fixhunt

biome nursery/useVueBaseImport: fix changes program behavior

fix-changes-behaviorlabelled safeprogram-bug · lowduplicate
Findings / 2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport / r1-p003biome 2.5.1510 → 1 lines2026-10-17 20:51 UTC

Hypothesis Nemotron 3 Super predicted to fire fired 1×

If the project uses module aliases or conditional exports (e.g., via package.json 'exports' field) that map 'vue' to a different build than the internal packages, the rewrite may resolve to an uninten

Program

before
1import { ref } from '@vue/reactivity'; // expect_trigger=true
after
1import { ref } from 'vue'; // expect_trigger=true

Output

stdout beforeexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js
stdout afterexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
fired
1 before · 0 after
runs
each version twice, same file name, no network

Judge Nemotron 3 Ultra advisory program-bug · low

Both the original and fixed programs fail with ERR_MODULE_NOT_FOUND because neither '@vue/reactivity' nor 'vue' is installed in the execution environment. The behavioral difference (different missing-package name) stems entirely from the missing dependencies, not from a semantic change introduced by the rewrite.

Explanation Nemotron 3 Super unverified

The original import targets @vue/reactivity; the replacement imports from vue instead. If neither module exists in the project’s dependency tree or node_modules, both fail with ERR_MODULE_NOT_FOUND—so the error message changes but the outcome (module not found) remains identical. However, if only one of these packages is installed—for example, if @vue/reactivity is present as a separate package while vue is absent—the rewrite shifts which missing module triggers the error, altering diagnostic output and potentially misleading debugging, even though the program still fails to load. Thus, the change is not semantics‑preserving because it modifies which dependency is expected, affecting error reporting and correctness under differing installation states.

Reproduce

file
prog.js (the before program)
minimized program
r1-p003.js
evidence sheet
r1-p003.md
regression fixture
r1-p003.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js
bunx @biomejs/biome lint --only=nursery/useVueBaseImport --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

useVueBaseImport fix · nursery useVueBaseImport import Vue reactivity · biome lint rule Vue base import fix · import ref from vue instead of reactivity

  • duplicate biomejs/biome/pull/7597 PR #7597 fixes aliased paths in useImportExtensions, which is the same rewrite logic that incorrectly changes @vue/reactivity to vue for the useVueBaseImport rule

Details

program
Conditional/External Mapping Hazard
hazard
If the project uses module aliases or conditional exports (e.g., via package.json 'exports' field) that map 'vue' to a different build than the internal packages, the rewrite may resolve to an uninten
oracle
stderr before: Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js stderr after: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
run
2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport
generated program (10 lines) and the fix's diff
1// Simulate conditional exports: 'vue' -> esm, '@vue/*' -> cjs
2const modules = {
3 vue: { ref: () => ({ value: 'esm-ref' }) },
4 '@vue/reactivity': { ref: () => ({ value: 'cjs-ref' }) }
5};
6function require(id) { return modules[id]; }
7// --- Rule target ---
8import { ref } from '@vue/reactivity'; // expect_trigger=true
9// --------------------
10console.log(ref().value);
--- orig.js	2026-10-17 16:52:39.360050253 -0400
+++ fixed.js	2026-10-17 16:52:39.641055046 -0400
@@ -5,6 +5,6 @@
 };
 function require(id) { return modules[id]; }
 // --- Rule target ---
-import { ref } from '@vue/reactivity'; // expect_trigger=true
+import { ref } from 'vue'; // expect_trigger=true
 // --------------------
 console.log(ref().value);
rule documentation given to the models
Summary

- Name: useVueBaseImport
- Fix: safe
- Default severity: info
- Available from version: 2.5.13
- Diagnostic category: lint/nursery/useVueBaseImport

Domains

- Name: vue
- The rule is recommended for this domain
- The rule is enabled when one of these dependencies are detected:
  - vue@>=3.0.0


Description

 Enforce importing Vue's public entry point instead of internal Vue packages.

 The `@vue/runtime-dom`, `@vue/runtime-core`, `@vue/reactivity`, and `@vue/shared` packages are internal implementation packages. Their public exports should be imported from `vue` instead.

Examples

Invalid

 ```js,expect_diagnostic
 import { computed } from "@vue/reactivity";
 ```

 ```js,expect_diagnostic
 export * from "@vue/shared";
 ```

Valid

 ```js
 import { computed } from "vue";
 import { internalOnly } from "@vue/reactivity";
 ```