
Product
Introducing Socket Fix for Safe, Automated Dependency Upgrades
Automatically fix and test dependency updates with socket fix—a new CLI tool that turns CVE alerts into safe, automated upgrades.
Security News
Sarah Gooding
March 25, 2025
The Biome team has announced the beta release of version 2.0 of their JavaScript/TypeScript toolchain, introducing several significant features that users have been requesting. This release comes amid the broader trend of JavaScript tooling being rewritten in Rust for performance gains, with Biome being one of the more mature projects in this space.
Biome has established itself as a viable alternative to traditional JavaScript tooling combinations like ESLint and Prettier, offering a unified, Rust-powered toolchain with impressive performance. The v2.0 beta introduces several notable features:
noFloatingPromises
rule.Biome's v2.0 beta represents another milestone in what some call the "Rust revolution" in JavaScript tooling. This growing trend includes projects like:
These tools share a common promise: delivering the same functionality as their JavaScript counterparts but with dramatically better performance through Rust's memory efficiency, parallelism capabilities, compile-time safety checks, and performance optimization options.
Another important consideration is what Joshua Goldberg calls "the typed linting gap." In his analysis "Rust-Based JavaScript Linters: Fast, But No Typed Linting Right Now," Goldberg highlights that no Rust-based linter has yet integrated with TypeScript's type-checking APIs.
"I’m not saying you shouldn’t use a Rust-based linter: if you don’t want any of the type-checked lint rules, then sure, switching over is great," Goldberg said. "But I strongly recommend you look through at least the recommended type-checked rules in typescript-eslint to understand what you’re missing first.
"You could even run both tools in tandem: a native-speed linter first for quick feedback, then typescript-eslint for just the rules with type information."
While tools like Biome and Oxlint offer impressive speed, they currently lack the type-checked lint rules that many teams rely on from ESLint and typescript-eslint. Biome v2.0 begins to address this with its first type-aware rule, but the ecosystem still has a way to go before achieving feature parity.
Biome project lead Arend van Beelen Jr. commented on GitHub about the team's approach to type checking, particularly in light of Microsoft's announcement of a native TypeScript compiler. He explained that Biome is pursuing its own type inference solution to ensure a "batteries-included" experience that works without TypeScript installed, avoid inefficiencies from external services duplicating parsing work, and prevent compatibility issues between different ASTs.
While acknowledging that the native TypeScript compiler will address performance concerns, he emphasized that Biome's approach could potentially be faster and more widely applicable. Van Beelen also noted that the team remains open to integrating with TypeScript's API in the future, suggesting it might appear on next year's roadmap as the native compiler develops.
A notable development is that as of January 2025, Biome is offering Enterprise Support, which could allow some contributors to dedicate more time to the project. This move signals Biome's growing maturity and commitment to long-term sustainability.
While the current focus is on the v2.0 beta release, the Biome team has also outlined their roadmap for 2025. It includes plans for HTML support, improved handling of embedded languages (like CSS or GraphQL in JavaScript template literals), and further expansion of the plugin system.
The team acknowledges that being a community-driven project means they cannot guarantee delivery of all planned features, but they've established clear priorities. After the v2.0 release, they intend to collect feedback on the new plugin system to determine which types of plugins to develop next.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Product
Automatically fix and test dependency updates with socket fix—a new CLI tool that turns CVE alerts into safe, automated upgrades.
Security News
CISA denies CVE funding issues amid backlash over a new CVE foundation formed by board members, raising concerns about transparency and program governance.
Product
We’re excited to announce a powerful new capability in Socket: historical data and enhanced analytics.