[eslint-refiner] ESLint Refiner — Daily Report 2026-07-25: require-fetch-try-catch

[github-actions[bot]]

Overview

Reviewed the newest custom rule, require-fetch-try-catch, and filed 2 grounded refinement issues. This is the first ESLint Refiner run since 2026-07-08 — a 17-day gap during which eslint-factory/src/index.ts grew from 12 to 30 rules. The README doc-debt flagged in prior runs is now resolved (nearly all rules documented).

Key metrics

Metric	Value
Rules in plugin (index.ts)	30
Rules reviewed >=1x (cumulative)	13
Rules never reviewed (backlog)	17
Rule reviewed this run	require-fetch-try-catch (newest)
Issues filed	2 / 3 cap (quality-over-cap)
Live await fetch sites audited	12 (10 correct true-negatives)

Findings (both grounded on the live actions/setup/js corpus)

1. False positive — awaited-callback fetch (medium)

isInsideTryBlock stops the ancestor walk at any function boundary. Correct for fire-and-forget callbacks, but wrong when an async () => {} is passed to a wrapper that is itself awaited inside an enclosing try.

Grounded: check_version_updates.cjs:92 — await fetch(CONFIG_URL) inside async () => {} passed to withRetry(...), all awaited inside the try at line 89. withRetry (error_recovery.cjs:222) does await operation() and re-throws, so the rejection is caught — yet the rule flags it. The existing intentional invalid tests (setTimeout, stored-uninvoked) must stay flagged; only the directly-awaited inline-callback pattern should become valid.

2. False negative — member-chained fetch escapes detection (medium)

isAwaitFetchCall only matches an awaited CallExpression whose callee is the bare fetch Identifier. Any chain (await fetch(url).then(...), .catch(...), .json()) has a MemberExpression callee and is silently ignored — including bare .then() chains with no rejection handler that would crash on a network TypeError.

Shape grounded: validate_secrets.cjs:65,85 — await fetch(...).catch(rethrowAbortError) (safe today via the caller's try, but the shape escapes). The fix must recognize a terminal .catch(...) / 2-arg .then(onF, onR) as satisfying, to avoid flagging those sites.

Positive signal

require-fetch-try-catch already carries the handler != null check — the catch-less try/finally soundness gap found in the older require-fs-sync-try-catch rule (2026-07-08) was not repeated in newer rules. True-negatives confirmed at awf_reflect.cjs:185/315, apply_samples.cjs:191, artifact_client.cjs:95, send_otlp_span.cjs:1096.

Next actions

• Work backward through the 17-rule review backlog by recency (newest-first): no-err-stack-then-string-fallback, no-setfailed-then-exit-zero, require-fs-io-try-catch, the execsync/execfilesync pair, the interpolated-command rules.
• On fix landing: re-verify check_version_updates.cjs:92 is no longer flagged and validate_secrets.cjs:65/85 remain unflagged.
• Strategy + findings persisted to repo-memory (memory/eslint-refiner branch).

References:

• §30146727020

Generated by 🤖 ESLint Refiner · age00 · 317.3 AIC · ⌖ 13 AIC · ⊞ 4.6K · ◷

• expires on Jul 25, 2026, 10:13 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-26T06:13:26.514Z.

Closed by Workflow