This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+12 more
Summary
AI summaryFixed false‑positive lint errors for JSX presence and unhandled promise rejections.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
`jsx-presence-mismatch` no longer triggers on .ts/.mts/.cts files; JSX detection forced false for these extensions. `jsx-presence-mismatch` no longer triggers on .ts/.mts/.cts files; JSX detection forced false for these extensions. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Bugfix | Medium |
`then-without-catch` no longer flags .then calls delegated via return, arrow‑return, await, or followed by a nearby .catch(). `then-without-catch` no longer flags .then calls delegated via return, arrow‑return, await, or followed by a nearby .catch(). Source: llm_adapter@2026-07-18 Confidence: high |
— |
Full changelog
Fixed
jsx-presence-mismatch(a block-eligible ERROR) no longer fires on a.ts/
.mts/.ctsfile. Those extensions cannot legally contain JSX -- only
.tsx/.jsxcan -- so any angle brackets are generics, comparisons, or a
template-string SVG (`<svg>...</svg>`). A nested template literal could
leak</svg>past the string scan and be misread as JSX, hard-flagging
conforming code with "move JSX to a component file. Fix these."jsx_present
is now forced False for these extensions where dimensions are extracted, with
zero signal loss (JSX detection on.tsx/.jsxis unchanged). Found and
verified via real usage.then-without-catchno longer flags a.thenwhose promise rejection is
delegated or handled elsewhere: a RETURNED promise (return x.then(...)), an
arrow-returned one (() => import('./m').then(...)), an AWAITED/voided one, or
a.then(...)immediately followed by a chained.catch(...)on a nearby line.
These are the dominant real patterns; flagging them was a false positive (the
noisiest advisory in practice). A truly bare statement-levelx.then(fn)with
no rejection handler still fires.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]