Skip to content

v3.17.0

Choose a tag to compare

View all tags
@goklab goklab released this 09 Jun 06:20
· 4 commits to main since this release
v3.17.0
bbe61e2
  • VG126 (Dynamic RegExp from user input) no longer fires when the argument is provably constant: a string literal, a const-list iteration (incl. imported SCREAMING_SNAKE lists), or someRegExp.source/.flags (cloning a compiled RegExp); minified bundles skipped
  • Validated: 29 to 21, all 8 removed are confirmed non-user-input (bot-pattern lists, a minified vendor bundle, RegExp clones), 0 true positives lost
  • No rule or tool changes (442 / 37); gate green (PASS/A/0)
Assets 2
Loading