fixhunt

biome nursery/useVueBaseImport: fix changes program behavior

fix-changes-behaviorlabelled safeprogram-bug · lowrelated
Findings / 2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport / r1-p001biome 2.5.1510 → 3 lines2026-10-17 20:51 UTC

Hypothesis Nemotron 3 Super predicted to fire fired 1×

In environments with custom module resolution (e.g., webpack aliases), replacing '@vue/reactivity' with 'vue' may bypass intended redirects or fallbacks.

Program

before
1function require(id) {
2}
3import { ref } from '@vue/reactivity'; // expect_trigger=true
after
1function require(id) {
2}
3import { ref } from 'vue'; // expect_trigger=true

Output

stdout beforeexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js
stdout afterexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
fired
1 before · 0 after
runs
each version twice, same file name, no network

Judge Nemotron 3 Ultra advisory program-bug · low

The program fails both before and after the fix because neither '@vue/reactivity' nor 'vue' packages are installed in the execution environment. The observed difference is purely environmental (missing dependencies), not a semantic change caused by the rewrite itself. The rule correctly rewrites internal imports to the public entry point as documented.

Explanation Nemotron 3 Super unverified

The original import targets `@vue/reactivity`, which may exist as a separate package providing only reactivity utilities like `ref`. After rewriting to `vue`, the module resolver attempts to load the main entry of the `vue` package, which might not export `ref` in the same way or could lack the expected submodule structure entirely. If `vue` does not re-export `ref` from its reactivity internals under the same path or name, the import fails where the original succeeded—or vice versa—altering runtime behavior due to differing module resolution outcomes, even if both aim to access the same functionality. This changes what code is loaded and executed.

Reproduce

file
prog.js (the before program)
minimized program
r1-p001.js
evidence sheet
r1-p001.md
regression fixture
r1-p001.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js
bunx @biomejs/biome lint --only=nursery/useVueBaseImport --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

useVueBaseImport fix · nursery useVueBaseImport import specifier · rule nursery Vue base import transformation · biome lint Vue reactivity import

  • related biomejs/biome/pull/7597 PR #7597 fixes aliased paths in useImportExtensions, a different rule that also rewrites import specifiers but handles path aliases rather than Vue subpackage redirects
  • related biomejs/biome/pull/3274 PR #3274 adds importMapping options to useImportExtensions for custom import path mappings, same rule category but different mechanism than Vue base import redirect
  • related biomejs/biome/issues/2473 Issue #2473 reports useImportType splitting React imports incorrectly, same rule category (import type/specifier rewriting) but different framework and construct
  • related biomejs/biome/issues/9848 Issue #9848 reports panic in useImportType on Vue SFC with multi-line imports, same rule category but different defect (panic vs incorrect rewrite)
  • related biomejs/biome/issues/4539 Issue #4539 reports useImportType showing 'imports only used as types' in Vue+TS, same rule but different construct (type-only imports vs base import redirect)

Details

program
Path Resolution Hazard
hazard
In environments with custom module resolution (e.g., webpack aliases), replacing '@vue/reactivity' with 'vue' may bypass intended redirects or fallbacks.
oracle
stderr before: Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js stderr after: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
run
2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport
generated program (10 lines) and the fix's diff
1// Simulate webpack alias: @vue/reactivity -> ./local-reactivity
2const originalRequire = require;
3function require(id) {
4 if (id === '@vue/reactivity') return { ref: () => ({ value: 'patched' }) };
5 return originalRequire(id);
6}
7// --- Rule target ---
8import { ref } from '@vue/reactivity'; // expect_trigger=true
9// --------------------
10console.log(ref().value);
--- orig.js	2026-10-17 16:52:38.881042082 -0400
+++ fixed.js	2026-10-17 16:52:39.190047354 -0400
@@ -5,6 +5,6 @@
   return originalRequire(id);
 }
 // --- Rule target ---
-import { ref } from '@vue/reactivity'; // expect_trigger=true
+import { ref } from 'vue'; // expect_trigger=true
 // --------------------
 console.log(ref().value);
rule documentation given to the models
Summary

- Name: useVueBaseImport
- Fix: safe
- Default severity: info
- Available from version: 2.5.13
- Diagnostic category: lint/nursery/useVueBaseImport

Domains

- Name: vue
- The rule is recommended for this domain
- The rule is enabled when one of these dependencies are detected:
  - vue@>=3.0.0


Description

 Enforce importing Vue's public entry point instead of internal Vue packages.

 The `@vue/runtime-dom`, `@vue/runtime-core`, `@vue/reactivity`, and `@vue/shared` packages are internal implementation packages. Their public exports should be imported from `vue` instead.

Examples

Invalid

 ```js,expect_diagnostic
 import { computed } from "@vue/reactivity";
 ```

 ```js,expect_diagnostic
 export * from "@vue/shared";
 ```

Valid

 ```js
 import { computed } from "vue";
 import { internalOnly } from "@vue/reactivity";
 ```