feat(linter)!: remove unmaintained security plugin (#7773)

apps/oxlint/src/command/lint.rs

@@ -283,10 +283,6 @@ pub struct EnablePlugins {
     /// Enable the node plugin and detect node usage problems
     #[bpaf(flag(OverrideToggle::Enable, OverrideToggle::NotSet), hide_usage)]
     pub node_plugin: OverrideToggle,
-
-    /// Enable the security plugin and detect security problems
-    #[bpaf(flag(OverrideToggle::Enable, OverrideToggle::NotSet), hide_usage)]
-    pub security_plugin: OverrideToggle,
 }
 
 /// Enables or disables a boolean option, or leaves it unset.
@@ -362,7 +358,6 @@ impl EnablePlugins {
         self.react_perf_plugin.inspect(|yes| plugins.set(LintPlugins::REACT_PERF, yes));
         self.promise_plugin.inspect(|yes| plugins.set(LintPlugins::PROMISE, yes));
         self.node_plugin.inspect(|yes| plugins.set(LintPlugins::NODE, yes));
-        self.security_plugin.inspect(|yes| plugins.set(LintPlugins::SECURITY, yes));
 
         // Without this, jest plugins adapted to vitest will not be enabled.
         if self.vitest_plugin.is_enabled() && self.jest_plugin.is_not_set() {

crates/oxc_linter/src/config/oxlintrc.rs

@@ -171,7 +171,7 @@ mod test {
             serde_json::from_str(r#"{ "plugins": ["typescript", "unicorn"] }"#).unwrap();
         assert_eq!(config.plugins, LintPlugins::TYPESCRIPT.union(LintPlugins::UNICORN));
         let config: Oxlintrc =
-            serde_json::from_str(r#"{ "plugins": ["typescript", "unicorn", "react", "oxc", "import", "jsdoc", "jest", "vitest", "jsx-a11y", "nextjs", "react-perf", "promise", "node", "security"] }"#).unwrap();
+            serde_json::from_str(r#"{ "plugins": ["typescript", "unicorn", "react", "oxc", "import", "jsdoc", "jest", "vitest", "jsx-a11y", "nextjs", "react-perf", "promise", "node"] }"#).unwrap();
         assert_eq!(config.plugins, LintPlugins::all());
 
         let config: Oxlintrc =

crates/oxc_linter/src/config/plugins.rs

@@ -38,8 +38,6 @@ bitflags! {
         const PROMISE = 1 << 11;
         /// `eslint-plugin-node`
         const NODE = 1 << 12;
-        /// Custom security rules made by the Oxc team
-        const SECURITY = 1 << 13;
     }
 }
 impl Default for LintPlugins {
@@ -65,7 +63,6 @@ impl From<LintPluginOptions> for LintPlugins {
         plugins.set(LintPlugins::REACT_PERF, options.react_perf);
         plugins.set(LintPlugins::PROMISE, options.promise);
         plugins.set(LintPlugins::NODE, options.node);
-        plugins.set(LintPlugins::SECURITY, options.security);
         plugins
     }
 }
@@ -115,7 +112,6 @@ impl From<&str> for LintPlugins {
             "react-perf" | "react_perf" => LintPlugins::REACT_PERF,
             "promise" => LintPlugins::PROMISE,
             "node" => LintPlugins::NODE,
-            "security" | "oxc-security" => LintPlugins::SECURITY,
             // "eslint" is not really a plugin, so it's 'empty'. This has the added benefit of
             // making it the default value.
             _ => LintPlugins::empty(),
@@ -139,7 +135,6 @@ impl From<LintPlugins> for &'static str {
             LintPlugins::REACT_PERF => "react-perf",
             LintPlugins::PROMISE => "promise",
             LintPlugins::NODE => "node",
-            LintPlugins::SECURITY => "security",
             _ => "",
         }
     }
@@ -245,7 +240,6 @@ pub struct LintPluginOptions {
     pub react_perf: bool,
     pub promise: bool,
     pub node: bool,
-    pub security: bool,
 }
 
 impl Default for LintPluginOptions {
@@ -264,7 +258,6 @@ impl Default for LintPluginOptions {
             react_perf: false,
             promise: false,
             node: false,
-            security: false,
         }
     }
 }
@@ -287,7 +280,6 @@ impl LintPluginOptions {
             react_perf: false,
             promise: false,
             node: false,
-            security: false,
         }
     }
 
@@ -308,7 +300,6 @@ impl LintPluginOptions {
             react_perf: true,
             promise: true,
             node: true,
-            security: true,
         }
     }
 }
@@ -332,7 +323,6 @@ impl<S: AsRef<str>> FromIterator<(S, bool)> for LintPluginOptions {
                 LintPlugins::REACT_PERF => options.react_perf = enabled,
                 LintPlugins::PROMISE => options.promise = enabled,
                 LintPlugins::NODE => options.node = enabled,
-                LintPlugins::SECURITY => options.security = enabled,
                 _ => {} // ignored
             }
         }
@@ -365,7 +355,6 @@ mod test {
                 && self.react_perf == other.react_perf
                 && self.promise == other.promise
                 && self.node == other.node
-                && self.security == other.security
         }
     }
 
@@ -405,7 +394,6 @@ mod test {
             react_perf: false,
             promise: false,
             node: false,
-            security: false,
         };
         assert_eq!(plugins, expected);
     }

crates/oxc_linter/src/context/mod.rs

@@ -350,5 +350,4 @@ const PLUGIN_PREFIXES: phf::Map<&'static str, &'static str> = phf::phf_map! {
     "unicorn" => "eslint-plugin-unicorn",
     "vitest" => "eslint-plugin-vitest",
     "node" => "eslint-plugin-node",
-    "security" => "oxc-security",
 };

crates/oxc_linter/src/rules.rs

@@ -443,10 +443,6 @@ mod oxc {
     pub mod uninvoked_array_callback;
 }
 
-mod security {
-    pub mod api_keys;
-}
-
 mod nextjs {
     pub mod google_font_display;
     pub mod google_font_preconnect;
@@ -850,7 +846,6 @@ oxc_macros::declare_all_lint_rules! {
     react_perf::jsx_no_new_array_as_prop,
     react_perf::jsx_no_new_function_as_prop,
     react_perf::jsx_no_new_object_as_prop,
-    security::api_keys,
     typescript::adjacent_overload_signatures,
     typescript::array_type,
     typescript::ban_ts_comment,