chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

deslop-cli@0.5.9

Patch Changes

• #936 ba2af1b Thanks @aidenybai! - Update the license to MIT with additional restrictions: the software may not be used as training, fine-tuning, or evaluation data for machine-learning models or AI systems, nor sold or resold as a commercial product or service (e.g. a paid API, SaaS, or hosted/managed service) whose value derives substantially from the software, without prior written permission (contact founders@million.dev). Each version's additional restrictions expire on the second anniversary of its release, after which that version is available under the standard MIT License (an FSL-style grant of future license). Each published package now ships its own up-to-date LICENSE file so the terms travel with the tarball.

  The react-doctor CLI also now prints a one-time notice (once per run) when it detects it is running inside an AI/ML training pipeline or agent sandbox, pointing to the license terms.

• Updated dependencies [ba2af1b, 7f9e7f4]:

  • deslop-js@0.5.9

deslop-js@0.5.9

Patch Changes

• #936 ba2af1b Thanks @aidenybai! - Update the license to MIT with additional restrictions: the software may not be used as training, fine-tuning, or evaluation data for machine-learning models or AI systems, nor sold or resold as a commercial product or service (e.g. a paid API, SaaS, or hosted/managed service) whose value derives substantially from the software, without prior written permission (contact founders@million.dev). Each version's additional restrictions expire on the second anniversary of its release, after which that version is available under the standard MIT License (an FSL-style grant of future license). Each published package now ships its own up-to-date LICENSE file so the terms travel with the tarball.

  The react-doctor CLI also now prints a one-time notice (once per run) when it detects it is running inside an AI/ML training pipeline or agent sandbox, pointing to the license terms.

• #916 7f9e7f4 Thanks @rayhanadev! - Rework unused-dependency detection to lean on real package metadata instead of hand-maintained whitelists.

  • Treat any installed dependency that ships a CLI binary as used. A package that declares a bin is routinely invoked outside what a static scan can see (Makefiles, CI, git hooks, ad-hoc npx), so it's no longer flagged just because no package.json script names the binary. Empty bin fields ("" / {}) don't count.
  • Drop the hardcoded fallback tables now that the bin/peer scans read real node_modules metadata: the binary→package map (CLI_BINARY_TO_PACKAGE + the babel/jest/remark fallbacks), the env-wrapper binary set, the static peer-dependency map, and the implicit-companion map. With dependencies installed (the normal scan condition) detection is unchanged — a package's real bin and peerDependencies cover what the tables used to hardcode.

  Trade-off: when scanning without node_modules, a CLI dependency whose binary name differs from its package name (e.g. vp → vite-plus) can no longer be resolved from scripts, and a few heuristic peer relationships that aren't declared peerDependencies (e.g. @hookform/resolvers → zod) are no longer inferred. The always-used lists for tooling that can't be detected statically (typescript, eslint, @types/*, eslint-plugin-*, …) are unchanged.

eslint-plugin-react-doctor@0.5.9

Patch Changes

• #936 ba2af1b Thanks @aidenybai! - Update the license to MIT with additional restrictions: the software may not be used as training, fine-tuning, or evaluation data for machine-learning models or AI systems, nor sold or resold as a commercial product or service (e.g. a paid API, SaaS, or hosted/managed service) whose value derives substantially from the software, without prior written permission (contact founders@million.dev). Each version's additional restrictions expire on the second anniversary of its release, after which that version is available under the standard MIT License (an FSL-style grant of future license). Each published package now ships its own up-to-date LICENSE file so the terms travel with the tarball.

  The react-doctor CLI also now prints a one-time notice (once per run) when it detects it is running inside an AI/ML training pipeline or agent sandbox, pointing to the license terms.

• #958 c72b560 Thanks @aidenybai! - Fix jsx-key's spread-overwrites-key check to key off the spread's position. A {...spread} can only clobber an explicit key when it appears after the key — the later attribute wins under the classic runtime ({ key, ...spread }) and React falls back to createElement under the automatic runtime, so the later spread wins there too. The rule now reports <App key="x" {...spread} /> (and the sandwiched <App {...a} key="x" {...b} />) and stays silent on <App {...spread} key="x" />, which previously produced a false positive. Spreads of object literals that provably carry no key (e.g. {...{}}, {...{ className }}) are never treated as overwriting.

• Updated dependencies [ba2af1b, c72b560]:

  • oxlint-plugin-react-doctor@0.5.9

oxlint-plugin-react-doctor@0.5.9

Patch Changes

• #936 ba2af1b Thanks @aidenybai! - Update the license to MIT with additional restrictions: the software may not be used as training, fine-tuning, or evaluation data for machine-learning models or AI systems, nor sold or resold as a commercial product or service (e.g. a paid API, SaaS, or hosted/managed service) whose value derives substantially from the software, without prior written permission (contact founders@million.dev). Each version's additional restrictions expire on the second anniversary of its release, after which that version is available under the standard MIT License (an FSL-style grant of future license). Each published package now ships its own up-to-date LICENSE file so the terms travel with the tarball.

  The react-doctor CLI also now prints a one-time notice (once per run) when it detects it is running inside an AI/ML training pipeline or agent sandbox, pointing to the license terms.

• #958 c72b560 Thanks @aidenybai! - Fix jsx-key's spread-overwrites-key check to key off the spread's position. A {...spread} can only clobber an explicit key when it appears after the key — the later attribute wins under the classic runtime ({ key, ...spread }) and React falls back to createElement under the automatic runtime, so the later spread wins there too. The rule now reports <App key="x" {...spread} /> (and the sandwiched <App {...a} key="x" {...b} />) and stays silent on <App {...spread} key="x" />, which previously produced a false positive. Spreads of object literals that provably carry no key (e.g. {...{}}, {...{ className }}) are never treated as overwriting.

react-doctor@0.5.9

Patch Changes

• #936 ba2af1b Thanks @aidenybai! - Update the license to MIT with additional restrictions: the software may not be used as training, fine-tuning, or evaluation data for machine-learning models or AI systems, nor sold or resold as a commercial product or service (e.g. a paid API, SaaS, or hosted/managed service) whose value derives substantially from the software, without prior written permission (contact founders@million.dev). Each version's additional restrictions expire on the second anniversary of its release, after which that version is available under the standard MIT License (an FSL-style grant of future license). Each published package now ships its own up-to-date LICENSE file so the terms travel with the tarball.

  The react-doctor CLI also now prints a one-time notice (once per run) when it detects it is running inside an AI/ML training pipeline or agent sandbox, pointing to the license terms.

• #941 5774deb Thanks @rayhanadev! - Speed up cold scans and bound dead-code memory on multi-project workspaces.

  • Overlap the project security scan with the lint pass instead of running it synchronously beforehand. The content-regex security sweep (shipped artifacts, dotenv, SQL — files lint never parses) was the single heaviest CPU phase on real repos and blocked the event loop the whole time. It now runs on a cooperative background fiber that yields between file chunks, so its cost hides under the subprocess-bound lint pass and stops starving a multi-project scan's concurrent git/network work. Cold scans are measurably faster (~30% on a mid-size project and workspace in local benchmarks); diagnostics are byte-identical.
  • Cap concurrent dead-code (deslop) workers by a memory budget so a multi-project scan can't oversubscribe memory with many simultaneous worker processes on a small CI runner. On a roomy machine the cap exceeds the project count, so nothing serializes and scan time is unchanged.

• #929 5f2bd72 Thanks @skoshx! - fix: validate string array config fields (projects, textComponents, etc.)

  Non-string entries in config.projects caused selectProjects to crash with requestedName.trim is not a function. The validator now filters non-string entries from projects, textComponents, rawTextWrapperComponents, and serverAuthFunctionNames with warnings instead of crashing.

  Fixes #921 (Sentry REACT-DOCTOR-1R)

• #940 441e6af Thanks @rayhanadev! - Stop a scan from crashing when a git subprocess fails synchronously (fixes REACT-DOCTOR-1E, REACT-DOCTOR-1P, REACT-DOCTOR-20). Unlike a missing binary (ENOENT, which arrives on the catchable 'error' event), child_process.spawn throws synchronously when the working directory isn't a directory (ENOTDIR) or the argument list exceeds the OS command-line limit (ENAMETOOLONG — e.g. --scope lines on a 1,000+-file diff on Windows). That throw escaped Effect's error channel entirely and took down the whole scan (reported to Sentry as a raw spawn error). The git runner now pre-flights both conditions and fails on its normal channel, so the existing fallbacks recover instead: a bad working directory degrades like an unavailable git, and an over-long --scope lines diff degrades to file-level scope.

• #934 970babc Thanks @skoshx! - Fix --project resolution when scanning from within a project directory whose basename matches the requested project name.

  When running react-doctor from a subdirectory (e.g., apps/website) and passing --project website, the CLI now correctly recognizes that the current directory is the requested project instead of failing with "Project 'website' is not a directory under /path/to/apps/website."

  This affects users who scan a single (non-workspace) project directory and pass that directory's own name as the project — e.g. directory: apps/website together with --project website (or projects: ["website"] in config). The * ("all projects") default is unaffected: it short-circuits to the root directory and never goes through name resolution.

• #938 229ea2e Thanks @skoshx! - fix(staged): log warning when getStagedSourceFiles encounters git errors

  When git commands fail (missing git binary, corrupted repo, permission errors), getStagedSourceFiles now logs a warning message showing the error instead of silently returning an empty array. This makes --staged failures much easier to debug while still gracefully degrading.

• #930 ea4d9af Thanks @skoshx! - Degrade gracefully when git is unavailable or diff base ref is missing (fixes REACT-DOCTOR-F, REACT-DOCTOR-1K, REACT-DOCTOR-14, REACT-DOCTOR-22). CI containers without git installed and shallow clones missing the diff base ref now fall back to a full scan with a clear warning instead of crashing and reporting to Sentry.

• #926 b8188e0 Thanks @skoshx! - Fix react-doctor install crashes on pre-existing malformed/conflicting agent config. The install command now handles three user-environment failure modes gracefully with clear error messages instead of unhandled exceptions:

  1. Malformed JSON in ~/.claude/settings.json or ~/.cursor/hooks.json (REACT-DOCTOR-25)
  2. Directory path blocked by an existing file at ~/.claude/skills or parent paths (REACT-DOCTOR-17)
  3. Permission denied when target directories aren't writable (REACT-DOCTOR-1A)

  These errors are now treated as expected user-environment conditions (not react-doctor bugs) and surface actionable messages without Sentry reports.

• #939 986557d Thanks @rayhanadev! - Align react-doctor install's agent selection with the Vercel skills CLI so it stops scattering skill directories across your project. The prompt previously detected every agent with a config dir anywhere in $HOME (~/.codebuddy, ~/.crush, ~/.goose, ~/.kilocode, …) and pre-selected all of them, so a single Enter copied .codebuddy/, .crush/, .goose/, … into the project root.

  Now, following that CLI's heuristic, the default selection is:

  • your remembered last pick (persisted globally, like skills' lastSelectedAgents lock), else
  • a small curated set of popular agents (claude-code, cursor, codex, opencode), else
  • a lone detected agent when that's the only one — and otherwise nothing, so you make a deliberate choice.

  Every detected agent is still shown so the rest are one keystroke away; they're just no longer pre-checked. A non-interactive run (--yes / CI) still installs to all detected agents, matching skills' --yes.

• #944 0c19858 Thanks @rayhanadev! - Organize the per-scan Sentry "wide event" under dotted namespaces. The root-span attributes had accreted into a flat, half-namespaced set (~50 keys, most bare); each now carries a namespace matching its concept — scan.* (config + scan.fileCount), action.* (CI/action knobs), outcome.* (verdict), diag.* (findings), score.*, lint.*, deadCode.*, supplyChain.*, timing.* — alongside the already-namespaced migration.*/baseline.*. Applied via a single withNamespace helper so the prefix lives in one place instead of being hand-spelled per key. Pure rename: value types are preserved (numbers stay numeric so p75/avg keep working) and the keys stay filter-/group-/aggregate-able in Sentry's Spans dataset. Run/project base tags and all metrics are unchanged.

• #917 7a673d2 Thanks @rayhanadev! - Remember the post-scan "What would you like to do next?" pick. The interactive handoff prompt now pre-selects whatever the user chose last (an agent, "copy to clipboard", or "skip"), so the common "always hand off to the same agent" path is a single Enter. The choice is remembered per user in the existing CLI state file via a new Preference lifecycle primitive; a remembered agent that's since been uninstalled falls back to highlighting the first option, and pressing Esc leaves the prior preference untouched.

• #928 734c564 Thanks @skoshx! - Stop reporting unactionable environment errors to Sentry. A narrow set of filesystem conditions react-doctor cannot fix — a full disk (ENOSPC), a failing or read-only disk (EIO/EROFS), denied permissions (EACCES/EPERM), a path blocked by a file (ENOTDIR), or a missing binary (spawn … ENOENT) — now exit cleanly with an actionable message instead of crashing with a stack trace and appearing as product defects in Sentry. The set is deliberately narrow: codes that usually indicate a react-doctor bug (a missing file we expected, or an over-long argv such as ENAMETOOLONG) keep reaching Sentry. A low-cardinality cli.env_error metric, keyed by code, tracks how often these occur without inflating the crash dashboard. Closes REACT-DOCTOR-13, REACT-DOCTOR-1V, REACT-DOCTOR-24.

• Updated dependencies [ba2af1b, c72b560, 7f9e7f4]:

  • oxlint-plugin-react-doctor@0.5.9
  • deslop-js@0.5.9

@react-doctor/api@0.5.9

Patch Changes

• Updated dependencies [5f2bd72, 441e6af, c2ce298, ea4d9af]:
  • @react-doctor/core@0.5.9

@react-doctor/core@0.5.9

Patch Changes

• #929 5f2bd72 Thanks @skoshx! - fix: validate string array config fields (projects, textComponents, etc.)

  Non-string entries in config.projects caused selectProjects to crash with requestedName.trim is not a function. The validator now filters non-string entries from projects, textComponents, rawTextWrapperComponents, and serverAuthFunctionNames with warnings instead of crashing.

  Fixes #921 (Sentry REACT-DOCTOR-1R)

• #940 441e6af Thanks @rayhanadev! - Stop a scan from crashing when a git subprocess fails synchronously (fixes REACT-DOCTOR-1E, REACT-DOCTOR-1P, REACT-DOCTOR-20). Unlike a missing binary (ENOENT, which arrives on the catchable 'error' event), child_process.spawn throws synchronously when the working directory isn't a directory (ENOTDIR) or the argument list exceeds the OS command-line limit (ENAMETOOLONG — e.g. --scope lines on a 1,000+-file diff on Windows). That throw escaped Effect's error channel entirely and took down the whole scan (reported to Sentry as a raw spawn error). The git runner now pre-flights both conditions and fails on its normal channel, so the existing fallbacks recover instead: a bad working directory degrades like an unavailable git, and an over-long --scope lines diff degrades to file-level scope.

• #927 c2ce298 Thanks @skoshx! - Fix crash when disable comments contain Object.prototype keys (constructor, toString, valueOf, etc.)

  Resolves REACT-DOCTOR-1Y and fixes #920.

  The suppression near-miss detector would crash with TypeError: bareRuleKey.includes is not a function when an eslint-disable or oxlint-disable comment contained a token matching an Object.prototype member name. Indexing the LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY lookup map with such a token returned an inherited method (which the ?? fallback let through), so canonicalizeRuleKey now guards the lookup with a typeof check and only treats the result as an alias when it is a string.

• #930 ea4d9af Thanks @skoshx! - Degrade gracefully when git is unavailable or diff base ref is missing (fixes REACT-DOCTOR-F, REACT-DOCTOR-1K, REACT-DOCTOR-14, REACT-DOCTOR-22). CI containers without git installed and shallow clones missing the diff base ref now fall back to a full scan with a clear warning instead of crashing and reporting to Sentry.

• Updated dependencies [ba2af1b, c72b560, 7f9e7f4]:

  • oxlint-plugin-react-doctor@0.5.9
  • deslop-js@0.5.9

@react-doctor/language-server@0.5.9

Patch Changes

• Updated dependencies [5f2bd72, 441e6af, c2ce298, ea4d9af]:
  • @react-doctor/core@0.5.9

---

Note

Medium Risk
The diff is release metadata, but 0.5.9 bundles many runtime behavior changes (git fallbacks, install defaults, deslop unused-dep heuristics, license notice) that can affect CI scans and dependency findings across consumers.

Overview
Automated Changesets release that bumps the monorepo from 0.5.8 → 0.5.9, removes consumed .changeset/* entries, and records the release notes in each package CHANGELOG.md / package.json.

This PR does not change application source; it publishes the accumulated patch work already merged to main. Highlights in 0.5.9:

License & distribution: MIT with FSL-style additional terms (no AI training / commercial resale without permission; restrictions sunset per version after two years). Each tarball ships an up-to-date LICENSE. The CLI prints a one-time notice when it detects an AI/ML training or agent sandbox.

CLI reliability & UX: Graceful degradation when git is missing or the diff base is unreachable; git spawn preflight for ENOTDIR / ENAMETOOLONG; warnings instead of silent empty results for --staged git failures; narrow handling of unactionable env errors (ENOSPC, EACCES, ENOENT, …) without Sentry noise; react-doctor install handles malformed agent JSON, blocked paths, and permission errors; install agent defaults aligned with Vercel skills (remembered / curated agents, not every detected home dir); remembered post-scan handoff choice; --project works when cwd basename matches the project name.

Scan performance: Security content-regex scan overlaps lint on a yielding background fiber (~30% faster cold scans, same diagnostics); dead-code worker concurrency capped by memory on multi-project workspaces.

Core: Config string-array fields (projects, textComponents, …) filter non-strings with warnings; canonicalizeRuleKey safe against Object.prototype tokens in disable comments.

Rules / deslop: jsx-key spread-overwrites-key respects attribute order; unused-deps detection uses real bin / peerDependencies metadata (fewer false positives with node_modules, weaker heuristics without).

Telemetry: Sentry wide-event span attributes renamed under dotted namespaces (scan.*, lint.*, …) via withNamespace — values unchanged.

^{Reviewed by Cursor Bugbot for commit b241376. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@918

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@918

npm i https://pkg.pr.new/react-doctor@918

commit: f3a3aeb