fixhunt

biome nursery/useVueBaseImport: fix changes program behavior

fix-changes-behaviorlabelled safeprogram-bug · lowrelated
Findings / 2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport / r2-p001biome 2.5.153 → 1 lines2026-10-17 20:51 UTC

Hypothesis Nemotron 3 Super predicted to fire fired 1×

comments attached to the removed or moved code

Program

before
1import { ref } /* inline */ from "@vue/reactivity"; // trailing
after
1import { ref } /* inline */ from "vue"; // trailing

Output

stdout beforeexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js
stdout afterexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
fired
1 before · 0 after
runs
each version twice, same file name, no network

Judge Nemotron 3 Ultra advisory program-bug · low

Both the original and fixed programs fail with ERR_MODULE_NOT_FOUND because neither '@vue/reactivity' nor 'vue' is installed in the execution environment. The behavioral difference (the missing package name) stems entirely from the missing dependency, not from the rewrite itself.

Explanation Nemotron 3 Super unverified

The original import targets @vue/reactivity, which does not exist as a standalone package; rewriting it to vue changes the module specifier entirely. Since neither package exists in this environment, both attempts fail—but with different error messages reflecting the distinct specifiers tried. Thus the behavior differs because the resolver reports failure for a different module name, even though both outcomes are errors. This change alters what the runtime attempts to load, so it is not semantically equivalent. (98 words)

Reproduce

file
prog.js (the before program)
minimized program
r2-p001.js
evidence sheet
r2-p001.md
regression fixture
r2-p001.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js
bunx @biomejs/biome lint --only=nursery/useVueBaseImport --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

useVueBaseImport fix · nursery useVueBaseImport import specifier · Biome Vue reactivity module rewrite · fix changes behavior @vue/reactivity to vue

  • related biomejs/biome/pull/7597 PR #7597 fixes aliased paths in useImportExtensions, a different rule that also rewrites import specifiers but not the Vue base import mapping
  • related biomejs/biome/pull/3274 PR #3274 adds importMapping options to useImportExtensions, same domain of import specifier rewriting but different rule
  • related biomejs/biome/issues/6305 Issue #6305 ports vue/no-setup-props-reactivity-loss from eslint-plugin-vue, same Vue domain but different rule and construct
  • related biomejs/biome/issues/9848 Issue #9848 reports panic in useImportType rule on Vue SFC with multi-line imports, same Vue domain and import rewriting but different rule and trigger

Details

program
Comments attached to removed or moved code
hazard
comments attached to the removed or moved code
oracle
stderr before: Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js stderr after: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
run
2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport
generated program (3 lines) and the fix's diff
1// This comment should stay
2import { ref } /* inline */ from "@vue/reactivity"; // trailing
3console.log(typeof ref === "function" ? "ok" : "missing");
--- orig.js	2026-10-17 16:52:51.990264505 -0400
+++ fixed.js	2026-10-17 16:52:52.336270340 -0400
@@ -1,3 +1,3 @@
 // This comment should stay
-import { ref } /* inline */ from "@vue/reactivity"; // trailing
+import { ref } /* inline */ from "vue"; // trailing
 console.log(typeof ref === "function" ? "ok" : "missing");
rule documentation given to the models
Summary

- Name: useVueBaseImport
- Fix: safe
- Default severity: info
- Available from version: 2.5.13
- Diagnostic category: lint/nursery/useVueBaseImport

Domains

- Name: vue
- The rule is recommended for this domain
- The rule is enabled when one of these dependencies are detected:
  - vue@>=3.0.0


Description

 Enforce importing Vue's public entry point instead of internal Vue packages.

 The `@vue/runtime-dom`, `@vue/runtime-core`, `@vue/reactivity`, and `@vue/shared` packages are internal implementation packages. Their public exports should be imported from `vue` instead.

Examples

Invalid

 ```js,expect_diagnostic
 import { computed } from "@vue/reactivity";
 ```

 ```js,expect_diagnostic
 export * from "@vue/shared";
 ```

Valid

 ```js
 import { computed } from "vue";
 import { internalOnly } from "@vue/reactivity";
 ```