Skip to content

[Snyk] Upgrade @biomejs/biome from 1.8.3 to 2.1.3 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
snyk-io wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade @biomejs/biome from 1.8.3 to 2.1.3 #22

snyk-io wants to merge 1 commit into from

Conversation

@snyk-io
Copy link

@snyk-io snyk-io bot commented Aug 21, 2025

snyk-top-banner

Snyk has created this PR to upgrade @biomejs/biome from 1.8.3 to 2.1.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 34 versions ahead of your current version.

  • The recommended version was released 23 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BABELHELPERS-9397697		 140 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BABELRUNTIME-10044504		 140 Proof of Concept
medium severity Symlink Attack
SNYK-JS-TMP-11501554		 140 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 140 Proof of Concept
Release notes
Package name: @biomejs/biome
  • 2.1.3 - 2025-07-29

    2.1.3

    Patch Changes

    • #7057 634a667 Thanks @ mdevils! - Added the rule noVueReservedKeys, which prevents the use of reserved Vue keys.

      It prevents the use of Vue reserved keys such as those starting with # @ biomejs/biome (like $el, $data, $props) and keys starting with _` in data properties, which can cause conflicts and unexpected behavior in Vue components.

      Invalid example
      <script>
export default {
  data: {
    $el: "",
    _foo: "bar",
  },
};
</script>
      <script>
export default {
  computed: {
    $data() {
      return this.someData;
    },
  },
};
</script>
      Valid examples
      <script>
export default {
  data() {
    return {
      message: "Hello Vue!",
      count: 0,
    };
  },
};
</script>
      <script>
export default {
  computed: {
    displayMessage() {
      return this.message;
    },
  },
};
</script>

    • #6941 734d708 Thanks @ JamBalaya56562! - Added @ eslint-react/no-nested-component-definitions as a rule source for noNestedComponentDefinitions. Now it will get picked up by biome migrate --eslint.

    • #6463 0a16d54 Thanks @ JamBalaya56562! - Fixed a website link for the useComponentExportOnlyModules linter rule to point to the correct URL.

    • #6944 e53f2fe Thanks @ sterliakov! - Fixed #6910: Biome now ignores type casts and assertions when evaluating numbers for noMagicNumbers rule.

    • #6991 476cd55 Thanks @ denbezrukov! - Fixed #6973: Add support for parsing the :active-view-transition-type() pseudo-class

      :active-view-transition-type(first second) {
}

    • #6992 0b1e194 Thanks @ ematipico! - Added a new JSON rule called noQuickfixBiome, which disallow the use of code action quickfix.biome inside code editor settings.

    • #6943 249306d Thanks @ JamBalaya56562! - Fixed @ vitest/eslint-plugin source url.

    • #6947 4c7ed0f Thanks @ JamBalaya56562! - Fixed ESLint migration for the rule prefer-for from eslint-plugin-solid to Biome's useForComponent.

    • #6976 72ebadc Thanks @ siketyan! - Fixed #6692: The rules noUnusedVariables and noUnusedFunctionParameters no longer cause an infinite loop when the suggested name is not applicable (e.g. the suggested name is already declared in the scope).

    • #6990 333f5d0 Thanks @ rvanlaarhoven! - Fixed the documentation URL for lint/correctness/noUnknownPseudoClass

    • #7000 4021165 Thanks @ harxki! - Fixed #6795: noUnassignedVariables now correctly recognizes variables used in JSX ref attributes.

    • #7044 b091ddf Thanks @ ematipico! - Fixed #6622, now the rule useSemanticElements works for JSX self-closing elements too.

    • #7014 c4864e8 Thanks @ siketyan! - Fixed #6516: The biome migrate command no longer break the member list with trailing comments.

    • #6979 29cb6da Thanks @ unvalley! - Fixed #6767: useSortedClasses now correctly removes leading and trailing whitespace in className.

      Previously, trailing spaces in className were not fully removed.

      // Think we have this code:
      <div className="text-sm font-bold " />

      // Before: applied fix, but a trailing space was preserved
      <div className="font-bold text-sm " />

      // After: applied fix, trailing spaces removed
      <div className="font-bold text-sm" />

    • #7055 ee4828d Thanks @ dyc3! - Added the nursery rule useReactFunctionComponents. This rule enforces the preference to use function components instead of class components.

      Valid:

      function Foo() {
  return <div>Hello, world!</div>;
}

      Invalid:

      class Foo extends React.Component {
  render() {
    return <div>Hello, world!</div>;
  }
}

    • #6924 2d21be9 Thanks @ ematipico! - Fixed #113, where the Biome Language Server didn't correctly update the diagnostics when the configuration file is modified in the editor. Now the diagnostics are correctly updated every time the configuration file is modified and saved.

    • #6931 e6b2380 Thanks @ arendjr! - Fixed #6915: useHookAtTopLevel no longer hangs when rules call themselves recursively.

    • #7012 01c0ab4 Thanks @ siketyan! - Fixed #5837: Invalid suppression comments such as biome-ignore-all-start or biome-ignore-all-end no longer causes a panic.

    • #6949 48462f8 Thanks @ fireairforce! - Support parse import defer(which is a stage3 proposal). The syntax look like this:

      import defer * as foo from "<specifier>";

    • #6938 5feb5a6 Thanks @ vladimir-ivanov! - Fixed #6919 and #6920:
      useReadonlyClassProperties now does checks for mutations in async class methods.

      Example:

      class Counter3 {
  private counter: number;
  async count() {
    this.counter = 1;
    const counterString = `${this.counter++}`;
  }
}

    • #6942 cfda528 Thanks @ sterliakov! - Fixed #6939. Biome now understands this binding in classes outside of methods.

    What's Changed

    New Contributors

    Full Changelog: https://github.com/biomejs/biome/compare/@ biomejs/biome@2.1.2...@ biomejs/biome@2.1.3

  • 2.1.2 - 2025-07-17

    2.1.2

    Patch Changes

    • #6865 b35bf64 Thanks @ denbezrukov! - Fix #6485: Handle multiple semicolons correctly in blocks (#6485)

      div {
  box-sizing: border-box;
  color: red;
}

    • #6798 3579ffa Thanks @ dyc3! - Fixed #6762, Biome now knows that ~/.config/zed/settings.json and ~/.config/Code/User/settings.json allows comments by default.

    • #6839 4cd62d8 Thanks @ ematipico! - Fixed #6838, where the Biome File Watcher incorrectly watched and stored ignored files, causing possible memory leaks when those files were dynamically created (e.g. built files).

    • #6879 0059cd9 Thanks @ denbezrukov! - Refactor: remove one level of indirection for CSS declarations with semicolon
      Previously, accessing a declaration from a list required an extra step:

      item
.as_any_css_declaration_with_semicolon()
.as_css_declaration_with_semicolon()

      Now, it can be done directly with:

      item.as_css_declaration_with_semicolon()

    • #6839 4cd62d8 Thanks @ ematipico! - Fixed a bug where the Biome Language Server didn't correctly ignore specific files when vcs.useIgnoreFile is set to true.

    • #6884 5ff50f8 Thanks @ arendjr! - Improved the performance of noImportCycles by ~30%.

    • #6903 241dd9e Thanks @ arendjr! - Fixed #6829: Fixed a false positive reported by useImportExtensions when importing a .js file that had a matching .d.ts file in the same folder.

    • #6846 446112e Thanks @ darricheng! - Fixed an issue where biome was using the wrong string quotes when the classes string has quotes, resulting in invalid code after applying the fix.

    • #6823 eebc48e Thanks @ arendjr! - Improved #6172: Optimised the way function arguments are stored in Biome's type inference. This led to about 10% performance improvement in RedisCommander.d.ts and about 2% on @ next/font type definitions.

    • #6878

@semanticdiff-com
Copy link

semanticdiff-com bot commented Aug 21, 2025 •
edited
Loading

Review changes with  SemanticDiff

Changed Files
File Status
  package.json  34% smaller

@snyk-io
Copy link
Author

snyk-io bot commented Aug 21, 2025

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants