@uppy: upgrade biome and more improvements by qxprakash · Pull Request #6244 · transloadit/uppy

qxprakash · 2026-03-26T12:17:00Z

This PR upgrades biome from 2.0.5 -> 2.1.2 and adds two new rules
- noUnusedImports ( we already had suppressions for this rule in code, but the rule itself was never enabled in the config )
- noUnusedPrivateClassMembers
remove stale suppressions.
remove stale code.

changeset-bot · 2026-03-26T12:17:06Z

⚠️ No Changeset found

Latest commit: ebbfbc9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-03-26T12:17:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	supertest@6.2.4
	@types/webpack@5.28.5
	@types/ms@0.7.31
	@types/cookie-parser@1.4.2
	@types/mime-types@2.1.4
	@types/cors@2.8.6
	@react-router/express@7.12.0
	cssnano@7.0.7
	multer@2.0.2
	jsdom@26.1.0
	@types/express@5.0.6
	escape-string-regexp@5.0.0
	@types/supertest@6.0.3
	@types/compression@1.7.0
	@types/jsonwebtoken@8.3.7
	@types/morgan@1.7.37
	@types/common-tags@1.8.4
	@types/node-schedule@2.1.8
	@types/http-proxy@1.17.16
	@types/express-session@1.17.3
	@types/ws@8.5.3
	@types/request@2.48.8
	he@1.2.0
	concat-stream@2.0.0
	escape-goat@4.0.0
	express-interceptor@1.2.0
	http-proxy@1.18.1
	namespace-emitter@2.0.1
	@types/jasmine@5.1.4
	@react-router/dev@7.12.0
	@angular/animations@19.2.17
	@types/validator@13.15.10
	@types/eslint@8.56.10
See 65 more rows in the dashboard

View full report

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dde27afd84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

mifi · 2026-03-26T14:57:37Z

looks good but I think we should wait until typescript pr #6179 is merged

mifi · 2026-05-09T02:52:41Z

once the conflicts are resolved i think this can be merged

…de_biome

qxprakash

upgraded biome 2.1.2 → 2.4.15
added html.experimentalFullSupportEnabled: true
Moved noNestedComponentDefinitions + noReactPropAssign (renamed → noReactPropAssignments) from nursery to correctness (where they now live in 2.4)
added fixes triggered by Vue/Svelte/HTML now being properly linted
Cleanup forced by Biome 2.4 + TypeScript stricter checks

Leveraged AI heavily in making these changes.

mifi · 2026-05-18T13:29:41Z

lgtm but verify that the changess in biome.json and correct, and verify that code inside packages is still being linted after this change (packages among other things was removed from include)

qxprakash · 2026-05-18T20:51:07Z

  "linter": {
    "enabled": true,
-    "includes": [
-      "packages/**",
-      "examples/**",
-      "scripts/**",
-      "private/**",
-      "!packages/**/{dist,lib}/**",
-      "!node_modules",
-      "!.svelte-kit",
-      "!packages/@uppy/components/src/input.css",
-      "!**/*.vue",
-      "!**/*.svelte"
-    ],


we can safely remove this now because biome 2.4 can fully lint .vue and .svelte files using the flag experimentalFullSupportEnabled: true , linter.includes falls back to files.includes , which already contains all the paths which should be linted.

previously we needed this block so that we can disable lint for .vue and svelte files. check the last two paths

"!**/*.vue", "!**/*.svelte"

qxprakash · 2026-05-18T21:03:01Z

+  "overrides": [
+    {
+      "includes": ["packages/@uppy/companion/**"],
+      "linter": {
+        "rules": {
+          "complexity": {
+            "useLiteralKeys": "off"
+          }
+        }
+      }
+    },
+    {
+      "includes": ["**/*.vue", "**/*.svelte", "packages/@uppy/vue/**/*.ts"],
+      "linter": {
+        "rules": {
+          "correctness": {
+            "useHookAtTopLevel": "off",
+            "useExhaustiveDependencies": "off"
+          }
+        }
+      }
+    },
+    {
+      "includes": ["examples/angular/**"],
+      "linter": {
+        "enabled": false
+      }
+    },
+    {
+      "includes": ["examples/nextjs/**/*.css"],
+      "css": {
+        "parser": {
+          "tailwindDirectives": true
+        }
+      }
+    }


this override block is used for overriding lint rules for certain paths , I will check them to see what do we actually need , for example : the first rule https://biomejs.dev/linter/rules/use-literal-keys/
disables the enforcement of literal access of objects i.e. obj.someKey instead of compuated access i.e. obj["someKey"] because companion uses it a lot , so rules like these must have been added by AI to reduce the linter noise.

{ "includes": ["packages/@uppy/companion/**"], "linter": { "rules": { "complexity": { "useLiteralKeys": "off" } }

qxprakash · 2026-05-18T21:28:21Z

lgtm but verify that the changess in biome.json and correct, and verify that code inside packages is still being linted after this change (packages among other things was removed from include)

verified ! , linting works in a random uppy plugin and random example. biome changes look correct still I will add small summaries of the reasoning given by AI and then we can decide on what to and what to revert.

socket-security · 2026-05-18T21:29:47Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

qxprakash · 2026-05-18T21:34:07Z

+      "includes": ["packages/@uppy/companion/**"],
+      "linter": {
+        "rules": {
+          "complexity": {
+            "useLiteralKeys": "off"
+          }
+        }
+      }
+    },


this is added due to a conflict : companion's tsconfig.shared.json sets noPropertyAccessFromIndexSignature: true. This is a deliberate, strict TypeScript option that says:

"If a property comes from an index signature (like process.env, req.query, req.body), you MUST use
bracket notation to access it."

qxprakash · 2026-05-18T21:35:09Z

+      "includes": ["**/*.vue", "**/*.svelte", "packages/@uppy/vue/**/*.ts"],
+      "linter": {
+        "rules": {
+          "correctness": {
+            "useHookAtTopLevel": "off",
+            "useExhaustiveDependencies": "off"
+          }
+        }
+      }
+    },


AI Summary :

What policy this protects: the framework's own reactivity model

These two rules are React-specific:

useHookAtTopLevel - React's "Rules of Hooks" (no conditionals, no loops, top-level only)

useExhaustiveDependencies — React's useEffect / useMemo / useCallback dependency-array discipline

Biome triggers them on any identifier starting with use*. But:

Vue composables (useUppy, useDropzone, useFileInput) have no rules-of-hooks constraint — they're
plain functions returning reactive refs. They can be called conditionally, in loops, anywhere.

Svelte 5 runes ($state, $derived, $effect) have automatic dependency tracking — there is no manual
dependency array to keep exhaustive.

qxprakash · 2026-05-18T21:52:08Z

+      "includes": ["examples/angular/**"],
+      "linter": {
+        "enabled": false
+      }


I tested without this override , it worked fine so I think we can remove this.

qxprakash · 2026-05-18T21:54:18Z

+      "includes": ["examples/nextjs/**/*.css"],
+      "css": {
+        "parser": {
+          "tailwindDirectives": true
+        }
+      }


AI summary :

The Next.js example uses Tailwind v4 directives:

@tailwind base; @tailwind components; @tailwind utilities; @apply text-lg font-bold;

These are not standard CSS. Without the tailwindDirectives: true setting, Biome's CSS parser errors
on @tailwind and @apply as unknown at-rules. Then the file fails to parse → nothing can be linted or
formatted.

…o upgrade_biome

mifi · 2026-05-20T05:25:46Z

let's merge this after #6300 is merged - there might be some conflicts in yarn.lock

@mifi

exact copy of #6175 - I will point the uppy deps upgrade pr to this PR's branch - no other changes needed in this branch as #6175 was reviewed and all the comments were resolved this should be the order of merge : 1. #6300 2. uppy deps upgrade ( yet to be raised ) 3. merge this to main 4. merge biome changes #6244 @mifi let me know if you think otherwise. --------- Co-authored-by: Mikael Finstad <finstaden@gmail.com>

upgrade biome and add new rules

dde27af

chatgpt-codex-connector Bot reviewed Mar 26, 2026

View reviewed changes

Comment thread packages/@uppy/transloadit/src/AssemblyWatcher.ts

add back #reject in TransloaditAssemblyWatcher

6bc038a

qxprakash requested a review from mifi March 26, 2026 12:27

qxprakash requested a review from Murderlon March 26, 2026 17:58

Murderlon reviewed May 9, 2026

View reviewed changes

Comment thread biome.json Outdated

qxprakash added 2 commits May 13, 2026 15:52

update biome version and config

9e2cada

Merge branch 'main' of https://github.com/transloadit/uppy into upgra…

4a94e0e

…de_biome

qxprakash marked this pull request as draft May 13, 2026 10:51

qxprakash added 2 commits May 13, 2026 16:38

yarn lock

2c679ca

add all lint suggestions by biome

2c997bc

qxprakash self-assigned this May 13, 2026

qxprakash marked this pull request as ready for review May 13, 2026 11:20

qxprakash added 2 commits May 13, 2026 16:54

fix

44cebfe

remove ts-expect-error directive

2e8a95d

qxprakash commented May 13, 2026

View reviewed changes

qxprakash commented May 18, 2026

View reviewed changes

Merge branch 'main' into upgrade_biome

ba59d96

qxprakash commented May 18, 2026

View reviewed changes

qxprakash added 2 commits May 19, 2026 03:26

remove angular example override block

78a50c1

Merge branch 'upgrade_biome' of https://github.com/qxprakash/uppy int…

20732c6

…o upgrade_biome

mifi mentioned this pull request May 20, 2026

Upgrade remaining dependencies #6297

Open

9 tasks

Merge branch 'main' into upgrade_biome

ebbfbc9

qxprakash mentioned this pull request May 20, 2026

upgrade to express v5 #6304

Merged

Merge branch 'main' into upgrade_biome

81d3656

mifi merged commit 5519b84 into transloadit:main May 21, 2026
12 checks passed

Conversation

qxprakash commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

socket-security Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

mifi commented Mar 26, 2026

Uh oh!

mifi commented May 9, 2026

Uh oh!

Uh oh!

qxprakash left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mifi commented May 18, 2026

Uh oh!

qxprakash May 18, 2026

Choose a reason for hiding this comment

Uh oh!

qxprakash May 18, 2026

Choose a reason for hiding this comment

Uh oh!

qxprakash May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qxprakash commented May 18, 2026

Uh oh!

socket-security Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qxprakash May 18, 2026

Choose a reason for hiding this comment

Uh oh!

qxprakash May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qxprakash May 18, 2026

Choose a reason for hiding this comment

Uh oh!

qxprakash May 18, 2026

Choose a reason for hiding this comment

Uh oh!

mifi commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

qxprakash commented Mar 26, 2026 •

edited

Loading

changeset-bot Bot commented Mar 26, 2026 •

edited

Loading

socket-security Bot commented Mar 26, 2026 •

edited

Loading

qxprakash left a comment •

edited

Loading

qxprakash May 18, 2026 •

edited

Loading

socket-security Bot commented May 18, 2026 •

edited

Loading

qxprakash May 18, 2026 •

edited

Loading