[aidenybai]

webhook-signature-risk currently warns on a closed Shopify SDK handler even when it awaits webhooks.validate, rejects an invalid result, and checks success before acting on the raw webhook body. Recognize that finite gate for an inline shopifyApi client or one default import from an explicit relative .js/.mjs provider. Keep warnings for ignored results, changed bodies or results, provider mutation, and unsupported handler shapes.

The review also bounds repeated readonly-reference and header-prefix proofs. Only immutable reference-flag eligibility is memoized by the actual scope analysis and symbol; depth, cycle, import permissions and provider-file reads stay fresh. Exact validated request.headers nodes use identity membership. Durable work and context regressions cover both admitted 20/100 shapes and provider edits, removal, restoration and symlinks.

This recognizes an obvious validation step under the ordinary SDK/module assumptions. It does not enforce an installed SDK version or certify cryptographic correctness, raw-byte middleware, replay protection or end-to-end security. The synthetic profile uses SDK 13.0.0; the official 13.1.0 changelog separately reports a webhook-HMAC fix. The conservative TypeScript boundary applies to reached TS-prefixed/declare nodes; JS-shaped .ts files and erased parameter annotations can still match.

Validation passed on the frozen final tree: 56 focused tests; all 12 test tasks with 34,122 passes and 1,118 skips; all 10 typecheck tasks; and a fresh five-task build, each graph without cache. Lint, formatting, registry generation, the two actual corpus loader/scan verdicts and built JSON smoke passed. Strict fuzzing ran once with 500 iterations, seed 42 and required positive target fire, with no findings.

Independent actual security-scan and API/CLI comparisons preserve all finding fields, order and multiplicity: 45 scenarios/87 source files with 40 target findings, and the expanded 55-scenario/97-source union with 45 target findings. All four profiles explicitly retain ordinary rules; the one unrelated default no-eval finding is unchanged. Nine actual API/CLI provider lifecycle states preserve same-host warm/cold results. These are project-level security-scan witnesses, not ordinary AST-plugin lint runs. Staged/diff scans skip this security scan; active target behavior is established by the whole-project profiles. Fresh credentialed sandbox parity is unavailable.

The existing patch Changeset covers the three published packages. No canonical resolver dependency, merge, release tag or publishing action is included.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2105

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2105

npm i https://pkg.pr.new/react-doctor@2105

commit: ce314d5

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at ce314d5 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence