feat: add a biome check

[alexander-akait]

Summary

The fifth check, and the last one the equivalent plugins for other bundlers have that this did not. Run it with { use: "biome" }: it checks the files webpack builds and reports at Biome's own severities, with command: "check" adding Biome's formatting and assist diagnostics to the linter's.

Biome is not outdated or deprecated, which is worth recording since it was asked: @biomejs/biome 2.5.13 published the day before this PR, 105 stable releases, no deprecation. (Download figures I could not get — api.npmjs.org is unreachable from here — so I am claiming nothing about popularity.)

Biome and oxlint are the same shape, a binary behind a Node entry rather than a library, so what the two of them need is src/cli.js rather than a copy each: finding the binary, running it for JSON, grouping diagnostics by the file they were found in, and splitting them by the severity the tool gave them. oxlint moves onto it here, so this adds a check and removes the duplication that adding it would otherwise have created.

Biome calls the JSON reporter this reads experimental — a release of its own may move the shape. That is said where the flag is passed and in the README, and it is the only reporter carrying the severities a check needs.

Three things a new test suite needs that only one of them was being given, each found by it going wrong:

• .prettierignore. lint:prettier is prettier -w, so running the suite's own lint reformatted the deliberately misformatted fixture the check case rests on, and the case then proved nothing.
• .gitignore for outputs. Without it a build artifact is committed and rewritten by every run — test/typescript/outputs/main.js is on main now from feat: add a typescript check #327, and test/oxlint/outputs/main.js was in feat: add an oxlint check #328. Both are dropped here and all three suites listed.
• fixtures/package.json with "type": "commonjs", or require() in a fixture is not a dependency webpack follows, since the repository itself is "type": "module".

What kind of change does this PR introduce?

feat

Did you add tests for your changes?

Yes — test/biome/biome.test.js, ten cases: a clean project reports nothing; an "error" rule becomes a webpack error naming file, line, column and rule; a "warn" rule becomes a warning without carrying the error; two problems in one file both survive; reportAs moves both; the linter alone runs by default over a misformatted file and says nothing; command: "check" reports that file's formatting; a formatter written in the configuration is used; Biome refusing to run is reported; and a biomePath naming nothing is reported. The oxlint suite still passes unchanged against the shared plumbing.

Does this PR introduce a breaking change?

No. The check is opt-in, and src/cli.js is internal — the oxlint check behaves as before.

If relevant, what needs to be documented once your changes are merged or what have you already documented?

README.md here: a Biome section with biomePath, command, configFile and args, plus the intro and install lines. @biomejs/biome >= 2 is an optional peer. The webpack.js.org page wants the section after release.

Use of AI

AI was used. Claude Code installed Biome and probed its CLI before designing anything — which is how the JSON-on-stdout, notice-on-stderr split, the relative location.path, the lowercase severities and the non-zero exit are described from what it prints rather than from memory. It had also argued against adding Biome at all, on the grounds that it duplicates oxlint's kind of check; told to add it, it did, and took the opportunity to share the plumbing. It verified that neither biome check nor the check through the plugin writes to a source file before trusting the fixture that appeared to have been rewritten.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GzZci4NQeiqwdrVfd7dGXy

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​biomejs/​biome@​2.5.13

View full report