# biome suspicious/noPrototypeBuiltins: fix changes program behavior

Internal evidence sheet generated by fixhunt. Not an issue text. A human re-verifies, checks the duplicates
below, and writes the upstream report in their own words following the project's AI policy.

- Tool: biome 2.5.15
- Rule: suspicious/noPrototypeBuiltins (tool labels the fix: safe, this fix reported as safe)
- Oracle: fix-changes-behavior
- Judge (Nemotron 3 Ultra, advisory): intended-change, severity high. The rule explicitly rewrites direct calls like obj.hasOwnProperty('x') to Object.hasOwn(obj, 'x') to bypass shadowed or missing prototype methods. The program demonstrates this by defining a non-function hasOwnProperty on obj, causing the original to throw a TypeError while the fixed version succeeds. This behavioral change is the documented purpose of the rule.
- Program: minimized from 13 to 10 lines

## Reproducer

```js
const obj = {};
Object.defineProperty(obj, 'hasOwnProperty', { value: 42, writable: false });
try {
  obj.hasOwnProperty('x');
} catch (e) {
  console.log('Original threw:', e.name, ':', e.message);
}
try {
} catch (e) {
}
```

## Commands

```sh
node prog.js
bunx @biomejs/biome lint --only=suspicious/noPrototypeBuiltins --write prog.js
node prog.js
```

## Observed

```
stdout before:
Original threw: TypeError : obj.hasOwnProperty is not a function
stdout after:
```

## Diff applied by the fix

```diff
--- orig.js	2026-10-22 13:37:07.978741051 -0400
+++ fixed.js	2026-10-22 13:37:10.524784083 -0400
@@ -1,7 +1,7 @@
 const obj = {};
 Object.defineProperty(obj, 'hasOwnProperty', { value: 42, writable: false });
 try {
-  obj.hasOwnProperty('x');
+  Object.hasOwn(obj, 'x');
 } catch (e) {
   console.log('Original threw:', e.name, ':', e.message);
 }
```

## Why the rewrite is not equivalent (model draft, verify before use)

The original call `obj.hasOwnProperty('x')` attempts to invoke the property named `'hasOwnProperty'` on `obj`, which was defined as a non‑function value (`42`), causing a `TypeError`. The replacement `Object.hasOwn(obj, 'x')` calls the static method `Object.hasOwn`, bypassing the overridden property entirely and returning `false` without throwing. Since the observable behavior—throwing an exception versus returning normally—differs, the transformation does not preserve program semantics.

## Upstream search

Queries: "noPrototypeBuiltins fix", "suspicious noPrototypeBuiltins hasOwnProperty call", "biome lint rule suspicious noPrototypeBuiltins method override", "fix behavior change Object.hasOwn vs obj.hasOwnProperty"

- related: https://github.com/biomejs/biome/issues/10769
  useLiteralKeys flags __proto__ with unsafe fix conflicting with noProto, same rule family (suspicious/noPrototypeBuiltins) but different construct (__proto__ vs hasOwnProperty)

<details><summary>All hits</summary>

- [github, open] 💅 `useSortedProperties` can produce invalid CSS when the final semicolon is omitted — https://github.com/biomejs/biome/issues/12417
- [github, open] 💅 `useSortedProperties` moves Sass variable declarations below their uses — https://github.com/biomejs/biome/issues/12414
- [github, open] 💅 `useSortedProperties` can change behavior when reordering nested CSS rules — https://github.com/biomejs/biome/issues/12413
- [github, open] 💅 `noUnnecessaryConditions`: false positive on an overloaded call with `undefined` as the default argument (Vue `inject`) — https://github.com/biomejs/biome/issues/12040
- [github, open] 💅 `noSkippedTests` conditionally skip fix suggestion — https://github.com/biomejs/biome/issues/9295
- [github, open] 💅 Actually used private method considered unused — https://github.com/biomejs/biome/issues/8185
- [github, open] 💅 cannot detect that the StrictMode component of React is being exported. — https://github.com/biomejs/biome/issues/10609
- [github, open] 💅 noUnnecessaryConditions callback overload false positive — https://github.com/biomejs/biome/issues/11439
- [github, open] 💅 lint/a11y/useAnchorContent: the PascalCase component allowance is applied only to self-closing elements — https://github.com/biomejs/biome/issues/11872
- [github, open] 💅 useLiteralKeys flags `__proto__` in a computed member expression and offers an unsafe fix that conflicts with noProto — https://github.com/biomejs/biome/issues/10769
- [github, closed] 💅 `noThisInStatic` safe fix is not safe — https://github.com/biomejs/biome/issues/10011
- [github, closed] 🐛 Biome LSP is treating typescript files as if they were javascript files — https://github.com/biomejs/biome/issues/3839
- [github, closed] 💅 Linter "safe fix" of "let -> const" breaks Svelte apps — https://github.com/biomejs/biome/issues/3556

</details>