From 245fd5282022dca0c238e4f2edbaea02e832bc95 Mon Sep 17 00:00:00 2001 From: Todd Schiller Date: Mon, 22 Jun 2026 10:33:38 -0400 Subject: [PATCH] Disable unicorn/prefer-uint8array-base64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The suggested `Uint8Array.fromBase64()`/`#toBase64()` are present in the Chrome target and in Bun (the build script), but Node 24 — which runs Jest/jsdom in CI — only exposes them behind the experimental `--js-base-64` flag, so they're absent under test. Rewriting the 8 sites (which include the `encoded-payload-redact.ts` / `encoded-fixture.ts` security decode paths and their fixtures) would either break the suite or force an atob/btoa-based polyfill into jsdom that exercises the shim instead of Chrome's native impl, masking prod divergence on a decode path. Not worth it for a stylistic rule. Turn off with rationale and move the row to the "not worth ratcheting" section of #279; revisit once Node ships these unflagged. Co-Authored-By: Claude Opus 4.8 (1M context) --- extension/eslint.config.js | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/extension/eslint.config.js b/extension/eslint.config.js index 22e74c4..30497a4 100644 --- a/extension/eslint.config.js +++ b/extension/eslint.config.js @@ -229,6 +229,20 @@ export default tseslint.config( // are idiomatic and read better nested than split into temporaries. "unicorn/max-nested-calls": "off", + // Off — blocked by the test runtime, not the codebase. The suggested + // `Uint8Array.fromBase64()`/`#toBase64()` are present in our Chrome + // target (133+; manifest requires 148) and in Bun (the build script), + // but Node 24 — which runs Jest/jsdom in CI — only exposes them behind + // the experimental `--js-base-64` flag, so they're absent under test. + // The 8 sites include two security-relevant decode paths + // (`encoded-payload-redact.ts`, `encoded-fixture.ts`) plus their + // fixtures; rewriting them would either break the suite or force an + // atob/btoa-based polyfill into jsdom — which would then exercise the + // shim, not Chrome's native impl, masking any prod divergence on a + // decode path. Not worth it for a stylistic rule. Revisit once Node + // ships these unflagged. See #279. + "unicorn/prefer-uint8array-base64": "off", + // Enforced (recommended `error`). Dynamically-built arrays pass an // explicit comparator; the only sites carrying a scoped `eslint-disable` // are where the rule can't be satisfied cleanly: @@ -243,7 +257,6 @@ export default tseslint.config( "unicorn/prefer-scoped-selector": "warn", "unicorn/no-break-in-nested-loop": "warn", "unicorn/prefer-number-coercion": "warn", - "unicorn/prefer-uint8array-base64": "warn", // no-global-object-property-assignment stays at its recommended `error` // for production code; it's disabled only for tests (which legitimately // assign globals to set up mocks) in the test-files block below.