unstale

npm / eslint-plugin-security

eslint-plugin-security

What changed in eslint-plugin-security 2 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.

2 breaking1 security3 new APIs and options2 behavior and defaults1 tooling9 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.5 on npm

eslint-plugin-security 416 changes

Breaking changes 2

Security 1

  • Expands detection to cover non-top-level require() calls and extends detection of non-literal filesystem filenames.

    4.0.0release notes

New APIs and options 3

Behavior and default changes 1

  • Supports template literals and fixes false positives for static expressions.

    4.0.0release notes

Tooling 1

  • Type definitions are added for TypeScript users of the plugin.

    4.2.0release notes

Fixes and other changes 8

  • Handles all ECMAScript line terminators.

    4.1.0release notes

  • Treats import.meta.dirname as static.

    4.0.1release notes

  • Treats import.meta.filename as static.

    4.0.1release notes

  • Corrects an incorrect method name in the rule.

    4.0.0release notes

  • Improves detection and fixes false positives for destructured exec and spawn; also avoids crashes when exec() has no arguments.

    4.0.0release notes

  • Avoids a crash when eval() is empty.

    4.0.0release notes

  • Fixes false positives for static expressions.

    4.0.0release notes

  • Adds compatibility with ESLint 9 and ESLint 10, including the context.sourceCode API change.

    4.0.0release notes

eslint-plugin-security 31 changes

Fixes and other changes 1

eslint-plugin-security 21 changes

Behavior and default changes 1

  • The recommended configuration switches to flat config.

    2.0.0release notes