Skip to content

fix(linter/plugins): error if defaultOptions is not JSON-serializable#16959

Merged
graphite-app[bot] merged 1 commit intomainfrom
12-16-fix_linter_plugins_error_if_defaultoptions_is_not_json-serializable
Dec 16, 2025
Merged

fix(linter/plugins): error if defaultOptions is not JSON-serializable#16959
graphite-app[bot] merged 1 commit intomainfrom
12-16-fix_linter_plugins_error_if_defaultoptions_is_not_json-serializable

Conversation

@overlookmotel
Copy link
Member

@overlookmotel overlookmotel commented Dec 16, 2025

Throw an error if rule.meta.defaultOptions isn't JSON-serializable. This makes using deepFreezeJsonArray on it safe - can't lead to infinite loop if defaultOptions is self-referential.

@github-actions github-actions bot added A-linter Area - Linter A-cli Area - CLI A-linter-plugins Area - Linter JS plugins C-bug Category - Bug labels Dec 16, 2025
Copy link
Member Author

overlookmotel commented Dec 16, 2025


How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

  • 0-merge - adds this PR to the back of the merge queue
  • hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds validation to ensure rule.meta.defaultOptions is JSON-serializable before freezing it. This prevents potential infinite loops when deepFreezeJsonArray is called on self-referential objects.

Key changes:

  • Serialize and deserialize defaultOptions through JSON to ensure it contains only JSON-serializable values
  • Remove now-obsolete safety concerns from comments since circular references are prevented

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
apps/oxlint/src-js/plugins/load.ts Added JSON serialization round-trip to validate and sanitize defaultOptions, with error handling for non-serializable values
apps/oxlint/src-js/plugins/options.ts Updated comment to reflect that circular references are now impossible in the data

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@overlookmotel overlookmotel self-assigned this Dec 16, 2025
@overlookmotel overlookmotel force-pushed the 12-16-fix_linter_plugins_error_if_defaultoptions_is_not_json-serializable branch from c83089a to be2e431 Compare December 16, 2025 16:27
@graphite-app graphite-app bot added the 0-merge Merge with Graphite Merge Queue label Dec 16, 2025
@graphite-app
Copy link
Contributor

graphite-app bot commented Dec 16, 2025

Merge activity

…le (#16959)

Throw an error if `rule.meta.defaultOptions` isn't JSON-serializable. This makes using `deepFreezeJsonArray` on it safe - can't lead to infinite loop if `defaultOptions` is self-referential.
@graphite-app graphite-app bot force-pushed the 12-16-fix_linter_plugins_freeze_whole_of_merged_options branch from e080b4d to d8b8a57 Compare December 16, 2025 16:38
@graphite-app graphite-app bot force-pushed the 12-16-fix_linter_plugins_error_if_defaultoptions_is_not_json-serializable branch from be2e431 to 2f946cf Compare December 16, 2025 16:39
Base automatically changed from 12-16-fix_linter_plugins_freeze_whole_of_merged_options to main December 16, 2025 16:44
@graphite-app graphite-app bot removed the 0-merge Merge with Graphite Merge Queue label Dec 16, 2025
@graphite-app graphite-app bot merged commit 2f946cf into main Dec 16, 2025
19 checks passed
@graphite-app graphite-app bot deleted the 12-16-fix_linter_plugins_error_if_defaultoptions_is_not_json-serializable branch December 16, 2025 16:45
overlookmotel added a commit that referenced this pull request Dec 19, 2025
# Oxlint
### 🚀 Features

- 6cc3fdf linter/no-inferrable-types: Implement fixer (#17090) (camc314)
- 2067997 linter/no-negation-in-equality-check: Implement suggestion
(#17084) (camc314)
- 552f9ef vscode: Auto-generate VSCode README configuration from
package.json (#16970) (Copilot)
- 9190c4b linter/no-unnecessary-array-flat-depth: Implement fixer
(#17057) (camc314)
- ed789de linter/misrefactored-assign-op: Implement fixer (#17056)
(camc314)
- a0f74a0 linter/config: Allow aliasing plugin names to allow names the
same as builtin plugins (#15569) (Cameron)
- a43d251 linter/plugins: `RuleTester` support `languageOptions.globals`
(#17009) (overlookmotel)
- 35070d9 linter/bad-bitwise-operator: Implement fixer (#17006)
(camc314)
- 322d995 linter/prefer-enum-initializers: Implement fixer (#17004)
(camc314)
- ae1e5bc vscode: Add support for tsgolint binary configuration (#16921)
(ColemanDunn)
- 3bfe31e linter/eslint-plugin-vitest: Add prefer-called-with as vitest
compatible jest rule (#16993) (Said Atrahouch)
- 0cd075f linter/eslint-plugin-jest: Add fix capabilities to
prefer-called-with rule (#16987) (Said Atrahouch)
- 357564b linter: Add options for
`typescript/require-array-sort-compare` rule. (#16980) (connorshea)
- 2b0ffba linter: Add options for
`typescript/no-meaningless-void-operator` rule. (#16981) (connorshea)
- 8bc4287 linter/plugins: Validate options against schema (#16974)
(overlookmotel)
- fdc7d08 linter: Implement eslint/capitalized-comments (#16896) (Tu
Shaokun)
- f8b6561 linter: Add support for `test.for` in vitest (#16925)
(camchenry)
- 7ee0379 linter/eslint-plugin-vitest: Implement prefer-spy-on (#16426)
(Said Atrahouch)
- fc96ee0 linter: Implement jest/prefer-to-have-been-called-times
(#16938) (秦宇航)
- 291b57b ast_tools: Generate TS declaration files for deserializer and
walk files (#16912) (camc314)
- e31da2a linter: Implement jest/perfer-to-have-been-called (#16899)
(秦宇航)
- 1a31306 linter/eslint-plugin-vitest: Add require-hook as vitest
compatible jest rule (#16880) (Said Atrahouch)
- cd3db21 linter: Add ignoredTypeNames option to no-base-to-string rule
(#16898) (camc314)
- 763b25a linter: Implement eslint/no-inline-comments (#16885) (Tu
Shaokun)

### 🐛 Bug Fixes

- fb9e193 linter: OOM problems with custom plugins (#17082)
(overlookmotel)
- 005ec25 linter: Permit `$schema` `.oxlintrc.json` struct (#17060)
(Copilot)
- fd03131 linter/plugins: Handle plugin names containing slashes
(#17073) (overlookmotel)
- b2a4fac linter/plugins: Error if plugin name alias is not normalized
(#17071) (overlookmotel)
- e046c4e linter/no-misused-spread: Add rule options support (#17054)
(camc314)
- 5c1a9e0 linter/no-deprecated: Add rule options support (#17053)
(camc314)
- 8c9cafe linter: `import/consistent-type-specifier-style`: add support
for declaration files (#16979) (camchenry)
- dab4780 linter/no-empty-pattern: Misleading help message for arrays
(#17039) (Copilot)
- 67f8c5d linter/plugins: Get correct plugin name in all cases (#17033)
(overlookmotel)
- 674dab9 linter/plugins: Fix indentation in error message (#17018)
(overlookmotel)
- 6524f72 linter/plugins: Add `@types/node` dev dependency to `oxlint`
package (#17016) (overlookmotel)
- 7a35513 linter/plugins: Better error for `null` in `globals` in
`RuleTester` (#17011) (overlookmotel)
- 42603ba linter/plugins: Always define `languageOptions.globals`
(#17008) (overlookmotel)
- 4cdc2f8 linter: Fix VITEST override rule list and add test for
alphabetizing the two lists (#16975) (Connor Shea)
- e466562 linter/consistent-type-definitions: Handle parenthesized types
in rule (#16998) (camc314)
- fce267c linter: Correct vitest plugin source to be
`@vitest/eslint-plugin` (#16976) (connorshea)
- 477bb57 linter: Fix `vitest/no-restricted-vi-methods` and add tests
for it. (#16971) (connorshea)
- 7d6974d linter: Ignore oxlint directive comments in
capitalized-comments (#16989) (Tu Shaokun)
- 23ac6b1 linter/plugins: Apply defaults from `meta.schema` to options
(#16930) (overlookmotel)
- 2f946cf linter/plugins: Error if `defaultOptions` is not
JSON-serializable (#16959) (overlookmotel)
- d8b8a57 linter/plugins: Freeze whole of merged options (#16958)
(overlookmotel)
- d446c43 linter: Prevent extra fields from being present on oxlint
config file (#16874) (connorshea)
- b845871 linter/plugins: Correctly handle object with `__proto__` keys
in options merging (#16928) (overlookmotel)
- c897794 linter: Fix eslint/sort-imports allowSeparatedGroups not
working with single empty line (#16012) (Duc Nghiem Xuan)
- 0c347a1 linter/array-type: Handle satisfies expression (#16903)
(camc314)

### ⚡ Performance

- 70d853c linter: Avoid cloning source text when cloning AST into
fixed-size allocator (#17088) (overlookmotel)
- 4d389f7 linter: Less bounds checks in `normalize_plugin_name` (#17030)
(overlookmotel)
- fd8e9c6 linter/plugins: Speed up cloning JSON objects (#16997)
(overlookmotel)
- d77e22d linter/plugins: Use `DEFAULT_OPTIONS` for rules with empty
array as default options (#16913) (overlookmotel)

### 📚 Documentation

- 6d053b4 linter: Fix typo in doc comment (#17091) (overlookmotel)
- b5f3c91 linter: Document intentional exclusion of ignoreCase option in
jsx-no-duplicate-props (#17046) (Copilot)
- a0bf5d8 linter: Fix the config option docs for no-inline-comments
rule. (#16983) (connorshea)
- ca26a11 linter/plugins: Fix typo in doc comment (#16966)
(overlookmotel)
- 3183bf8 linter/plugins: Fix typo in JSDoc comment (#16900)
(overlookmotel)
# Oxfmt
### 🚀 Features

- 15dfb55 oxfmt: Respect single nearest `.editorconfig` (#17043)
(leaysgur)
- 8c33ff4 oxfmt: Expose Node.js API: `format(fileName, sourceText,
options?)` (#16939) (leaysgur)

### 🐛 Bug Fixes

- d340c87 oxfmt: Update api `FormatOptions` type with `& Record<string,
unknown>` (#17036) (leaysgur)
- 827a256 oxfmt: Place ignorePatterns at bottom of JSON in --migrate
prettier (#16926) (Boshen)

Co-authored-by: overlookmotel <[email protected]>
qinyuhang pushed a commit to qinyuhang/oxc that referenced this pull request Jan 22, 2026
…le (oxc-project#16959)

Throw an error if `rule.meta.defaultOptions` isn't JSON-serializable. This makes using `deepFreezeJsonArray` on it safe - can't lead to infinite loop if `defaultOptions` is self-referential.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-cli Area - CLI A-linter Area - Linter A-linter-plugins Area - Linter JS plugins C-bug Category - Bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments