Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@biomejs/wasm-nodejs
Advanced tools
1.5.2 (2024-01-15)
Fix #1512 by skipping verbose diagnostics from the count. Contributed by @ematipico
Correctly handle cascading include
and ignore
.
Previously Biome incorrectly included files that were included at tool level and ignored at global level.
In the following example, file.js
was formatted when it should have been ignored.
Now, Biome correctly ignores the directory ./src/sub/
.
❯ tree src
src
└── sub
└── file.js
❯ cat biome.json
{
"files": { "ignore": ["./src/sub/"] },
"formatter": { "include": ["./src"] }
}
Contributed by @Conaclos
Don't emit verbose warnings when a protected file is ignored.
Some files, such as package.json
and tsconfig.json
,
are protected.
Biome emits a verbose warning when it encounters a protected file.
Previously, Biome emitted this verbose warning even if the file was ignored by the configuration. Now, it doesn't emit verbose warnings for protected files that are ignored.
Contributed by @Conaclos
overrides
no longer affect which files are ignored. Contributed by @Conaclos
The file biome.json
can't be ignored anymore. Contributed by @ematipico
Fix #1541 where the content of protected files wasn't returned
to stdout
. Contributed by @ematipico
Don't handle CSS files, the formatter isn't ready yet. Contributed by @ematipico
Fix 1440, a case where extends
and overrides
weren't correctly
emitting the final configuration. Contributed by @arendjr
Correctly handle include
when ignore
is set (#1468). Contributed by @Conaclos
Previously, Biome ignored include
if ignore
was set.
Now, Biome check both include
and ignore
.
A file is processed if it is included and not ignored.
If include
is not set all files are considered included.
Fix placement of comments before *
token in generator methods with
decorators. #1537 Contributed by @ah-yu
Fix #1406. Ensure comments before the async
keyword are placed
before it. Contributed by @ah-yu
Fix #1172. Fix placement of line comment after function expression parentheses, they are now attached to first statement in body. Contributed by @kalleep
Fix #1511 that made the JavaScript formatter crash. Contributed @Conaclos
Add an unsafe code fix for noConsoleLog. Contributed by @vasucp1207
useArrowFunction no longer reports function in extends
clauses or in a new
expression. Contributed by @Conaclos
These cases require the presence of a prototype.
Add dependency variable names on error message when useExhaustiveDependencies rule shows errors. Contributed by @mehm8128
The fix of useArrowFunction now adds parentheses around the arrow function in more cases where it is needed (#1524).
A function expression doesn't need parentheses in most expressions where it can appear. This is not the case with the arrow function. We previously added parentheses when the function appears in a call or member expression. We now add parentheses in binary-like expressions and other cases where they are needed, hopefully covering all cases.
Previously:
- f = f ?? function() {};
+ f = f ?? () => {};
Now:
- f = f ?? function() {};
+ f = f ?? (() => {});
Contributed by @Conaclos
Fix #1514. Fix autofix suggestion to avoid the syntax error
in no_useless_fragments
. Contributed by @togami2864
FAQs
WebAssembly bindings to the Biome workspace API
The npm package @biomejs/wasm-nodejs receives a total of 29,643 weekly downloads. As such, @biomejs/wasm-nodejs popularity was classified as popular.
We found that @biomejs/wasm-nodejs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.