Dependency scanning

[SaadBazaz]

I think we should also have a basic dependency-scanning security rule.

e.g. called useSafeDependencies or something like that (I'm not even sure it would be in linting, probably in analyzer?)

How I imagine this to be built:

1. Work on only two files: package.json and *-lock.(yml|json)
2. Take packagejson object, take .dependencies and .devDependencies, for each field and corresponding string make an API call to a scanner like https://listen.dev, and display results in popup in real-time.
3. If there are high vulnerabilities, display them in a nice display

Of course this can't replace commit hooks or CI/CD scanning processes, but at least it's realtime. And can prevent potential problems from spreading immediately. Specially if it's easy to set up.

[SaadBazaz]

@Conaclos @ematipico -

1. What say? Do you guys think it's worth pursuing?

If yes, I inspected the code a bit and it seems we've used network calls (with ureq) in only one place:

biome/xtask/codegen/src/unicode.rs

Line 91 in c97a4af

let raw = ureq::get("http://www.unicode.org/Public/UNIDATA/DerivedCoreProperties.txt")

2. Are we comfortable with using it in a lint-rule?

[ematipico]

We don't use network calls in Biome. That code you found is for our internal tooling for auto-generated code.

[ematipico]

A couple of questions:

• Biome doesn't have plugins. Did you use the incorrect wording?
• Can't users use those tools directly? What can Biome do that other tools can't?

[SaadBazaz]

1. Ah sorry. Must have typed when half asleep. Corrected.
2. I suppose with Biome, they can just have one tool to install to manage almost everything from linting, formatting and up until basic security protection. Could protect more projects in the future, specially newbie ones. But yes, it steers Biome in a direction which may or may not be desirable in the future. Really depends on the project's direction and maintainer's vision.

[Conaclos]

There are already really good tools for scanning and reporting questionable dependencies. I think this is beyond the scope of Biome.