Skip to content

Chameleon

v4.4.11 Bugfix

This release fixes issues for SREs watching stability and regressions.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-coding-assistant archetype ast-analysis claude-code claude-plugin code-conventions
+12 more
code-review code-style developer-tools javascript linter mcp mcp-server prompt-engineering python ruby rails typescript

Summary

AI summary

Fixed false‑positive lint errors for JSX presence and unhandled promise rejections.

Changes in this release

Bugfix Medium

`jsx-presence-mismatch` no longer triggers on .ts/.mts/.cts files; JSX detection forced false for these extensions.

`jsx-presence-mismatch` no longer triggers on .ts/.mts/.cts files; JSX detection forced false for these extensions.

Source: llm_adapter@2026-07-18

Confidence: high

Bugfix Medium

`then-without-catch` no longer flags .then calls delegated via return, arrow‑return, await, or followed by a nearby .catch().

`then-without-catch` no longer flags .then calls delegated via return, arrow‑return, await, or followed by a nearby .catch().

Source: llm_adapter@2026-07-18

Confidence: high

Full changelog

Fixed

  • jsx-presence-mismatch (a block-eligible ERROR) no longer fires on a .ts /
    .mts / .cts file. Those extensions cannot legally contain JSX -- only
    .tsx / .jsx can -- so any angle brackets are generics, comparisons, or a
    template-string SVG (`<svg>...</svg>`). A nested template literal could
    leak </svg> past the string scan and be misread as JSX, hard-flagging
    conforming code with "move JSX to a component file. Fix these." jsx_present
    is now forced False for these extensions where dimensions are extracted, with
    zero signal loss (JSX detection on .tsx / .jsx is unchanged). Found and
    verified via real usage.
  • then-without-catch no longer flags a .then whose promise rejection is
    delegated or handled elsewhere: a RETURNED promise (return x.then(...)), an
    arrow-returned one (() => import('./m').then(...)), an AWAITED/voided one, or
    a .then(...) immediately followed by a chained .catch(...) on a nearby line.
    These are the dominant real patterns; flagging them was a false positive (the
    noisiest advisory in practice). A truly bare statement-level x.then(fn) with
    no rejection handler still fires.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Chameleon

Get notified when new releases ship.

Sign up free

About Chameleon

All releases →

Related context

Earlier breaking changes

  • v3.0.0 MCP surface folded from 48 tools to 19; remaining 32 operator tools become actions on three dispatchers.

Beta — feedback welcome: [email protected]