feat(biome_js_analyze): add bundleDependencies option to NoUndeclaredDependencies rule

.changeset/dull-shirts-hunt.md

@@ -0,0 +1,7 @@
+---
+"@biomejs/biome": minor
+---
+
+Added `bundleDependencies` option to [NoUndeclaredDependencies](https://biomejs.dev/linter/rules/no-undeclared-dependencies) rule.
+
+This rule now supports imports of packages that are defined only in `bundleDependencies` array.

crates/biome_js_analyze/src/lint/correctness/no_undeclared_dependencies.rs

@@ -66,6 +66,7 @@ declare_lint_rule! {
     /// - `devDependencies`: If set to `false`, then the rule will show an error when `devDependencies` are imported. Defaults to `true`.
     /// - `peerDependencies`: If set to `false`, then the rule will show an error when `peerDependencies` are imported. Defaults to `true`.
     /// - `optionalDependencies`: If set to `false`, then the rule will show an error when `optionalDependencies` are imported. Defaults to `true`.
+    /// - `bundleDependencies`: If set to `false`, then the rule will show an error when `bundleDependencies` are imported. Defaults to `true`.
     ///
     /// You can set the options like this:
     ///
@@ -74,7 +75,8 @@ declare_lint_rule! {
     ///   "options": {
     ///     "devDependencies": false,
     ///     "peerDependencies": false,
-    ///     "optionalDependencies": false
+    ///     "optionalDependencies": false,
+    ///     "bundleDependencies": false
     ///   }
     /// }
     /// ```
@@ -86,9 +88,8 @@ declare_lint_rule! {
     ///
     /// ### Example using the `devDependencies` option
     ///
-    /// In this example, only test files can use dependencies in the
-    /// `devDependencies` section. `dependencies`, `peerDependencies`, and
-    /// `optionalDependencies` are always available.
+    /// In this example, only test files can use dependencies in the `devDependencies` section.
+    /// `dependencies`, `peerDependencies`, `optionalDependencies` and `bundleDependencies` are always available.
     ///
     /// ```json,options
     /// {
@@ -133,6 +134,7 @@ pub struct RuleState {
     is_dev_dependency_available: bool,
     is_peer_dependency_available: bool,
     is_optional_dependency_available: bool,
+    is_bundle_dependency_available: bool,
 }
 
 impl Rule for NoUndeclaredDependencies {
@@ -165,12 +167,18 @@ impl Rule for NoUndeclaredDependencies {
             .optional_dependencies
             .as_ref()
             .is_none_or(|dep| dep.is_available(path));
+        let is_bundle_dependency_available = ctx
+            .options()
+            .bundle_dependencies
+            .as_ref()
+            .is_none_or(|dep| dep.is_available(path));
 
         let is_available = |package_name| {
             ctx.is_dependency(package_name)
                 || (is_dev_dependency_available && ctx.is_dev_dependency(package_name))
                 || (is_peer_dependency_available && ctx.is_peer_dependency(package_name))
                 || (is_optional_dependency_available && ctx.is_optional_dependency(package_name))
+                || (is_bundle_dependency_available && ctx.is_bundle_dependency(package_name))
         };
 
         let token_text = node.inner_string_text()?;
@@ -206,6 +214,7 @@ impl Rule for NoUndeclaredDependencies {
             is_dev_dependency_available,
             is_peer_dependency_available,
             is_optional_dependency_available,
+            is_bundle_dependency_available,
         })
     }
 
@@ -215,6 +224,7 @@ impl Rule for NoUndeclaredDependencies {
             is_dev_dependency_available,
             is_peer_dependency_available,
             is_optional_dependency_available,
+            is_bundle_dependency_available,
         } = state;
 
         let Some(package_path) = ctx.package_path.as_ref() else {
@@ -252,6 +262,8 @@ impl Rule for NoUndeclaredDependencies {
             Some("peerDependencies")
         } else if ctx.is_optional_dependency(package_name) && !is_optional_dependency_available {
             Some("optionalDependencies")
+        } else if ctx.is_bundle_dependency(package_name) && !is_bundle_dependency_available {
+            Some("bundleDependencies")
         } else {
             None
         };

crates/biome_js_analyze/src/services/manifest.rs

@@ -47,6 +47,13 @@ impl ManifestServices {
             .as_deref()
             .is_some_and(|pkg| pkg.optional_dependencies.contains(specifier))
     }
+
+    pub(crate) fn is_bundle_dependency(&self, specifier: &str) -> bool {
+        self.manifest.as_deref().is_some_and(|pkg| {
+            pkg.bundle_dependencies.contains(specifier)
+                || pkg.bundled_dependencies.contains(specifier)
+        })
+    }
 }
 
 impl FromServices for ManifestServices {

crates/biome_js_analyze/tests/specs/correctness/noUndeclaredDependencies/invalid.package.json

@@ -4,5 +4,7 @@
 	},
   "devDependencies": {
     "@testing-library/react": "1.0.0"
-  }
+  },
+	"bundleDependencies": true,
+	"bundledDependencies": false
 }

crates/biome_js_analyze/tests/specs/correctness/noUndeclaredDependencies/valid.package.json

@@ -18,5 +18,11 @@
 	},
 	"optionalDependencies": {
 		"optional-dep": "1.0.0"
-	}
+	},
+	"bundleDependencies": [
+		"bundle-dep"
+	],
+	"bundledDependencies": [
+		"bundled-dep"
+	]
 }

crates/biome_js_analyze/tests/specs/correctness/noUndeclaredDependencies/valid.ts

@@ -19,6 +19,8 @@ import { fontFamily } from "tailwindcss/defaultTheme";
 
 import "peer-dep";
 import "optional-dep";
+import "bundle-dep";
+import "bundled-dep";
 
 import "my-package"
 

crates/biome_js_analyze/tests/specs/correctness/noUndeclaredDependencies/valid.ts.snap

@@ -25,6 +25,8 @@ import { fontFamily } from "tailwindcss/defaultTheme";
 
 import "peer-dep";
 import "optional-dep";
+import "bundle-dep";
+import "bundled-dep";
 
 import "my-package"
 

crates/biome_package/src/node_js_package/package_json.rs

@@ -33,6 +33,8 @@ pub struct PackageJson {
     pub dev_dependencies: Dependencies,
     pub peer_dependencies: Dependencies,
     pub optional_dependencies: Dependencies,
+    pub bundle_dependencies: BundleDependencies,
+    pub bundled_dependencies: BundleDependencies,
     pub license: Option<(Box<str>, TextRange)>,
 
     pub author: Option<Box<str>>,
@@ -191,6 +193,66 @@ impl Dependencies {
     }
 }
 
+#[derive(Debug, Default, Clone)]
+pub struct BundleDependencies(pub Box<[Box<str>]>);
+
+/// The "bundleDependencies" field is usually an array of package names (not a map like the other dependencies fields).
+/// It can also be a boolean (`true` to mean “bundle everything”).
+impl Deserializable for BundleDependencies {
+    fn deserialize(
+        ctx: &mut impl DeserializationContext,
+        value: &impl DeserializableValue,
+        name: &str,
+    ) -> Option<Self> {
+        struct Visitor;
+
+        impl DeserializationVisitor for Visitor {
+            type Output = BundleDependencies;
+
+            const EXPECTED_TYPE: DeserializableTypes =
+                DeserializableTypes::ARRAY.union(DeserializableTypes::BOOL);
+
+            fn visit_array(
+                self,
+                ctx: &mut impl DeserializationContext,
+                items: impl ExactSizeIterator<Item = Option<impl DeserializableValue>>,
+                _range: TextRange,
+                name: &str,
+            ) -> Option<Self::Output> {
+                let values = items
+                    .filter_map(|item| {
+                        let item = item?;
+                        Deserializable::deserialize(ctx, &item, name)
+                    })
+                    .collect::<Vec<Box<str>>>();
+
+                Some(BundleDependencies(values.into_boxed_slice()))
+            }
+
+            fn visit_bool(
+                self,
+                _ctx: &mut impl DeserializationContext,
+                _value: bool,
+                _range: TextRange,
+                _name: &str,
+            ) -> Option<Self::Output> {
+                // Allow boolean value and treat it as “no explicit list”.
+                Some(BundleDependencies::default())
+            }
+        }
+
+        value.deserialize(ctx, Visitor, name)
+    }
+}
+
+impl BundleDependencies {
+    pub fn contains(&self, specifier: &str) -> bool {
+        self.0
+            .iter()
+            .any(|dependency| dependency.as_ref() == specifier)
+    }
+}
+
 #[derive(Debug, Clone, Eq, PartialEq)]
 pub enum Version {
     SemVer(Range),
@@ -286,6 +348,16 @@ impl DeserializationVisitor for PackageJsonVisitor {
                         result.optional_dependencies = deps;
                     }
                 }
+                "bundleDependencies" => {
+                    if let Some(deps) = Deserializable::deserialize(ctx, &value, &key_text) {
+                        result.bundle_dependencies = deps;
+                    }
+                }
+                "bundledDependencies" => {
+                    if let Some(deps) = Deserializable::deserialize(ctx, &value, &key_text) {
+                        result.bundled_dependencies = deps;
+                    }
+                }
                 "type" => {
                     result.r#type = Deserializable::deserialize(ctx, &value, &key_text);
                 }
@@ -392,4 +464,23 @@ mod tests {
 
         assert_eq!(result, Ok(Version::Literal("~0.x.0".to_string())));
     }
+
+    #[test]
+    fn parse_package_json_bundle_dependencies_field_with_bool() {
+        let deserialized = deserialize_from_json_str::<PackageJson>(
+            r#"{
+    "name": "@shared/format",
+    "bundleDependencies": true,
+    "bundledDependencies": false
+}"#,
+            JsonParserOptions::default(),
+            "",
+        );
+        let (package_json, errors) = deserialized.consume();
+        assert!(errors.is_empty());
+
+        let package_json = package_json.expect("parsing must have succeeded");
+        assert!(package_json.bundle_dependencies.0.is_empty());
+        assert!(package_json.bundled_dependencies.0.is_empty());
+    }
 }

crates/biome_rule_options/src/no_undeclared_dependencies.rs

@@ -20,6 +20,10 @@ pub struct NoUndeclaredDependenciesOptions {
     /// If set to `false`, then the rule will show an error when `optionalDependencies` are imported. Defaults to `true`.
     #[serde(skip_serializing_if = "Option::<_>::is_none")]
     pub optional_dependencies: Option<DependencyAvailability>,
+
+    /// If set to `false`, then the rule will show an error when `bundleDependencies` are imported. Defaults to `true`.
+    #[serde(skip_serializing_if = "Option::<_>::is_none")]
+    pub bundle_dependencies: Option<DependencyAvailability>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize)]