# What changed in eslint-plugin-security

> 18 changes in eslint-plugin-security 2 to 4 from its official release notes, upgrade guides and advisories: 2 breaking, 1 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/eslint-plugin-security/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## eslint-plugin-security 4

### Breaking changes

- Requires Node.js ^18.18.0 || ^20.9.0 || >=21.1.0. (3.0.0, 4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/v3.0.0), [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)
- The recommended config switches to flat configuration. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)

### Security

- Expands detection to cover non-top-level require() calls and extends detection of non-literal filesystem filenames. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)

### New APIs and options

- Adds a rule that detects invisible characters. (4.1.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.1.0)
- Adds a rule to detect bidirectional characters. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)
- Adds a legacy recommended configuration. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)

### Behavior and default changes

- Supports template literals and fixes false positives for static expressions. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)

### Tooling

- Type definitions are added for TypeScript users of the plugin. (4.2.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.2.0)

### Fixes and other changes

- Handles all ECMAScript line terminators. (4.1.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.1.0)
- Treats import.meta.dirname as static. (4.0.1) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.1)
- Treats import.meta.filename as static. (4.0.1) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.1)
- Corrects an incorrect method name in the rule. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)
- Improves detection and fixes false positives for destructured exec and spawn; also avoids crashes when exec() has no arguments. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)
- Avoids a crash when eval() is empty. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)
- Fixes false positives for static expressions. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)
- Adds compatibility with ESLint 9 and ESLint 10, including the context.sourceCode API change. (4.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/eslint-plugin-security-v4.0.0)

## eslint-plugin-security 3

### Fixes and other changes

- Ensures everything works with ESLint v9. (3.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/v3.0.0)

## eslint-plugin-security 2

### Behavior and default changes

- The recommended configuration switches to flat config. (2.0.0) — [release notes](https://github.com/eslint-community/eslint-plugin-security/releases/tag/v2.0.0)