feat(lint): add noDrizzleDeleteWithoutWhere and noDrizzleUpdateWithoutWhere rules (#9525)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: 3 people

.changeset/drizzle-update-rule.md

@@ -0,0 +1,5 @@
+---
+"@biomejs/biome": patch
+---
+
+Added the rule [`noDrizzleUpdateWithoutWhere`](https://biomejs.dev/linter/rules/no-drizzle-update-without-where/) to prevent accidental full-table updates when using Drizzle ORM without a `.where()` clause.

.changeset/wide-symbols-post.md

@@ -0,0 +1,5 @@
+---
+"@biomejs/biome": patch
+---
+
+Added the rule [`noDrizzleDeleteWithoutWhere`](https://biomejs.dev/linter/rules/no-drizzle-delete-without-where/) to prevent accidental full-table deletes when using Drizzle ORM without a `.where()` clause.

crates/biome_analyze/src/rule.rs

@@ -188,6 +188,8 @@ pub enum RuleSource<'a> {
     EslintYml(&'a str),
     /// Rules from [Eslint CSS](https://github.com/eslint/css)
     EslintCss(&'a str),
+    /// Rules from [Eslint Plugin Drizzle](https://orm.drizzle.team/docs/eslint-plugin)
+    EslintDrizzle(&'a str),
 }
 
 impl<'a> std::fmt::Display for RuleSource<'a> {
@@ -242,6 +244,7 @@ impl<'a> std::fmt::Display for RuleSource<'a> {
             Self::EslintMarkdown(_) => write!(f, "@eslint/markdown"),
             Self::EslintYml(_) => write!(f, "eslint-plugin-yml"),
             Self::EslintCss(_) => write!(f, "@eslint/css"),
+            Self::EslintDrizzle(_) => write!(f, "eslint-plugin-drizzle"),
         }
     }
 }
@@ -307,6 +310,7 @@ impl<'a> RuleSource<'a> {
             Self::EslintMarkdown(_) => 42,
             Self::EslintYml(_) => 43,
             Self::EslintCss(_) => 44,
+            Self::EslintDrizzle(_) => 45,
         }
     }
 
@@ -370,7 +374,8 @@ impl<'a> RuleSource<'a> {
             | Self::EslintPlaywright(rule_name)
             | Self::EslintJson(rule_name)
             | Self::EslintMarkdown(rule_name)
-            | Self::EslintYml(rule_name) => rule_name,
+            | Self::EslintYml(rule_name)
+            | Self::EslintDrizzle(rule_name) => rule_name,
         }
     }
 
@@ -421,6 +426,7 @@ impl<'a> RuleSource<'a> {
             Self::EslintMarkdown(_) => "markdown",
             Self::EslintYml(_) => "yml",
             Self::EslintCss(_) => "css",
+            Self::EslintDrizzle(_) => "drizzle",
         }
     }
 
@@ -479,6 +485,7 @@ impl<'a> RuleSource<'a> {
             Self::EslintMarkdown(rule_name) => format!("https://github.com/eslint/markdown/blob/main/docs/rules/{rule_name}.md"),
             Self::EslintYml(rule_name) => format!("https://ota-meshi.github.io/eslint-plugin-yml/rules/{rule_name}.html"),
             Self::EslintCss(rule_name) => format!("https://github.com/eslint/css/blob/main/docs/rules/{rule_name}.md"),
+            Self::EslintDrizzle(rule_name) => format!("https://orm.drizzle.team/docs/eslint-plugin#{rule_name}"),
         }
     }
 
@@ -566,6 +573,8 @@ impl RuleSourceKind {
 #[cfg_attr(feature = "serde", serde(rename_all = "camelCase"))]
 #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
 pub enum RuleDomain {
+    /// Drizzle ORM rules
+    Drizzle,
     /// React library rules
     React,
     /// Testing rules
@@ -594,6 +603,7 @@ impl Display for RuleDomain {
     fn fmt(&self, fmt: &mut Formatter) -> std::io::Result<()> {
         // use lower case naming, it needs to match the name of the configuration
         match self {
+            Self::Drizzle => fmt.write_str("drizzle"),
             Self::React => fmt.write_str("react"),
             Self::Test => fmt.write_str("test"),
             Self::Solid => fmt.write_str("solid"),
@@ -647,6 +657,7 @@ impl RuleDomain {
             Self::Turborepo => &[&("turbo", ">=1.0.0")],
             Self::Playwright => &[&("@playwright/test", ">=1.0.0")],
             Self::Types => &[],
+            Self::Drizzle => &[&("drizzle-orm", ">=0.9.0")],
         }
     }
 
@@ -687,6 +698,7 @@ impl RuleDomain {
             Self::Turborepo => &[],
             Self::Playwright => &["test", "expect"],
             Self::Types => &[],
+            Self::Drizzle => &[],
         }
     }
 
@@ -703,6 +715,7 @@ impl RuleDomain {
             Self::Turborepo => "turborepo",
             Self::Playwright => "playwright",
             Self::Types => "types",
+            Self::Drizzle => "drizzle",
         }
     }
 }
@@ -723,6 +736,7 @@ impl FromStr for RuleDomain {
             "turborepo" => Ok(Self::Turborepo),
             "playwright" => Ok(Self::Playwright),
             "types" => Ok(Self::Types),
+            "drizzle" => Ok(Self::Drizzle),
             _ => Err("Invalid rule domain"),
         }
     }

crates/biome_cli/src/execute/migrate/eslint_any_rule_to_biome.rs

@@ -15,6 +15,7 @@ domains.json:4:7 deserialize ━━━━━━━━━━━━━━━━━
 
   i Accepted values:
 
+  - drizzle
   - react
   - test
   - solid

crates/biome_configuration/src/analyzer/linter/rules.rs

@@ -0,0 +1,45 @@
+use biome_js_syntax::{AnyJsExpression, JsCallExpression, JsStaticMemberExpression, JsSyntaxKind};
+use biome_rowan::{AstNode, SyntaxNode};
+
+pub(crate) fn get_identifier_name(expr: &AnyJsExpression) -> Option<biome_rowan::TokenText> {
+    match expr {
+        AnyJsExpression::JsIdentifierExpression(id) => {
+            Some(id.name().ok()?.value_token().ok()?.token_text_trimmed())
+        }
+        _ => None,
+    }
+}
+
+pub(crate) fn has_where_in_chain(node: &SyntaxNode<biome_js_syntax::JsLanguage>) -> bool {
+    let mut current = node.parent();
+    loop {
+        let Some(parent) = current else { break };
+
+        if let Some(member_expr) = JsStaticMemberExpression::cast_ref(&parent)
+            && let Ok(member) = member_expr.member()
+            && let Some(name) = member.as_js_name()
+            && name
+                .value_token()
+                .ok()
+                .is_some_and(|t| t.token_text_trimmed() == "where")
+        {
+            // Only count `.where(...)` as a where clause, not bare `.where` property access.
+            let is_called = parent
+                .parent()
+                .is_some_and(|p| JsCallExpression::cast_ref(&p).is_some());
+            if is_called {
+                return true;
+            }
+        }
+
+        if matches!(
+            parent.kind(),
+            JsSyntaxKind::JS_EXPRESSION_STATEMENT | JsSyntaxKind::JS_RETURN_STATEMENT
+        ) {
+            break;
+        }
+
+        current = parent.parent();
+    }
+    false
+}