Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@biomejs/wasm-nodejs
Advanced tools
1.3.0 (2023-10-19)
Import sorting is safe to apply now, and it will be applied when running check --apply
instead
of check --apply-unsafe
.
Import sorting now handles Bun imports bun:<name>
, absolute path imports /<path>
,
and Node's subpath imports #<name>
.
See our documentation for more details. Contributed by @Conaclos
biome lint
now shows the correct options.
Contributed by @ematipicobiome --version
now exits with status code 0
instead of 1
. Contributed by @nhedgerextends
functionality doesn't carry over organizeImports.ignore
. Contributed by @ematipicostdin
and the original content doesn't change. Contributed by
@ematipicoAdd support for BIOME_BINARY
environment variable to override the location of the binary. Contributed by @ematipico
Add option --indent-width
, and deprecated the option --indent-size
. Contributed by @ematipico
Add option --javascript-formatter-indent-width
, and deprecated the option --javascript-formatter-indent-size
.
Contributed by @ematipico
Add option --json-formatter-indent-width
, and deprecated the option --json-formatter-indent-size
. Contributed by
@ematipico
Add option --daemon-logs
to biome rage
. The option is required to view Biome daemon server logs. Contributed by
@unvalley
Add support for logging. By default, Biome doesn't log anything other than diagnostics. Logging can be enabled with
the new option --log-level
:
biome format --log-level=info ./src
There are four different levels of logging, from the most verbose to the least verbose: debug
, info
, warn
and error
. Here's how an INFO
log will look like:
2023-10-05T08:27:01.954727Z INFO Analyze file ./website/src/playground/components/Resizable.tsx
at crates/biome_service/src/file_handlers/javascript.rs:298 on biome::worker_5
in Pulling diagnostics with categories: RuleCategories(SYNTAX)
in Processes formatting with path: "./website/src/playground/components/Resizable.tsx"
in Process check with path: "./website/src/playground/components/Resizable.tsx"
You can customize how the log will look like with a new option --log-kind
. The supported kinds
are: pretty
, compact
and json
.
pretty
is the default logging. Here's how a compact
log will look like:
2023-10-05T08:29:04.864247Z INFO biome::worker_2 Process check:Processes linting:Pulling diagnostics: crates/biome_service/src/file_handlers/javascript.rs: Analyze file ./website/src/playground/components/Resizable.tsx path="./website/src/playground/components/Resizable.tsx" path="./website/src/playground/components/Resizable.tsx" categories=RuleCategories(LINT)
2023-10-05T08:29:04.864290Z INFO biome::worker_7 Process check:Processes formatting: crates/biome_service/src/file_handlers/javascript.rs: Format file ./website/src/playground/components/Tabs.tsx path="./website/src/playground/components/Tabs.tsx" path="./website/src/playground/components/Tabs.tsx"
2023-10-05T08:29:04.879332Z INFO biome::worker_2 Process check:Processes formatting:Pulling diagnostics: crates/biome_service/src/file_handlers/javascript.rs: Analyze file ./website/src/playground/components/Resizable.tsx path="./website/src/playground/components/Resizable.tsx" path="./website/src/playground/components/Resizable.tsx" categories=RuleCategories(SYNTAX)
2023-10-05T08:29:04.879383Z INFO biome::worker_2 Process check:Processes formatting: crates/biome_service/src/file_handlers/javascript.rs: Format file ./website/src/playground/components/Resizable.tsx path="./website/src/playground/components/Resizable.tsx" path="./website/src/playground/components/Resizable.tsx"
ROME_BINARY
. Use BIOME_BINARY
instead. Contributed by @ematipico.git
folder when VCS support is enabled. Contributed by @ematipicobiome rage
doesn't print the logs of the daemon, use biome rage --daemon-logs
to print them. Contributed by
@unvalleyAdd option formatter.indentWidth
, and deprecated the option formatter.indentSize
. Contributed by @ematipico
Add option javascript.formatter.indentWidth
, and deprecated the option javascript.formatter.indentSize
.
Contributed by @ematipico
Add option json.formatter.indentWidth
, and deprecated the option json.formatter.indentSize
. Contributed by
@ematipico
Add option include
to multiple sections of the configuration
files.include
;formatter.include
;linter.include
;organizeImports.include
;
When include
and ignore
are both specified, ignore
takes precedence over include
Add option overrides
, where users can modify the behaviour of the tools for certain files or paths.
For example, it's possible to modify the formatter lineWidth
, and even quoteStyle
for certain files that are
included in glob path generated/**
:
{
"formatter": {
"lineWidth": 100
},
"overrides": [
{
"include": ["generated/**"],
"formatter": {
"lineWidth": 160
},
"javascript": {
"formatter": {
"quoteStyle": "single"
}
}
}
]
}
Or, you can disable certain rules for certain path, and disable the linter for other paths:
{
"linter": {
"enabled": true,
"rules": {
"recommended": true
}
},
"overrides": [
{
"include": ["lib/**"],
"linter": {
"rules": {
"suspicious": {
"noDebugger": "off"
}
}
}
},
{
"include": ["shims/**"],
"linter": {
"enabled": false
}
}
]
}
extends
was incorrectly applied to the biome.json
file.
Contributed by @ematipicoFix #404. Biome intellij plugin now works on Windows. Contributed by @victor-teles
Fix #402. Biome format
on intellij plugin now recognize biome.json.
Contributed by @victor-teles
OnceCell
for the Memoized memory because that's what the RefCell<Option>
implemented. Contributed by
@denbezrukovThe following rules are now recommended:
Add noEmptyCharacterClassInRegex rule. The rule reports empty character classes and empty negated character classes in regular expression literals. Contributed by @Conaclos
Add noMisleadingInstantiator rule. The rule reports the
misleading use of the new
and constructor
methods. Contributed by @unvalley
Add noUselessElse rule.
The rule reports else
clauses that can be omitted because their if
branches break.
Contributed by @Conaclos
Add noUnusedImports rule. The rule reports unused imports and suggests removing them. Contributed by @Conaclos
noUnusedVariables reports also unused imports, but don't suggest their removal. Once noUnusedImports stabilized, noUnusedVariables will not report unused imports.
Add useShorthandAssign rule. The rule enforce use of shorthand operators that combine variable assignment and some simple mathematical operations. For example, x = x + 4 can be shortened to x += 4. Contributed by @victor-teles
Add useAsConstAssertion rule.
The rule enforce use of as const
assertion to infer literal types.
Contributed by @unvalley
Add noMisrefactoredShorthandAssign rule.
The rule reports shorthand assigns when variable appears on both sides. For example x += x + b
Contributed by @victor-teles
Add noApproximativeNumericConstant rule. Contributed by @nikeee
Add noInteractiveElementToNoninteractiveRole rule. The rule enforces the non-interactive ARIA roles are not assigned to interactive HTML elements. Contributed by @nissy-dev
Add useAriaActivedescendantWithTabindex
rule. The rule enforces that tabIndex
is assigned to non-interactive HTML elements with aria-activedescendant
.
Contributed by @nissy-dev
Add noUselessLoneBlockStatements rule. The rule reports standalone blocks that don't include any lexical scoped declaration. Contributed by @emab
Add noInvalidNewBuiltin rule.
The rule reports use of new
on Symbol
and BigInt
. Contributed by @lucasweng
The following rules have now safe code fixes:
noAccumulatingSpread makes more check in order to reduce potential false positives. Contributed by @Vivalldi
noConstAssign now provides an unsafe code fix that
replaces const
with let
. Contributed by @vasucp1207
noExcessiveComplexity default complexity
threshold is now 15
. Contributed by @arendjr
noPositiveTabindexValue now provides an unsafe code fix that
set to 0
the tab index. Contributed by @vasucp1207
noUnusedLabels no longer reports unbreakable labeled statements. Contributed by @Conaclos
noUnusedVariables now reports unused TypeScript's type parameters. Contributed by @Conaclos
useAnchorContent now provides an unsafe code fix that removes the `aria-hidden`` attribute. Contributed by @vasucp1207
useValidAriaProps now provides an unsafe code fix that removes invalid properties. Contributed by @vasucp1207
noExcessiveComplexity
was renamed to noExcessiveCognitiveComplexity
Fix #294. noConfusingVoidType no longer reports false positives for return types. Contributed by @b4s36t4
Fix #313. noRedundantUseStrict now keeps leading comments.
Fix #383. noMultipleSpacesInRegularExpressionLiterals now provides correct code fixes when consecutive spaces are followed by a quantifier. Contributed by @Conaclos
Fix #397. useNumericLiterals now provides correct code fixes for signed numbers. Contributed by @Conaclos
Fix 452. The linter panicked when it met a malformed regex (a regex not ending with a slash).
Fix #104. We now correctly handle types and values with the same name.
Fix #243 a false positive case where the incorrect scope was defined
for the infer
type in rule noUndeclaredVariables.
Contributed by @denbezrukov
Fix #322, now noSelfAssign correctly handles literals inside call expressions.
Changed how noSelfAssign behaves. The rule is not triggered anymore on function calls. Contributed by @ematipico
Enhance diagnostic for infer type handling in the parser. The 'infer' keyword can only be utilized within the ' extends' clause of a conditional type. Using it outside this context will result in an error. Ensure that any type declarations using 'infer' are correctly placed within the conditional type structure to avoid parsing issues. Contributed by @denbezrukov
Add support for parsing trailing commas inside JSON files:
{
"json": {
"parser": {
"allowTrailingCommas": true
}
}
}
Contributed by @nissy-dev
FAQs
WebAssembly bindings to the Biome workspace API
The npm package @biomejs/wasm-nodejs receives a total of 29,643 weekly downloads. As such, @biomejs/wasm-nodejs popularity was classified as popular.
We found that @biomejs/wasm-nodejs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.