# biome correctness/noGlobalDirnameFilename: fix changes program behavior

Internal evidence sheet generated by fixhunt. Not an issue text. A human re-verifies, checks the duplicates
below, and writes the upstream report in their own words following the project's AI policy.

- Tool: biome 2.5.15
- Rule: correctness/noGlobalDirnameFilename (tool labels the fix: safe, this fix reported as safe)
- Oracle: fix-changes-behavior
- Judge (Nemotron 3 Ultra, advisory): program-bug, severity high. The program runs as an ES module where __dirname is not defined, so it crashes before the fix. The rewrite replaces __dirname with import.meta.dirname, which is the correct ES-module equivalent and makes the program run successfully. The behavior change is caused by the module system environment, not by a defect in the fix.
- Program: minimized from 4 to 2 lines

## Reproducer

```js
const o = {};
o[`__proto__${__dirname}`] = 'tampered';
```

## Commands

```sh
node prog.js
bunx @biomejs/biome lint --only=correctness/noGlobalDirnameFilename --write prog.js
node prog.js
```

## Observed

```
exit 1 → 0
stderr before: ReferenceError: __dirname is not defined in ES module scope
stderr after: (none)
```

## Diff applied by the fix

```diff
--- orig.js	2026-10-22 13:26:56.160475244 -0400
+++ fixed.js	2026-10-22 13:26:56.276477170 -0400
@@ -1,2 +1,2 @@
 const o = {};
-o[`__proto__${__dirname}`] = 'tampered';
+o[`__proto__${import.meta.dirname}`] = 'tampered';
```

## Why the rewrite is not equivalent (model draft, verify before use)

The original code uses `__dirname`, which is undefined in ES modules, causing a `ReferenceError`. The replacement with `import.meta.dirname` resolves to the directory of the current module file, so the property name becomes `'__proto__' + <actual path>`, avoiding the error. This changes the object key from one that would trigger prototype pollution via `__proto__` to a unique string key, altering behavior: the original would have modified `Object.prototype` if `__dirname` were defined, but now it sets a regular property on `o`, preventing the tampering effect intended in the unsafe pattern. Thus, the semantics differ.

## Upstream search

Queries: "noGlobalDirnameFilename fix", "correctness noGlobalDirnameFilename import meta dirname", "__dirname replacement import.meta.dirname es modules", "biome lint rule global variable substitution"

- duplicate: https://github.com/biomejs/biome/issues/11028
  same rule (noGlobalDirnameFilename) and same defect (false positive on __dirname/__filename in modules where they are not defined)

<details><summary>All hits</summary>

- [github, open] 💅 `noUnnecessaryConditions`: false positive on an overloaded call with `undefined` as the default argument (Vue `inject`) — https://github.com/biomejs/biome/issues/12040
- [github, open] 💅 noLeakedRender false positive when using useState<boolean> — https://github.com/biomejs/biome/issues/10790
- [github, closed] 💅 `useSimplifiedLogicExpression` "safe" fix breaks code — https://github.com/biomejs/biome/issues/11351
- [github, closed] 💅 `useExplicitLengthCheck` false positive and broken fix — https://github.com/biomejs/biome/issues/11558
- [github, closed] 💅 `useExplicitLengthCheck` false positive — https://github.com/biomejs/biome/issues/11352
- [github, closed] 💅 Corrupted CLI safe fix for `useConsistentArrowReturn` — https://github.com/biomejs/biome/issues/8347
- [github, closed] 💅 lint/nursery/noUselessUndefined fix is unsafe for functions with union return types — https://github.com/biomejs/biome/issues/6906
- [github, closed] 💅 `useConsistentCurlyBraces` not working with string children — https://github.com/biomejs/biome/issues/7579
- [github, closed] 💅 `noLeakedRender` false positives — https://github.com/biomejs/biome/issues/10514
- [github, closed] 💅 2.1.2 broke SolidJS store syntax — https://github.com/biomejs/biome/issues/6998
- [tavily] biome migrate --write accesses the whole filesystem, takes minutes · Issue #7361 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/7361
- [tavily] 💅 useConsistentTypeDefinitions should ignore interfaces in global declarations · Issue #8449 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/8449
- [tavily] 💅 `noProcessGlobal` imports from `node::process` instead of `node:process` · Issue #5778 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/5778
- [tavily] 💅 [v2] Overrides not working when all linter category rules are on · Issue #5456 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/5456
- [tavily] 💅 noNoninteractiveElementInteractions marks `dialog` as non-interactive · Issue #7783 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/7783
- [tavily] 💅 False positive by lint/nursery/noUselessUndefined · Issue #6577 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/6577
- [tavily] 💅 `noUnresolvedImports`: multiple categories of false positives · Issue #9143 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/9143
- [github, closed] 💅 false positive of `noGlobalDirnameFilename` in CommonJS module — https://github.com/biomejs/biome/issues/11028
- [tavily] 💅 `noUnknownAttribute` doesn't support SVG opacity · Issue #7967 · biomejs/biome · GitHub — https://github.com/biomejs/biome/issues/7967
- [github, closed] 💅 noUnnecessaryConditions: false positive on useRef(...).current null-guards (regression in 2.5.6) — https://github.com/biomejs/biome/issues/11360

</details>