fixhunt

biome nursery/useVueBaseImport: fix changes program behavior

fix-changes-behaviorlabelled safeprogram-bug · lowrelated
Findings / 2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport / r2-p004biome 2.5.156 → 3 lines2026-10-17 20:51 UTC

Hypothesis Nemotron 3 Super predicted to fire fired 1×

async/await ordering, generators and yield position

Program

before
1import { watch } from "@vue/reactivity";
2async function test() {
3}
after
1import { watch } from "vue";
2async function test() {
3}

Output

stdout beforeexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js
stdout afterexit 1
(no stdout)
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
fired
1 before · 0 after
runs
each version twice, same file name, no network

Judge Nemotron 3 Ultra advisory program-bug · low

Both the original and fixed programs fail with ERR_MODULE_NOT_FOUND because neither '@vue/reactivity' nor 'vue' is installed in the execution environment. The behavioral difference (different missing-package name) stems entirely from the missing dependencies, not from the rewrite itself.

Explanation Nemotron 3 Super unverified

The original import references `@vue/reactivity`, which provides only the reactivity utilities like `watch`. After rewriting to `vue`, it attempts to import everything exported by the main Vue module; if that entry point does not re‑export `watch` or lacks the submodule’s exports, the binding may be missing or different, causing runtime errors when `watch` is used. Even if both resolve successfully, they refer to distinct modules with potentially different implementations, so the program’s behavior changes. This violates semantic preservation because the fix alters which module supplies the imported identifier.

Reproduce

file
prog.js (the before program)
minimized program
r2-p004.js
evidence sheet
r2-p004.md
regression fixture
r2-p004.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js
bunx @biomejs/biome lint --only=nursery/useVueBaseImport --write prog.js
node prog.js

Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra

useVueBaseImport fix · nursery useVueBaseImport import specifier · Biome Vue reactivity base import rewrite · watch import path normalization

  • related biomejs/biome/pull/7597 PR #7597 fixes aliased paths in useImportExtensions, a different rule that also rewrites import specifiers but not the Vue-specific nursery/useVueBaseImport rule
  • related biomejs/biome/pull/3274 PR #3274 adds importMapping options to useImportExtensions, a different rule that also rewrites import specifiers via configuration

Details

program
Async/await ordering, generators and yield position
hazard
async/await ordering, generators and yield position
oracle
stderr before: Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@vue/reactivity' imported from /w/prog.js stderr after: Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'vue' imported from /w/prog.js
run
2026-10-17T20-51-53-018Z-egr4-biome-nursery_useVueBaseImport
generated program (6 lines) and the fix's diff
1import { watch } from "@vue/reactivity";
2async function test() {
3 await Promise.resolve();
4 return watch(() => 1, () => {});
5}
6test().then(r => console.log(typeof r === "function" ? "stop" : "bad"));
--- orig.js	2026-10-17 16:52:53.189284721 -0400
+++ fixed.js	2026-10-17 16:52:53.444289018 -0400
@@ -1,4 +1,4 @@
-import { watch } from "@vue/reactivity";
+import { watch } from "vue";
 async function test() {
   await Promise.resolve();
   return watch(() => 1, () => {});
rule documentation given to the models
Summary

- Name: useVueBaseImport
- Fix: safe
- Default severity: info
- Available from version: 2.5.13
- Diagnostic category: lint/nursery/useVueBaseImport

Domains

- Name: vue
- The rule is recommended for this domain
- The rule is enabled when one of these dependencies are detected:
  - vue@>=3.0.0


Description

 Enforce importing Vue's public entry point instead of internal Vue packages.

 The `@vue/runtime-dom`, `@vue/runtime-core`, `@vue/reactivity`, and `@vue/shared` packages are internal implementation packages. Their public exports should be imported from `vue` instead.

Examples

Invalid

 ```js,expect_diagnostic
 import { computed } from "@vue/reactivity";
 ```

 ```js,expect_diagnostic
 export * from "@vue/shared";
 ```

Valid

 ```js
 import { computed } from "vue";
 import { internalOnly } from "@vue/reactivity";
 ```