Skip to content

Conversation

@miccy
Copy link
Collaborator

@miccy miccy commented Dec 24, 2025

Goal

Adopt Biome as the sole tool for linting and formatting.

Changes

  • Replaced ESLint and Prettier with Biome across the monorepo.
  • Created shared @evolu/biome-config package.
  • Updated package.json scripts (lint -> biome check, format -> biome check --write).
  • Integrated lint and format tasks with Turborepo.
  • Fixed formatting and linting issues identified by Biome.
  • Cherry-picked critical fixes from dev-v8.

Verification

  • pnpm lint passes (using Biome)
  • pnpm format passes (using Biome)
  • All packages use shared Biome config

Updated the 'engines.node' field from >=22.0.0 to >=24.0.0 across all package.json files to require the current LTS version. This is a major version change for all affected packages.
Introduces polyfills for Symbol.dispose, Symbol.asyncDispose, DisposableStack, and AsyncDisposableStack to support automatic resource cleanup in environments lacking native support. Updates documentation and navigation to cover resource management concepts and usage. Refactors example to use DisposableStack for safer URL cleanup. Adds comprehensive tests for polyfill correctness and updates Result tests for resource management patterns.
Groups tests for resource management under more descriptive nested 'describe' blocks for 'using keyword', 'DisposableStack', and 'AsyncDisposableStack'. This improves test organization and readability without changing test logic.
Introduces tests demonstrating generator-based monadic composition with the Result type, comparing imperative and generator patterns, verifying type inference, performance, and resource disposal behavior. These tests illustrate how generator composition can reduce boilerplate.
Added 'sql.raw' to the embeddedSqlTags in prettier.config.mjs to support additional SQL formatting. Updated .prettierignore to adjust ignored paths for API reference MDX files.
Bump various dependencies including @typescript-eslint, shiki, vitest, @op-engineering/op-sqlite, @react-navigation, electron-to-chromium, sf-symbols-typescript, and tinyexec to their latest versions for improved stability, features, and security.
Updated the 'engines.node' field from >=22.0.0 to >=24.0.0 across all package.json files to require the current LTS version. This is a major version change for all affected packages.
Introduces polyfills for Symbol.dispose, Symbol.asyncDispose, DisposableStack, and AsyncDisposableStack to support automatic resource cleanup in environments lacking native support. Updates documentation and navigation to cover resource management concepts and usage. Refactors example to use DisposableStack for safer URL cleanup. Adds comprehensive tests for polyfill correctness and updates Result tests for resource management patterns.
Groups tests for resource management under more descriptive nested 'describe' blocks for 'using keyword', 'DisposableStack', and 'AsyncDisposableStack'. This improves test organization and readability without changing test logic.
Introduces tests demonstrating generator-based monadic composition with the Result type, comparing imperative and generator patterns, verifying type inference, performance, and resource disposal behavior. These tests illustrate how generator composition can reduce boilerplate.
Added 'sql.raw' to the embeddedSqlTags in prettier.config.mjs to support additional SQL formatting. Updated .prettierignore to adjust ignored paths for API reference MDX files.
Bump various dependencies including @typescript-eslint, shiki, vitest, @op-engineering/op-sqlite, @react-navigation, electron-to-chromium, sf-symbols-typescript, and tinyexec to their latest versions for improved stability, features, and security.
steida and others added 7 commits January 12, 2026 11:52
Major rewrite of Task.ts to implement JavaScript-native structured concurrency, including new types for Task, Runner, Fiber, and AsyncDisposableStack. Adds support for dependency injection, resource management, and monitoring via Runner events. Updates documentation and examples to reflect new API and usage patterns.
- Take Steida's new code: Task.ts (structured concurrency), Schedule, Listeners, Set, Tracer
- Preserve our Biome/Bun migration (no ESLint/Prettier)
- Remove: eslint.config.mjs, prettier.config.mjs, .prettierignore
- Keep: biome.json, Bun scripts in package.json

New modules from upstream:
- Task.ts: Complete rewrite with Runner, Fiber, AsyncDisposableStack
- OldTask.ts: Backward compatibility for WebSocket
- Schedule.ts: Composable retry/repeat strategies
- Listeners.ts: Pub-sub notifications
- Set.ts: Type-safe immutable Set helpers
- Tracer.ts: Observability interface
@snyk-io
Copy link

snyk-io bot commented Jan 12, 2026

⚠️ Snyk checks are incomplete.

Status Scanner Critical High Medium Low Total (0)
⚠️ Open Source Security 0 0 0 0 See details

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@socket-security
Copy link

socket-security bot commented Jan 12, 2026

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Critical
Critical CVE: Happy DOM: VM Context Escape can lead to Remote Code Execution in npm happy-dom

CVE: GHSA-37j7-fg3j-429f Happy DOM: VM Context Escape can lead to Remote Code Execution (CRITICAL)

Affected versions: < 20.0.0

Patched version: 20.0.0

From: packages/react-web/package.jsonnpm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Telemetry collection: npm next

Note: Can be disabled by setting the environment variable NEXT_TELEMETRY_DISABLED=1 . See https://nextjs.org/telemetry for more information

From: apps/web/package.jsonnpm/[email protected]

ℹ Read more on: This package | This alert | What is telemetry?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm typescript

License: LicenseRef-W3C-Community-Final-Specification-Agreement - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt)

From: packages/react-web/package.jsonnpm/[email protected]

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm vite is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @rollup/rollup-linux-loong64-musl

Location: Package overview

From: ?npm/[email protected]npm/@rollup/[email protected]

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rollup/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @rollup/rollup-linux-ppc64-musl

Location: Package overview

From: ?npm/[email protected]npm/@rollup/[email protected]

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rollup/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @rollup/rollup-openbsd-x64

Location: Package overview

From: ?npm/[email protected]npm/@rollup/[email protected]

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rollup/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Deprecated by its maintainer: npm memoize-one

Reason: New custom equality api does not play well with all equality helpers. Please use v5.x

From: ?npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is a deprecated package?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm obug

Location: Package overview

From: ?npm/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

miccy and others added 18 commits January 12, 2026 14:17
Updated the build script to set NODE_OPTIONS=--max-old-space-size=8192, increasing the memory allocation for Next.js builds from 4GB to 8GB to help prevent out-of-memory errors during the build process.
Added details about the web build process, including the use of webpack, memory options to prevent heap OOM, and macOS-specific file limit instructions. Clarifies that 'pnpm build:web' builds both docs and web.
Disabled the use of fast-glob and dynamic importing of MDX files in the docs layout to improve build and hot reload performance. Added a note explaining the reason and replaced the dynamic section loading with an empty object.
Replaces unnecessary async arrow functions with synchronous ones in Task-related tests, improving readability and reducing boilerplate.
- Sync all commits from upstream/common-v8
- Resolve conflicts in Task.ts and Task.test.ts
- Unify dependencies across monorepo (React 19.2.3, TS 5.9.3, Vitest 4.0.17)
- Update root README.md to use Bun and Biome conventions
- Migrate root package.json scripts to Bun
- Fix Typedoc generation by disabling Prettier integration
- Fix linting and types in apps/web and packages
@miccy miccy closed this Jan 16, 2026
@miccy miccy deleted the feat/m0-biome branch January 16, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

biome Biome tooling bun Bun runtime dependencies Pull requests that update a dependency file feature New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[M0] Biome Migration: Replace ESLint+Prettier

2 participants