click handler only forwards focus to a nested control.

• #1532 65539af Thanks @aidenybai! - Avoid reporting parent callbacks used to synchronize external subscriptions, layout measurements, and imperative controllers.

• #1520 b07af9d Thanks @aidenybai! - Keep no-create-ref-in-function-component quiet when createRef() values are initialized once behind a stable useRef().current guard.

• #1488 d6f02bb Thanks @aidenybai! - Detect browser-dependent hydration branches through render-time helpers, mutable aliases, state initializers, and compiled React output.

• #1492 9512488 Thanks @aidenybai! - Report zero-argument constructor allocations passed directly to useRef.

• #1495 adcee58 Thanks @aidenybai! - Recognize stable previous/current transitions and exact convergence guards in componentDidUpdate.

• #1497 1f6e181 Thanks @aidenybai! - Recognize predictable guarded ref initialization while preserving diagnostics for render-dependent and externally mutable values.

• #1525 6b64dfa Thanks @aidenybai! - Detect external collection mutations, setter callbacks, persistence calls, and async update calls inside React state updater functions.

• #1509 c672551 Thanks @aidenybai! - Keep exhaustive-deps quiet for unconfigured custom Hooks without dependency arrays.

• #1507 a81b3d6 Thanks @aidenybai! - Avoid reporting Intl formatters in plain utilities when their locale or options come from caller input.

• #1514 660200e Thanks @aidenybai! - Require exported custom Hook callbacks to have same-file component prop provenance before reporting render-time callback invocations.

• #1490 8715808 Thanks @aidenybai! - Recognize source-proven listener and timer teardown across stable aliases, local loops, and callback-ref replacement.

• #1510 3a0b9a0 Thanks @aidenybai! - Avoid reporting parent notifications that forward an immutable snapshot from an imported external-subscription hook after also copying it into a comparison ref.

• #1498 2992a03 Thanks @aidenybai! - Avoid flagging intentional JSON normalization at Next.js Pages Router props boundaries.

• #1521 443082a Thanks @aidenybai! - Preserve sequential awaits when ordered operations mutate and observe one shared receiver.

• #1529 bf470d5 Thanks @aidenybai! - Detect hoistable helpers inside compiled forwardRef component wrappers.

• #1522 b479d7d Thanks @aidenybai! - Recognize ref-owned one-shot timer reschedules with helper-based replacement and unmount cleanup.

• #1541 a9a1f40 Thanks @skoshx! - Recognize exact-client Supabase removeChannel and removeAllChannels cleanup for fluent Realtime subscriptions.

• #1503 5dc936e Thanks @aidenybai! - Avoid reporting intentional uncontrolled state selected as the fallback to a controlled prop.

• #1511 fb5f881 Thanks @aidenybai! - Treat custom Hook calls as opaque in no-effect-with-fresh-deps.

• #1508 a8115b8 Thanks @aidenybai! - Avoid no-flush-sync false positives for Softmaple Awareness integrations that synchronize editor selections with committed text.

• #1477 3bc63ea Thanks @aidenybai! - Avoid reporting intentionally sequential async traversal that appends await-derived values to an ordered output array.

• #1476 811a2ff Thanks @aidenybai! - Avoid array-lookup reports for fresh array transforms and generated rest helpers with only small fixed omission lists.

react-doctor@0.9.3

Patch Changes

• #1519 83f3ff8 Thanks @aidenybai! - Detect Astro projects, run template design rules through Astro's compiler with source-mapped diagnostics, and keep Astro's default sharp image service out of unused-dependency findings.

• #1470 f1a1b16 Thanks @aidenybai! - Detect React Compiler transforms passed through bundled config wrappers such as Vite's defineConfig.

• #1533 2db2a97 Thanks @aidenybai! - Reduce scan startup time and workspace contention by loading lightweight rule
  metadata, sharing Oxlint subprocess capacity across projects, and reusing
  semantic and filesystem analysis within each scan. Keep cached diagnostics
  correct when imported browser guards, Next.js manifests, nested project
  targets, or TypeScript path configuration change, and ignore explicitly
  disabled inline CSS animations and transitions in Remotion rules.

• #1457 b31fd85 Thanks @skoshx! - Keep baseline comparisons accurate when the GitHub Action scans a rootDir subdirectory.

• #1540 5268cb4 Thanks @skoshx! - fix(server-auth-actions): skip credential-establishing actions via SDK detection

  The server-auth-actions rule now correctly skips server actions that perform credential-establishing operations (signup, signin, OTP verification, password reset) by detecting calls to auth SDK methods like supabase.auth.signUp(), auth.signInWithPassword(), and auth.verifyOtp(). These actions legitimately run for anonymous callers, so requiring authentication would be incorrect.

  This resolves the documented false positive where credential-establishing endpoints were incorrectly flagged as unauthenticated privileged operations.

  Closes #1538

• #1467 3728102 Thanks @aidenybai! - Upgrade the Oxc toolchain to the latest releases.

• #1488 d6f02bb Thanks @aidenybai! - Detect browser-dependent hydration branches through render-time helpers, mutable aliases, state initializers, and compiled React output.

• #1426 3f3197f Thanks @aidenybai! - Show scan progress immediately after interactive project selection while Git and project setup continue. Keep the experimental TUI usable across terminal sizes with a compact visual hierarchy, balanced report layouts, readable active findings, and a theme-safe action menu. Render repeated live diagnostics without React key warnings.

• #1516 86add14 Thanks @aidenybai! - --staged now honors --project and the config's projects field, so a monorepo pre-commit scan stops reporting clean with every React rule gated off. Each selected package brings its own package.json / tsconfig / config into the staged snapshot, and every staged path belongs to exactly one package. Selecting a package also makes the --json report package-scoped, so packageRoot is no longer always the report's directory; diagnostic ids are unchanged, so baselines still match.

  Selecting several packages prints the aggregate project summary rather than a single-scan report, notes how many staged files fell outside the selected projects, and writes --output-dir on a quiet (--json / --score) run where it previously wrote nothing.

  Failures stay out of the committer's way. A projects entry that no longer resolves, or that points outside the scanned tree, warns and falls back to a root scan rather than blocking every commit; an explicit --project still fails, since it was typed this run. A staged run whose git index cannot be read fails rather than treating it as empty, but individual paths that cannot be snapshotted are reported and skipped, and when nothing is left to scan the run warns and exits 0 — nobody can act on an oversized blob mid-commit, and failing would only send them to --no-verify.

• Updated dependencies [83f3ff8, 3d67ca1, 1098b9c, c126684, 992205a, 8402820, de6d280, 0cc5efb, d81eeda, 16972ae, 5f23826, c6bdd2d, 57743f8, 1938763, 29e35d5, 01ca0b3, 69d19b5, 2db2a97, 5268cb4, 3728102, b10cd4c, 9418a1c, 444e177, 8170ba2, 65539af, b07af9d, d6f02bb, 9512488, adcee58, 1f6e181, 6b64dfa, c672551, a81b3d6, 660200e, 8715808, 3a0b9a0, 2992a03, 443082a, bf470d5, b479d7d, a9a1f40, 5dc936e, fb5f881, a8115b8, 3bc63ea, 811a2ff]:

  • deslop-js@0.9.3
  • oxlint-plugin-react-doctor@0.9.3

@react-doctor/api@0.9.3

Patch Changes

• Updated dependencies [83f3ff8, f1a1b16, 2db2a97, 86add14, b1352a2, 86add14]:
  • @react-doctor/core@0.9.3

@react-doctor/core@0.9.3

Patch Changes

• #1519 83f3ff8 Thanks @aidenybai! - Detect Astro projects, run template design rules through Astro's compiler with source-mapped diagnostics, and keep Astro's default sharp image service out of unused-dependency findings.

• #1470 f1a1b16 Thanks @aidenybai! - Detect React Compiler transforms passed through bundled config wrappers such as Vite's defineConfig.

• #1533 2db2a97 Thanks @aidenybai! - Reduce scan startup time and workspace contention by loading lightweight rule
  metadata, sharing Oxlint subprocess capacity across projects, and reusing
  semantic and filesystem analysis within each scan. Keep cached diagnostics
  correct when imported browser guards, Next.js manifests, nested project
  targets, or TypeScript path configuration change, and ignore explicitly
  disabled inline CSS animations and transitions in Remotion rules.

• #1516 86add14 Thanks @aidenybai! - Clear inherited GIT_DIR from nested Git commands so scoped scans launched by Git hooks respect their working directory, while preserving GIT_INDEX_FILE and the rest of the environment.

• #1473 b1352a2 Thanks @skoshx! - Fix inline suppression comments being ignored when oxlint reports diagnostic filenames as file:// URLs in terminals such as JetBrains JediTerm.

• #1516 86add14 Thanks @aidenybai! - --staged now honors --project and the config's projects field, so a monorepo pre-commit scan stops reporting clean with every React rule gated off. Each selected package brings its own package.json / tsconfig / config into the staged snapshot, and every staged path belongs to exactly one package. Selecting a package also makes the --json report package-scoped, so packageRoot is no longer always the report's directory; diagnostic ids are unchanged, so baselines still match.

  Selecting several packages prints the aggregate project summary rather than a single-scan report, notes how many staged files fell outside the selected projects, and writes --output-dir on a quiet (--json / --score) run where it previously wrote nothing.

  Failures stay out of the committer's way. A projects entry that no longer resolves, or that points outside the scanned tree, warns and falls back to a root scan rather than blocking every commit; an explicit --project still fails, since it was typed this run. A staged run whose git index cannot be read fails rather than treating it as empty, but individual paths that cannot be snapshotted are reported and skipped, and when nothing is left to scan the run warns and exits 0 — nobody can act on an oversized blob mid-commit, and failing would only send them to --no-verify.

• Updated dependencies [83f3ff8, 3d67ca1, 1098b9c, c126684, 992205a, 8402820, de6d280, 0cc5efb, d81eeda, 16972ae, 5f23826, c6bdd2d, 57743f8, 1938763, 29e35d5, 01ca0b3, 69d19b5, 2db2a97, 5268cb4, 3728102, b10cd4c, 9418a1c, 444e177, 8170ba2, 65539af, b07af9d, d6f02bb, 9512488, adcee58, 1f6e181, 6b64dfa, c672551, a81b3d6, 660200e, 8715808, 3a0b9a0, 2992a03, 443082a, bf470d5, b479d7d, a9a1f40, 5dc936e, fb5f881, a8115b8, 3bc63ea, 811a2ff]:

  • deslop-js@0.9.3
  • oxlint-plugin-react-doctor@0.9.3

@react-doctor/fuzz@0.0.21

Patch Changes

• Updated dependencies [83f3ff8, 3d67ca1, 1098b9c, c126684, 992205a, 8402820, de6d280, 0cc5efb, d81eeda, 16972ae, 5f23826, c6bdd2d, 57743f8, 1938763, 29e35d5, 01ca0b3, 69d19b5, 2db2a97, 5268cb4, 3728102, b10cd4c, 9418a1c, 444e177, 8170ba2, 65539af, b07af9d, d6f02bb, 9512488, adcee58, 1f6e181, 6b64dfa, c672551, a81b3d6, 660200e, 8715808, 3a0b9a0, 2992a03, 443082a, bf470d5, b479d7d, a9a1f40, 5dc936e, fb5f881, a8115b8, 3bc63ea, 811a2ff]:
  • oxlint-plugin-react-doctor@0.9.3

@react-doctor/language-server@0.9.3

Patch Changes

• Updated dependencies [83f3ff8, f1a1b16, 2db2a97, 86add14, b1352a2, 86add14]:
  • @react-doctor/core@0.9.3

---

Note

Low Risk
Release metadata only—no runtime code in the diff; risk is limited to version/changelog accuracy and publish timing.

Overview
This is a Changesets release PR: it does not change application or rule source code in the diff.

It removes the pending .changeset/*.md entries (they are applied at release time) and bumps workspace versions—mainly 0.9.2 → 0.9.3 for react-doctor, @react-doctor/core, oxlint-plugin-react-doctor, deslop-js, and related packages, plus @react-doctor/fuzz to 0.0.21. Each affected package gets a new CHANGELOG section that documents the accumulated patch notes (Astro support, scan performance, --staged monorepo behavior, many oxlint rule fixes, Oxc upgrade, etc.).

Merging is intended to trigger npm publish for the versioned packages per the Changesets workflow.

^{Reviewed by Cursor Bugbot for commit c533cb1. Bugbot is set up for automated code reviews on this repo. Configure here.}