biomejs/biome

• 8555 files indexed
• 40786 code symbols extracted
• 311084 symbol references tracked
• 0 active memories (0 core, 0 stale)
• Languages: rust (4079), javascript (2938), typescript (1538)

These are the symbols your codebase depends on most. Changes here have the largest blast radius.

• into — 7041 references
• fmt — 6045 references
• format — 5199 references
• next — 4998 references
• kind — 4612 references
• node — 4111 references
• syntax — 3564 references
• element — 2915 references
• into_iter — 2770 references
• splice_slots — 2636 references

Core architectural files — imported by many others.

• crates/biomejsanalyze/tests/specs/suspicious/noImportCycles/invalidBaz.js (1.00)
• crates/biomejsanalyze/tests/specs/suspicious/noImportCycles/invalidFoobar.js (0.93)
• crates/biomeformattertest/src/prettier/prepare_tests.js (0.74)
• crates/biomejsanalyze/tests/specs/correctness/noUndeclaredDependencies/valid.ts (0.71)
• packages/@biomejs/js-api/src/wasm.ts (0.51)
• packages/@biomejs/js-api/src/common.ts (0.47)
• crates/biomejsanalyze/tests/specs/correctness/noPrivateImports/sub/index.js (0.29)
• crates/biomejsanalyze/tests/specs/nursery/noFloatingPromises/invalidGenericWrapper/trace.ts (0.27)
• crates/biomejsanalyze/tests/specs/nursery/noFloatingPromises/validGenericWrapper/trace.ts (0.27)
• packages/prettier-compare/src/languages.ts (0.27)

No obvious dead code — every named symbol has at least one reference.

• crates/biomejsanalyze/tests/specs/suspicious/noImportCycles/invalidBaz.js (1.00)
• crates/biomejsanalyze/tests/specs/suspicious/noImportCycles/invalidFoobar.js (0.93)
• crates/biomeformattertest/src/prettier/prepare_tests.js (0.74)
• crates/biomejsanalyze/tests/specs/correctness/noUndeclaredDependencies/valid.ts (0.71)
• packages/@biomejs/js-api/src/wasm.ts (0.51)

Critical (11)

• Hardcoded secret — crates/biomejsanalyze/tests/specs/security/noSecrets/invalid.js:3
• const slackToken = "xoxb-not-a-real-token-this-will-not-work";
• API token — crates/biomejsanalyze/tests/specs/security/noSecrets/invalid.js:3
• const slackToken = "xoxb-not-a-real-token-this-will-not-work";
• Hardcoded secret — crates/biomejsanalyze/tests/specs/security/noSecrets/invalid.js:4
• const awsApiKey = "AKIA1234567890EXAMPLE"
• API token — crates/biomejsanalyze/tests/specs/security/noSecrets/invalid.js:4
• const awsApiKey = "AKIA1234567890EXAMPLE"
• Private key — crates/biomejsanalyze/tests/specs/security/noSecrets/invalid.js:5
• const rsaPrivateKey = "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA1234567890..."
• Hardcoded secret — crates/biomejsanalyze/tests/specs/security/noSecrets/invalid.js:8
• const githubToken = "githubpat1234567890abcdefghijklmnopqrstuvwxyz";
• API token — crates/biomejsanalyze/tests/specs/security/noSecrets/invalid.js:8
• const githubToken = "githubpat1234567890abcdefghijklmnopqrstuvwxyz";
• API token — crates/biomecli/tests/cases/configextends.rs:109
• fn extendsconfigokfromnpmpackagewithauthorfield() {
• API token — crates/biomecli/tests/cases/configextends.rs:161
• "extendsconfigokfromnpmpackagewithauthorfield",
• API token — crates/biomecli/tests/cases/configextends.rs:169
• fn extendsconfigokfromnpmpackagewithconditionnames() {
• ...and 1 more

High (5)

• eval() usage — crates/biomejsanalyze/src/lint/security/noglobaleval.rs:86
• <Emphasis>"eval()"</Emphasis>" exposes to security risks and performance issues."
• eval() usage — crates/biomejsanalyze/src/lint/security/noglobaleval.rs:93
• "Refactor the code so that it doesn't need to call "<Emphasis>"eval()"</Emphasis>"."
• eval() usage — crates/biomejsanalyze/src/lint/nursery/noimpliedeval.rs:149
• "Implied "<Emphasis>"eval()"</Emphasis>" is not allowed."
• eval() usage — crates/biomejsanalyze/src/lint/nursery/noimpliedeval.rs:155
• " is a form of implied "<Emphasis>"eval()"</Emphasis>" and can lead to security and performance issues."
• eval() usage — crates/biomejsanalyze/src/lint/nursery/noimpliedeval.rs:170
• "It parses strings into executable code at runtime and has the same security and performance drawbacks as "<Emphasis>"ev

Low (33)

• debugger statement — e2e-tests/relative-path-ignore-file/file.js:1
• debugger;
• debugger statement — crates/biomejsanalyze/src/suppressions.tests.rs:318
• debugger;
• debugger statement — crates/biomejsanalyze/src/suppressions.tests.rs:364
• debugger;
• debugger statement — crates/biomejsanalyze/src/suppressions.tests.rs:412
• debugger;
• debugger statement — crates/biomejsanalyze/src/suppressions.tests.rs:692
• debugger;
• debugger statement — crates/biomejsanalyze/src/suppressions.tests.rs:695
• debugger;
• debugger statement — crates/biomejsanalyze/src/suppressions.tests.rs:697
• debugger;
• debugger statement — crates/biome_lsp/src/server.tests.rs:3588
• let filelintonly = r#"debugger;\n"#;
• Excessive console.log — crates/biomejssemantic/src/semantic_model/closure.rs:460
• let two_captures = "let a, b; function f(c) {console.log(a, b, c)}";
• Excessive console.log — crates/biomejssemantic/src/semantic_model/closure.rs:466
• console.log(a);
• ...and 23 more

• Before refactoring into, run sverklo_impact to see the 7041 call sites
• crates/biomejsanalyze/tests/specs/suspicious/noImportCycles/invalidBaz.js is your most-imported file — changes here cascade widely