biome correctness/noGlobalDirnameFilename: fix changes program behavior

Hypothesis Nemotron 3 Super predicted to fire fired 1×

__proto__ keys, prototype access, Object.assign vs spread

Program

Output

(no stdout)
ReferenceError: __dirname is not defined in ES module scope

(no stdout)

Judge Nemotron 3 Ultra advisory program-bug · high

The program runs as an ES module where __dirname is not defined, so it crashes before the fix. The rewrite replaces __dirname with import.meta.dirname, which is the correct ES-module equivalent and makes the program run successfully. The behavior change is caused by the module system environment, not by a defect in the fix.

Explanation Nemotron 3 Super unverified

The original code uses `__dirname`, which is undefined in ES modules, causing a `ReferenceError`. The replacement with `import.meta.dirname` resolves to the directory of the current module file, so the property name becomes `'__proto__' + <actual path>`, avoiding the error. This changes the object key from one that would trigger prototype pollution via `__proto__` to a unique string key, altering behavior: the original would have modified `Object.prototype` if `__dirname` were defined, but now it sets a regular property on `o`, preventing the tampering effect intended in the unsafe pattern. Thus, the semantics differ.

Reproduce

file

prog.js (the before program)

minimized program

r1-p002.js

evidence sheet

r1-p002.md

regression fixture

r1-p002.js the minimized program with a header stating the observed change, for the tool's test suite

node prog.js
bunx @biomejs/biome lint --only=correctness/noGlobalDirnameFilename --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

noGlobalDirnameFilename fix · correctness noGlobalDirnameFilename import meta dirname · __dirname replacement import.meta.dirname es modules · biome lint rule global variable substitution

• duplicate biomejs/biome/issues/11028 same rule (noGlobalDirnameFilename) and same defect (false positive on __dirname/__filename in modules where they are not defined)

Details

program

__dirname in __proto__ key via computed property

hazard

__proto__ keys, prototype access, Object.assign vs spread

oracle

exit 1 → 0 stderr before: ReferenceError: __dirname is not defined in ES module scope stderr after: (none)

run

2026-10-17T20-16-26-722Z-l85y-biome-correctness_noGlobalDirnameFilename

--- orig.js	2026-10-17 16:16:39.258051857 -0400
+++ fixed.js	2026-10-17 16:16:39.542048373 -0400
@@ -1,4 +1,4 @@
 // Hazard 2
 const o = {};
-o[`__proto__${__dirname}`] = 'tampered';
+o[`__proto__${import.meta.dirname}`] = 'tampered';
 console.log(Object.getPrototypeOf(o));

Summary

- Name: noGlobalDirnameFilename
- Fix: safe
- Default severity: info
- Available from version: 2.0.0
- Diagnostic category: lint/correctness/noGlobalDirnameFilename


Description

 Disallow the use of `__dirname` and `__filename` in the global scope.

 They are [not available in ES modules](https://nodejs.org/api/esm.html#esm_no_filename_or_dirname).
 Starting with Node.js 20.11, `import.meta.dirname` and `import.meta.filename` have been introduced in ES modules, providing identical functionality to `__dirname` and `__filename` in CommonJS (CJS).

Examples

Invalid

 ```js,expect_diagnostic
 const dirname = __dirname;
 ```

 ```js,expect_diagnostic
 const filename = __filename;
 ```

 ``` js,expect_diagnostic
 const foo = { __filename }
 ```

 ```js,expect_diagnostic
 if (__dirname.startsWith("/project/src/")) {}
 ```

Valid

 ```js
 const dirname = import.meta.dirname
 const filename = import.meta.filename
 const foo = {__filename: import.meta.filename };
 if (import.meta.dirname.startsWith("/project/src/")) {}
 ```