fixhunt

biome nursery/useVueBaseImport: fix changes program behavior

fix-changes-behaviorlabelled safeprogram-bug · lowrelated
Findings / 2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport / r2-p002biome 2.5.157 → 4 lines2026-10-17 20:51 UTC

Hypothesis Nemotron 3 Super predicted to fire fired 1×

strict vs sloppy mode semantics

Program

before
1import { reactive } from "@vue/runtime-core";
2try {
3} catch (e) {
4}
after
1import { reactive } from "vue";
2try {
3} catch (e) {
4}

Output

stdout beforeexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/runtime-core' imported from /w/prog.js
stdout afterexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
fired
1 before · 0 after
runs
each version twice, same file name, no network

Judge Nemotron 3 Ultra advisory program-bug · low

Both the original and fixed programs fail with ERR_MODULE_NOT_FOUND because neither '@vue/runtime-core' nor 'vue' is installed in the execution environment. The behavioral difference (different missing-package name) stems entirely from the missing dependencies, not from the rewrite itself.

Explanation Nemotron 3 Super unverified

The import path was changed from @vue/runtime-core to vue, which may resolve to a different module or version; if neither package exists or both fail to resolve identically, the program still throws a module-not-found error, but the specific missing module name differs, altering the error message and thus the observable behavior of the program. This change in error output means the rewrite is not semantics-preserving, as the program’s external behavior—specifically, the error it produces—has changed.

Reproduce

file
prog.js (the before program)
minimized program
r2-p002.js
evidence sheet
r2-p002.md
regression fixture
r2-p002.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js
bunx @biomejs/biome lint --only=nursery/useVueBaseImport --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

useVueBaseImport fix · nursery useVueBaseImport import specifier · useVueBaseImport vue runtime core replacement · biome lint rule import path correction

  • related biomejs/biome/pull/7597 PR #7597 fixes aliased paths in useImportExtensions, a different rule that also rewrites import specifiers but not the Vue-specific base import mapping used by useVueBaseImport
  • related biomejs/biome/pull/3274 PR #3274 adds importMapping options to useImportExtensions for generic import path mapping, similar concept but different rule and configuration mechanism than useVueBaseImport

Details

program
Strict vs sloppy mode semantics
hazard
strict vs sloppy mode semantics
oracle
stderr before: Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/runtime-core' imported from /w/prog.js stderr after: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
run
2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport
generated program (7 lines) and the fix's diff
1"use strict";
2import { reactive } from "@vue/runtime-core";
3try {
4 reactive(null);
5} catch (e) {
6 console.log(e.constructor.name);
7}
--- orig.js	2026-10-17 16:52:52.511273291 -0400
+++ fixed.js	2026-10-17 16:52:52.793278046 -0400
@@ -1,5 +1,5 @@
 "use strict";
-import { reactive } from "@vue/runtime-core";
+import { reactive } from "vue";
 try {
   reactive(null);
 } catch (e) {
rule documentation given to the models
Summary

- Name: useVueBaseImport
- Fix: safe
- Default severity: info
- Available from version: 2.5.13
- Diagnostic category: lint/nursery/useVueBaseImport

Domains

- Name: vue
- The rule is recommended for this domain
- The rule is enabled when one of these dependencies are detected:
  - vue@>=3.0.0


Description

 Enforce importing Vue's public entry point instead of internal Vue packages.

 The `@vue/runtime-dom`, `@vue/runtime-core`, `@vue/reactivity`, and `@vue/shared` packages are internal implementation packages. Their public exports should be imported from `vue` instead.

Examples

Invalid

 ```js,expect_diagnostic
 import { computed } from "@vue/reactivity";
 ```

 ```js,expect_diagnostic
 export * from "@vue/shared";
 ```

Valid

 ```js
 import { computed } from "vue";
 import { internalOnly } from "@vue/reactivity";
 ```