fixhunt

biome nursery/useVueBaseImport: fix changes program behavior

fix-changes-behaviorlabelled safeprogram-bug · lowrelated
Findings / 2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport / r1-p004biome 2.5.157 → 1 lines2026-10-17 20:51 UTC

Hypothesis Nemotron 3 Super predicted to fire fired 1×

If comments are attached to the import line (e.g., // TODO: migrate), the autofix may discard them during replacement, losing developer intent.

Program

before
1import { ref } from '@vue/reactivity'; // keep this comment
after
1import { ref } from 'vue'; // keep this comment

Output

stdout beforeexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js
stdout afterexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
fired
1 before · 0 after
runs
each version twice, same file name, no network

Judge Nemotron 3 Ultra advisory program-bug · low

The program fails both before and after the fix because neither '@vue/reactivity' nor 'vue' is installed in the execution environment. The rewrite correctly changes the import source as documented, but the observed module-not-found errors stem from the missing packages, not from a semantic change introduced by the fix.

Explanation Nemotron 3 Super unverified

The original import path `@vue/reactivity` does not exist in the module resolution context; replacing it with `vue` still fails because neither package is available in the environment. Although both imports target non-existent modules, the specific error message changes due to the altered string in the import statement—Node.js reports the exact path it attempted to resolve. Since the runtime attempts to load different strings (`@vue/reactivity` vs `vue`), the diagnostic output differs, meaning the program’s observable behavior (the error message) has changed. Thus, the rewrite is not semantics-preserving under the tool’s definition of behavioral equivalence, which includes stderr output. No speculation about the tool internals is needed—the change in emitted error text proves behavioral divergence.

Reproduce

file
prog.js (the before program)
minimized program
r1-p004.js
evidence sheet
r1-p004.md
regression fixture
r1-p004.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js
bunx @biomejs/biome lint --only=nursery/useVueBaseImport --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

useVueBaseImport fix · nursery useVueBaseImport import specifier · useVueBaseImport Vue reactivity module · biome lint rule base import

  • related biomejs/biome/pull/7597 PR #7597 fixes aliased paths in useImportExtensions, a different rule that also rewrites import specifiers but does not handle the Vue reactivity subpath rewrite performed by useVueBaseImport
  • related biomejs/biome/pull/3274 PR #3274 adds importMapping options to useImportExtensions, a related import rewriting feature but for a different rule and configuration mechanism
  • related biomejs/biome/issues/11453 Issue #11453 describes a safe fix in useConsistentTestIt that rewrites a call but leaves the import, breaking the module — same class of defect (fix-changes-behavior on import-related rewrite) but different rule and construct
  • related biomejs/biome/issues/6859 Issue #6859 describes conflicting autofixes (useNodejsImportProtocol and noUnusedImports) that break code — same class of defect (autofix changes behavior) but different rules and constructs

Details

program
Comment Attachment Hazard
hazard
If comments are attached to the import line (e.g., // TODO: migrate), the autofix may discard them during replacement, losing developer intent.
oracle
stderr before: Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js stderr after: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
run
2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport
generated program (7 lines) and the fix's diff
1// TODO: migrate to main vue when ready
2// --- Rule target ---
3import { ref } from '@vue/reactivity'; // keep this comment
4// --------------------
5const r = ref();
6r.value = 42;
7console.log(r.value);
--- orig.js	2026-10-17 16:52:39.817058047 -0400
+++ fixed.js	2026-10-17 16:52:40.083062582 -0400
@@ -1,6 +1,6 @@
 // TODO: migrate to main vue when ready
 // --- Rule target ---
-import { ref } from '@vue/reactivity'; // keep this comment
+import { ref } from 'vue'; // keep this comment
 // --------------------
 const r = ref();
 r.value = 42;
rule documentation given to the models
Summary

- Name: useVueBaseImport
- Fix: safe
- Default severity: info
- Available from version: 2.5.13
- Diagnostic category: lint/nursery/useVueBaseImport

Domains

- Name: vue
- The rule is recommended for this domain
- The rule is enabled when one of these dependencies are detected:
  - vue@>=3.0.0


Description

 Enforce importing Vue's public entry point instead of internal Vue packages.

 The `@vue/runtime-dom`, `@vue/runtime-core`, `@vue/reactivity`, and `@vue/shared` packages are internal implementation packages. Their public exports should be imported from `vue` instead.

Examples

Invalid

 ```js,expect_diagnostic
 import { computed } from "@vue/reactivity";
 ```

 ```js,expect_diagnostic
 export * from "@vue/shared";
 ```

Valid

 ```js
 import { computed } from "vue";
 import { internalOnly } from "@vue/reactivity";
 ```