biome nursery/useVueBaseImport: fix changes program behavior
fix-changes-behaviorlabelled safeprogram-bug · lowrelated
Hypothesis Nemotron 3 Super predicted to fire fired 1×
numeric/string coercion: + vs template literal, objects with toString/valueOf, Symbol, BigInt
Program
before
1import { reactive } from '@vue/reactivity'; // expect_trigger=true
after
1import { reactive } from 'vue'; // expect_trigger=true
Output
stdout beforeexit 1
(no stdout) Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js
stdout afterexit 1
(no stdout) Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
- fired
- 1 before · 0 after
- runs
- each version twice, same file name, no network
Judge Nemotron 3 Ultra advisory program-bug · low
Both the original and fixed programs fail with ERR_MODULE_NOT_FOUND because neither '@vue/reactivity' nor 'vue' is installed in the execution environment. The behavioral difference (the missing package name) stems entirely from the missing dependencies, not from the rewrite itself.
Explanation Nemotron 3 Super unverified
The original import references @vue/reactivity, which exists in the environment; the fix changes it to vue, a different module that cannot be resolved here, causing a module-not-found error where none occurred before—thus altering runtime behavior despite preserving the same identifier name.
Reproduce
- file
prog.js(the before program)- minimized program
- r1-p008.js
- evidence sheet
- r1-p008.md
- regression fixture
- r1-p008.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js bunx @biomejs/biome lint --only=nursery/useVueBaseImport --write prog.js node prog.js
Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra
useVueBaseImport fix · nursery useVueBaseImport import · reactive vue reactivity mapping · base import transformation
- related biomejs/biome/pull/7597 PR #7597 fixes aliased paths in useImportExtensions, a different rule from nursery/useVueBaseImport which rewrites Vue submodule imports to the main vue package
- related biomejs/biome/pull/3274 PR #3274 adds importMapping options to useImportExtensions for custom import rewriting, same general area but different rule and mechanism
Details
- program
- Numeric/String Coercion Hazard
- hazard
- numeric/string coercion: + vs template literal, objects with toString/valueOf, Symbol, BigInt
- oracle
stderr before: Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js stderr after: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js- run
- 2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport
generated program (10 lines) and the fix's diff
1// Internal Vue reactivity returns objects with custom valueOf used in reactive calculations
2let reactiveValue;
3// --- Rule target ---
4import { reactive } from '@vue/reactivity'; // expect_trigger=true
5// --------------------
6reactiveValue = reactive({ value: 5 });
7// Object with custom valueOf that returns a BigInt
8const obj = { valueOf: () => 3n };
9console.log(String(reactiveValue.value + obj)); // Should be '8' if reactive unwraps correctly
10console.log(`${reactiveValue.value}${obj}`); // Template literal: relies on String() coercion
--- orig.js 2026-10-17 16:52:40.569070864 -0400 +++ fixed.js 2026-10-17 16:52:40.833075362 -0400 @@ -1,7 +1,7 @@ // Internal Vue reactivity returns objects with custom valueOf used in reactive calculations let reactiveValue; // --- Rule target --- -import { reactive } from '@vue/reactivity'; // expect_trigger=true +import { reactive } from 'vue'; // expect_trigger=true // -------------------- reactiveValue = reactive({ value: 5 }); // Object with custom valueOf that returns a BigInt
rule documentation given to the models
Summary
- Name: useVueBaseImport
- Fix: safe
- Default severity: info
- Available from version: 2.5.13
- Diagnostic category: lint/nursery/useVueBaseImport
Domains
- Name: vue
- The rule is recommended for this domain
- The rule is enabled when one of these dependencies are detected:
- vue@>=3.0.0
Description
Enforce importing Vue's public entry point instead of internal Vue packages.
The `@vue/runtime-dom`, `@vue/runtime-core`, `@vue/reactivity`, and `@vue/shared` packages are internal implementation packages. Their public exports should be imported from `vue` instead.
Examples
Invalid
```js,expect_diagnostic
import { computed } from "@vue/reactivity";
```
```js,expect_diagnostic
export * from "@vue/shared";
```
Valid
```js
import { computed } from "vue";
import { internalOnly } from "@vue/reactivity";
```