This release fixes issues for SREs watching stability and regressions.
Published 6d
Developer Productivity
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
ai-coding-assistant
archetype
ast-analysis
claude-code
claude-plugin
code-conventions
+12 more
code-review
code-style
developer-tools
javascript
linter
mcp
mcp-server
prompt-engineering
python
ruby
rails
typescript
Summary
AI summaryFixed ESLint flat-config parsing error message to explain array export limitation.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Reports why a flat ESLint config could not be read. Reports why a flat ESLint config could not be read. Source: llm_adapter@2026-07-20 Confidence: medium |
— |
Full changelog
Fixed
- A flat ESLint config now reports why it could not be read. A flat config exports an ARRAY of
blocks -- the canonical shape in ESLint's own documentation, usually built bydefineConfig([...])
ortseslint.config(...), and the default since ESLint 9 -- while the static parser reads only an
object literal. Every flat config therefore fell tono top-level module.exports assignment found, which is wrong twice: the file has nomodule.exportsprecisely because it correctly uses
export default, sending readers after a CommonJS export that was never meant to exist, and the
message named no way forward. The warning now states that a flat config exports an array the
static parser cannot read without executing it, and points atCHAMELEON_ALLOW_ESLINT_EVAL=1.
Parse behaviour is deliberately unchanged -- resolving spreads, imports and helper calls means
executing the config, which stays opt-in so an untrusted repo's code never runs during bootstrap.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]