fix(unicorn/prefer-string-slice): avoid unsafe autofix for substr-to-slice by camc314 · Pull Request #20010 · oxc-project/oxc

camc314 · 2026-03-04T21:58:43Z

camc314 · 2026-03-04T21:58:57Z

fix(unicorn/prefer-string-slice): avoid unsafe autofix for substr-to-slice #20010 👈 (View in Graphite)
main

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

0-merge - adds this PR to the back of the merge queue
hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

_{An organization admin has enabled the Graphite Merge Queue in this repository.} _{Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.}

This stack of pull requests is managed by Graphite. Learn more about stacking.

Copilot

Pull request overview

This PR addresses an unsafe autofix in the unicorn/prefer-string-slice rule where String#substr(start, length) was being naively rewritten to String#slice(start, length), changing runtime behavior (issue #17933).

Changes:

Switch the rule to conditional_fix and disable autofix for substr calls with potentially unsafe argument patterns (2+ args or spreads).
Add a regression test case ("foo".substr(11, 8)) and update the snapshot output to reflect diagnostics without fixes for unsafe cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`crates/oxc_linter/src/rules/unicorn/prefer_string_slice.rs`	Makes `substr` fixes conditional based on argument safety and updates tests.
`crates/oxc_linter/src/snapshots/unicorn_prefer_string_slice.snap`	Updates expected snapshot output to remove fix hints where fixes are now suppressed.

You can also share your feedback on Copilot code review. Take the survey.

crates/oxc_linter/src/rules/unicorn/prefer_string_slice.rs

codspeed-hq · 2026-03-04T22:04:49Z

Merging this PR will not alter performance

✅ 4 untouched benchmarks
⏩ 52 skipped benchmarks¹

_{Comparing c/03-04-fix_unicorn_avoid_unsafe_substr-to-slice_autofix_fixes_https__github.com_oxc-project_oxc_issues_17933 (7aecae2) with main (753e27e)²}

52 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (4bc84b1) during the generation of this report, so 753e27e was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

camc314 · 2026-03-05T09:18:59Z

Merge activity

Mar 5, 9:18 AM UTC: The merge label '0-merge' was detected. This PR will be added to the Graphite merge queue once it meets the requirements.
Mar 5, 9:19 AM UTC: camc314 added this pull request to the Graphite merge queue.
Mar 5, 9:24 AM UTC: Merged by the Graphite merge queue.

…slice (#20010) fixes #17933

# Oxlint ### 🚀 Features - e6b604f oxlint: Auto-enable gitlab formatter on GitLab (#20076) (camc314) - 2488a68 linter: Add .oxlintrc.jsonc config file support (#19870) (Scott S.) - 61bf388 linter: Add `options.reportUnusedDisableDirectives` to config file (#19799) (Peter Wagenet) - c92422b oxlint: Auto-enable github formatter on GitHub Actions (#19944) (Boshen) - 0337c6d linter: Implement typescript/no-unecessary-type-conversion (#19955) (camc314) - 2919313 linter: Introduce denyWarnings config options (#19926) (camc314) - a607119 linter: Introduce maxWarnings config option (#19777) (camc314) ### 🐛 Bug Fixes - 0861d9a linter/plugins: Remove getters from `Context` (#20115) (overlookmotel) - 92cfb14 linter/plugins: Fix types for `walkProgram` and `walkProgramWithCfg` (#20081) (overlookmotel) - 10e211f oxlint/lsp: Send other code actions besides `source.fixAll` if requested (#20042) (Sysix) - 602daaa linter/plugins: Fix type definition for `VisitorObject` (#20065) (overlookmotel) - ee0491e apps,napi: Explicitly specify libs in tsconfigs (#20071) (camc314) - b6e9499 linter: Fix the logic for `unicorn/prefer-dom-node-remove` to handle literal callees as well as arguments. (#20059) (connorshea) - 3874ae1 linter: Update `unicorn/prefer-query-selector` to also catch `getElementsByName()`. (#20060) (connorshea) - 77c93fb linter: Handle array-type shorthand inside union members (#20034) (camc314) - 50eb160 linter/no-unused-vars: Allow unused type params in ambient module blocks (#19615) (Don Isaac) - 1dd0d21 linter/no-restricted-imports: Apply regex pattern checks to side-effect imports (#20028) (camc314) - 7f3d735 linter: Error when --type-check is used without --type-aware (#20025) (camc314) - eea201c unicorn/prefer-string-slice: Avoid unsafe autofix for substr-to-slice (#20010) (camc314) - 50359dc oxlint/lsp: Detect `reportUnusedDisableDirectives` from oxlint config, change lsp `unusedDisableDirectives` default value to `None` (#20011) (Sysix) - 4bc84b1 linter/plugins: Allow `null` and `undefined` for `rule.meta.fixable` (#20008) (overlookmotel) - 753e27e linter/role-supports-aria-props: Add `aria-posinset` to supported `option` ARIA properties (#20003) (JongKyung Lee) - f57b2c9 linter/plugins: Fix return types of tokens methods (#19985) (overlookmotel) - 27ee4fc linter/no-loss-of-precision: Avoid double rounding for negative exponents (#19999) (camc314) - 77a94bb linter: Avoid no-loss-of-precision false positive for 3e-308 (#19992) (camc314) - 6245c56 linter/no-unused-private-class-members: Treat logical lhs access as usage (#19991) (camc314) - 65891e3 linter: Avoid prefer-const false positive for mixed-scope destructuring (#19982) (camc314) - 89991fe linter: Avoid prefer-const false positive for operator reassignments (#19975) (camc314) - 87318e7 oxlint/lsp: Load js config with reforcing fs read (#19551) (Sysix) - d40a942 linter/no-useless-constructor: Mark fixer as suggestion (#19961) (camc314) - ccbd959 linter/prefer-code-point: Report String.fromCharCode member references (#19931) (camc314) - 14fbbfc linter: Add help text to oxc/no-rest-spread-properties rule (#19900) (Subin Kim) ### ⚡ Performance - 2baa5fb napi: Unify build-test profile to coverage for cache sharing (#20090) (Boshen) - 77f1c71 linter/plugins: Make tokens class instances (#19980) (overlookmotel) - 758b424 linter/plugins: Reduce memory copies for tokens (#19979) (overlookmotel) - 236847f linter/plugins: Cache token objects (#19978) (overlookmotel) - 94b597a linter/plugins: Store tokens as a `Box<[Token]>` (#19969) (overlookmotel) ### 📚 Documentation - 2c0010a linter/plugins: Move comment about "bivariance hack" into generated code (#20082) (overlookmotel) - 7538f09 linter: Improve `import/extensions` and `import/no-named-as-default` rule docs. (#20053) (connorshea) - 1f909cf linter: Improve docs for `unicorn/require-post-message-target-origin` rule. (#20061) (connorshea) - 12ae35c oxlint/lsp: Remove outdated ToDo for `LintOptions.run` (#20012) (Sysix) - 3be73e6 linter/plugins: Fix JSDoc comments for tokens methods (#20004) (overlookmotel) - 48ef285 linter: Update `--config` docs (#19965) (camc314) - 6ea49a0 linter: Fix some identation issues for the generated types used in `oxlint.config.ts`. (#19942) (connorshea) - 6c0e0b5 linter: Add oxlint.config.ts to the config docs. (#19941) (connorshea) - 160e423 linter: Add a note that the typeAware and typeCheck options require oxlint-tsgolint (#19940) (connorshea) - d54c275 linter: Improve rule docs for 27 unicorn rules (#19903) (connorshea) # Oxfmt ### 🚀 Features - ee26215 oxfmt: Support css-in-js substitution (#20019) (leaysgur) - 0f0ff51 oxfmt: Display default settings was used message in cli stats (#19939) (leaysgur) - 88815b8 oxfmt: Reintroduce stats line for write mode (#19938) (leaysgur) ### 🐛 Bug Fixes - ee0491e apps,napi: Explicitly specify libs in tsconfigs (#20071) (camc314) - 92f4490 oxfmt: Apply `is_ignored_dir` for glob paths too (#20056) (leaysgur) - 114f974 oxfmt/lsp: Prefer language_id over file extension when formatting (#19977) (copilot-swe-agent) ### ⚡ Performance - 2baa5fb napi: Unify build-test profile to coverage for cache sharing (#20090) (Boshen) Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>

github-actions bot added A-linter Area - Linter C-bug Category - Bug labels Mar 4, 2026

camc314 marked this pull request as ready for review March 4, 2026 21:59

Copilot AI review requested due to automatic review settings March 4, 2026 21:59

Copilot started reviewing on behalf of camc314 March 4, 2026 21:59 View session

camc314 changed the title ~~fix(unicorn): avoid unsafe substr-to-slice autofix fixes https://github.com/oxc-project/oxc/issues/17933~~ fix(unicorn): avoid unsafe substr-to-slice autofix Mar 4, 2026

camc314 changed the title ~~fix(unicorn): avoid unsafe substr-to-slice autofix~~ fix(unicorn/prefer-string-slice): avoid unsafe autofix for substr-to-slice Mar 4, 2026

Copilot AI reviewed Mar 4, 2026

View reviewed changes

crates/oxc_linter/src/rules/unicorn/prefer_string_slice.rs Show resolved Hide resolved

camc314 added the 0-merge Merge with Graphite Merge Queue label Mar 5, 2026

camc314 self-assigned this Mar 5, 2026

fix(unicorn/prefer-string-slice): avoid unsafe autofix for substr-to-…

eea201c

…slice (#20010) fixes #17933

graphite-app bot force-pushed the c/03-04-fix_unicorn_avoid_unsafe_substr-to-slice_autofix_fixes_https__github.com_oxc-project_oxc_issues_17933 branch from 7aecae2 to eea201c Compare March 5, 2026 09:19

graphite-app bot merged commit eea201c into main Mar 5, 2026
21 checks passed

graphite-app bot deleted the c/03-04-fix_unicorn_avoid_unsafe_substr-to-slice_autofix_fixes_https__github.com_oxc-project_oxc_issues_17933 branch March 5, 2026 09:24

graphite-app bot removed the 0-merge Merge with Graphite Merge Queue label Mar 5, 2026

Boshen mentioned this pull request Mar 9, 2026

release(apps): oxlint v1.52.0 && oxfmt v0.37.0 #20143

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(unicorn/prefer-string-slice): avoid unsafe autofix for substr-to-slice#20010

fix(unicorn/prefer-string-slice): avoid unsafe autofix for substr-to-slice#20010
graphite-app[bot] merged 1 commit intomainfrom
c/03-04-fix_unicorn_avoid_unsafe_substr-to-slice_autofix_fixes_https__github.com_oxc-project_oxc_issues_17933

camc314 commented Mar 4, 2026

Uh oh!

camc314 commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

codspeed-hq bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

camc314 commented Mar 5, 2026 •

edited by graphite-app bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

camc314 commented Mar 4, 2026

Uh oh!

camc314 commented Mar 4, 2026

How to use the Graphite Merge Queue

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

codspeed-hq bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

camc314 commented Mar 5, 2026 • edited by graphite-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge activity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codspeed-hq bot commented Mar 4, 2026 •

edited

Loading

camc314 commented Mar 5, 2026 •

edited by graphite-app bot

Loading