Skip to content

fix(sarif): guard optional chain in baseline.test.ts for Biome 2.5.3#291

Merged
theagenticguy merged 2 commits into
mainfrom
fix/sarif-unsafe-optional-chaining
Jul 9, 2026
Merged

fix(sarif): guard optional chain in baseline.test.ts for Biome 2.5.3#291
theagenticguy merged 2 commits into
mainfrom
fix/sarif-unsafe-optional-chaining

Conversation

@theagenticguy

Copy link
Copy Markdown
Owner

What

Add the optional-chaining operator (?.) to two spots in packages/sarif/src/baseline.test.ts where an optional chain was followed by a non-optional member access on the next line:

const state = (tagged.runs[0]?.results?.[0] as unknown as { baselineState?: string })
  ?.baselineState;  // was: .baselineState

Why

Biome 2.5.3 tightened lint/correctness/noUnsafeOptionalChaining. The pre-existing code on main (lines 135 and 174) short-circuits tagged.runs[0]?.results?.[0] to undefined, then reads .baselineState on it — which would throw TypeError at runtime. Biome now flags this as an error.

Verified locally against @biomejs/biome@2.5.3: the unfixed file emits 2 noUnsafeOptionalChaining errors; the fixed file passes clean.

Impact

  • Fixes a real latent bug on main independent of any dep bump.
  • Unblocks the Biome 2.5.2 → 2.5.3 bump in the typescript-tooling group (build(deps-dev): bump the typescript-tooling group with 2 updates #287), whose lint + self-scan jobs fail on exactly this code.
  • Behavior unchanged on the passing path (value present); if the chain were ever undefined, the assertion now fails on value mismatch instead of a raw TypeError.

🤖 Opened by Bonk nightly maintenance.

Biome 2.5.3 tightened lint/correctness/noUnsafeOptionalChaining and now
flags two spots in baseline.test.ts where an optional chain
(tagged.runs[0]?.results?.[0]) was followed by a non-optional
.baselineState member access on the next line. If the chain
short-circuits to undefined, the access throws TypeError.

Add the optional-chaining operator so the access is guarded. Behavior
is unchanged for the passing path (value present); if the chain were
ever undefined the assertion now fails on value mismatch instead of a
raw TypeError.

Unblocks the Biome 2.5.2 -> 2.5.3 bump in the typescript-tooling group
(PR #287), whose lint + self-scan jobs fail on this pre-existing code.
@theagenticguy theagenticguy enabled auto-merge (squash) July 9, 2026 03:08
@theagenticguy theagenticguy merged commit 919e94f into main Jul 9, 2026
32 of 33 checks passed
@theagenticguy theagenticguy deleted the fix/sarif-unsafe-optional-chaining branch July 9, 2026 03:10
@github-actions github-actions Bot mentioned this pull request Jul 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant