eslint-plugin-vercel-ai-security@1.5.4

1.5.4

Patch Changes

• #407 5ecf4d1 Thanks @ofri-peretz! - Correct the declared ESLint floor: ^8.0.0 → ^8.40.0.

  context.sourceCode landed in ESLint 8.40. The shared devkit reads it without a
  fallback and 20 plugins read it directly, so on ESLint 8.0–8.39 the install
  resolved cleanly and then every rule threw
  Cannot read properties of undefined (reading 'ast') at lint time — npm reported
  nothing, because the manifest claimed the version was supported.

  Measured on 8.0.0 / 8.39.0 (throw on load) versus 8.40.0 / 8.57.1 / 9.0.0 /
  9.39.2 / 10.8.0 (all produce the expected finding). No runtime behaviour
  changes; this only makes the manifest match what the code can actually run.

• #329 75d3497 Thanks @ofri-peretz! - Test infrastructure only — no rule, config, or API behavior changes. These
  packages ship src/ in their npm tarball, so the moved SDK compatibility specs
  technically alter the published files, hence the patch bump.

  The src/__compatibility__/ suites no longer run as part of each package's
  default vitest run. They assert the export surface of the third-party SDK
  (express, jose, @middy/core, mongodb, @nestjs/common, pg, ai), not our rules, and
  sdk-compatibility.yml already exercises them against each SDK's @latest —
  the only run that produces new signal. Loading those SDK graphs on a cold module
  cache was measured at 82s (express) and 209s (@nestjs/common), which blew every
  per-file hook timeout and blocked unrelated local commits via the lefthook
  tests-affected pre-commit hook. The ceiling now lives once in
  vitest.compat.config.mts, sized off those cold numbers.

• Updated dependencies [b59e984, 5ecf4d1, 4794017]:

  • @interlace/eslint-devkit@1.11.0