Skip to content

fix(build): match helper imports literally - #508

Merged
cevdetch merged 1 commit into
mainfrom
fix/security-follow-up
Oct 16, 2026
Merged

cevdetch merged 1 commit into
mainfrom
fix/security-follow-up

Conversation

@cevdetch

Copy link
Copy Markdown
Owner

Summary

The shared-helper usage validator treats dollar signs in exported names and
punctuation in module filenames as regex syntax. This can mark imported names
unused and unrelated names or modules used. Escape both values and match full
JavaScript identifiers, including dollar signs.

Two regression tests cover imported and unimported dollar-sign names, literal
filename periods and a filename containing a plus sign. Both tests failed before
the fix and pass with it.

Validation

Verified on Node 24.21.0 with the pinned pnpm 12.6.0:

  • pnpm install --frozen-lockfile
  • node --test --test-name-pattern=checkLibModules test/rules.test.ts — 3 passed
  • pnpm validate:rules && pnpm build && pnpm build:css && pnpm build:bookmarklet && pnpm typecheck && pnpm test && pnpm check:self — 877 tests passed
  • pnpm site:check && pnpm check:site — 249 pages pass lint, size and SEO checks
  • pnpm check:packages && pnpm smoke:packages — package and consumer checks pass
  • pnpm lint:deps — exit zero, 45 warnings
  • git diff --check

Notes for the reviewer

This changes the build-time helper import check. The regression cases exercise
its observable diagnostics using temporary module files.

Escape helper export names and module filenames in the usage check, and
recognize dollar signs as part of JavaScript identifiers. Add regressions for
complete identifiers and literal module filenames.
@cevdetch
cevdetch merged commit 05d8e27 into main Oct 16, 2026
7 checks passed
@cevdetch
cevdetch deleted the fix/security-follow-up branch October 16, 2026 16:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant