fix(config): category severities no longer force-enable opt-out rules

[rayhanadev]

Why

A config that only re-stamps category severities — e.g. categories: { "Maintainability": "warn" } — silently activated every defaultEnabled: false rule in those categories, because the opt-out guard in createOxlintConfig accepted the category fallback from resolveRuleSeverityOverride as an explicit enable. Rule fire-rate telemetry traced the two highest per-scan intensity outliers in production to exactly this: forbid-component-props (avg 871 findings/scan, p90 2,965) and react-in-jsx-scope (avg 2,514/scan), plus design-no-redundant-size-axes. Users are visibly being burned — two unrelated OSS repos carry hand-written "react-doctor/react-in-jsx-scope": "off" overrides for a rule they never enabled.

Before (real repo, Anchal789/Org-Drive — config sets category severities only, never names either rule):

forbid-component-props        5 findings   (flags <Image className=...>, the Tailwind pattern the rule is off-by-default to avoid)
design-no-redundant-size-axes 4 findings
total                         13 diagnostics

After:

forbid-component-props        0
design-no-redundant-size-axes 0
total                         4 diagnostics (the legitimately-enabled rules, severities still re-stamped by categories)

What changed

• createOxlintConfig (packages/core/src/runners/oxlint/config.ts): the defaultEnabled: false guard now requires a rule-level severity (per-rule key or legacy alias) — resolved with the same no-category lookup the app-only gate in build-diagnostic-pipeline already uses. Category severities still re-stamp already-enabled rules.
• react-doctor rules preview (resolve-effective-rule-severity.ts) mirrors the same semantics so the catalog matches scan behavior.
• categories docstring + regenerated config schema state the contract explicitly.
• Tests: 5 new core cases + 2 new CLI cases; migrated one existing CLI test that asserted the old semantics through no-danger (itself an opt-out rule); consolidated a repeated test fixture literal.
• Changeset: react-doctor patch.

For configs that never touch categories, scan output is byte-identical — the change can only remove force-enabled rules, never add any.

Test plan

• packages/core: full pnpm test suite green; tests/oxlint-config-settings.test.ts covers category-can't-enable / category-still-restamps / rule-key-enables / alias-enables / off-by-default
• packages/react-doctor: full pnpm test suite green (2,041 passed)
• turbo typecheck + vp fmt clean
• Empirical: re-scanned the cloned Org-Drive repo with the built CLI — 13 → 4 diagnostics, no new rules appearing

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes which lint rules run for real-world configs that set category severities without per-rule pins; impact is limited to removing unintended rule activations, not adding new ones.

Overview
Fixes a bug where categories severities (e.g. Maintainability: "warn") were treated as explicit opt-in for defaultEnabled: false rules, so scans could flood with rules like forbid-component-props and react-in-jsx-scope even when those rules were never named under rules.

createOxlintConfig now gates opt-out rules on a rule-only severity lookup (canonical key or legacy alias); category bumps still re-stamp severities for rules that are already on. react-doctor rules uses the same logic via resolveEffectiveRuleSeverity, and docs/schema state that category maps never activate opt-out rules.

Configs that only touch categories may see fewer diagnostics; explicit rules entries (or aliases) are still required to turn opt-out rules on.

^{Reviewed by Cursor Bugbot for commit 1c89ea3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1020

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1020

npm i https://pkg.pr.new/react-doctor@1020

commit: 1c89ea3