cli: remove unsafe from bun run / bun test / --filter and the other CLI commands by Jarred-Sumner · Pull Request #40242 · oven-sh/bun

Merge branch 'claude/sql-zero-unsafe' (c7636ec: socket + timer + sql) into the #40242 base

Jarred-Sumner

committed

f1b4767

cli: remove unsafe from run/test/filter/multi-run and the other CLI commands

Jarred-Sumner

committed

db1b01d

Address review: read GlobalMiniEventLoop::loop_ptr through the raw pointer, tidy install helpers and open.rs comment

Jarred-Sumner

committed

2d1d062

drop three comments that described the removed raw-pointer/RacyCell shapes

Jarred-Sumner

committed

03e45f5

router/interpreter: drop two comments about the removed &mut borrows

Jarred-Sumner

committed

f8d28f2

shell: the mini-loop tick closure can borrow the interpreter directly

Jarred-Sumner

committed

1c7e137

pm pkg/version: drop the ctx parameters that no longer reach anything

Jarred-Sumner

committed

48cd97b

VirtualMachine::init writes on_print_error_zig_exception explicitly; get_many_sync owns requests as OwnedThis so the callback ctx keeps its provenance

Jarred-Sumner

committed

2ff41d8

repl: thread the api-locked &mut VirtualMachine into ReplRunner; io: drop the unused reader= arm of impl_buffered_reader_parent

Jarred-Sumner

committed

406d0aa

to_executable/download_to_path take &Loader; build_command holds a shared env borrow across generate_from_cli

Jarred-Sumner

committed

888c710

CompileTarget::exe_path takes &Loader to match to_executable

Jarred-Sumner

committed

f490ac0

filter_run: build the script CStr with from_bytes_until_nul like multi_run

Jarred-Sumner

committed

bd13328

cli: stop reaching singletons under a live &mut (test run log flush, install/pm log print, Scanner dir iterator); drop PmWhyCommand's dead ctx param

Jarred-Sumner

committed

ef4cf98

filter_run/multi_run: consume cwd, PATH and dep names when building handles instead of keeping them on ScriptConfig; init_global publishes after initialising; Scanner holds leaf copies instead of &…

Jarred-Sumner

committed

31beff3

create_command: refresh progress before lending the node to the request

Jarred-Sumner

committed

37c50ea

spawn: ProcessHandle reads through RefPtr's Deref (rebase onto #40478)

Jarred-Sumner

committed

5401fe9

Rebase fixups: ProcessHandle keeps main's kill/as_ptr, target_executable/target_builtins take &Loader, test coverage collection goes through ByteRangeMapping::with_map

Jarred-Sumner

committed

e0ca0d6

Navigation Menu

Repository navigation

cli: remove unsafe from bun run / bun test / --filter and the other CLI commands - #40242

cli: remove unsafe from bun run / bun test / --filter and the other CLI commands#40242
Jarred-Sumner wants to merge 33 commits into
claude/buntest-zero-unsafefrom
claude/cli-zero-unsafe

Commits on Aug 29, 2026

socket: remove the remaining unsafe from socket_body.rs and UpgradedDuplex.rs

boringssl_sys: the ALPN select thunk only accepts exactly one entry of the offered list

timer: remove unsafe from the timer module

timer: fire WTF timers without reading the slot, make All::remove a no-op for unlinked slots

dispatch: the WTFTimer arm of fire_timer is unreachable now; drop WTFTimer's write-only repeat flag

rebase on #40192: timer id maps hold BackRef<_, Root>

jsc_hooks: drop the leftover cfg(not(unix)) state suppression in auto_tick_active

timer_object_internals: RefPtr releases on drop (rebase onto #40478)

timer: clearImmediate ignores primitive ids; QuicEndpoint::timer_ref helper; WTFTimer teardown-order doc

timers: an interval that stops itself Node-style lets go of its wrapper; Heap::insert asserts the node is unlinked; host_fn treats a ThisPtr first parameter as the receiver; libuv Timer::get_due_in…

Merge remote-tracking branch 'origin/claude/timer-zero-unsafe' into sql

sql_jsc, valkey_jsc: remove unsafe from the SQL and Redis clients

err_error_string_n: find the NUL via bun_core::strings (byte-search lint)

PostgresSQLQuery: release a statement a re-entrant run left in the reserved slot on the bind-error paths

PostgresSQLQuery: bind-error paths drop the statement a re-entrant run left in the reserved slot

PostgresSQLConnection::enqueue_request is infallible again: the queue push happens after protocol bytes are written, so an OOM there must abort like the base did rather than return to JS with a des…

Commits on Aug 31, 2026

Merge branch 'claude/sql-zero-unsafe' (c7636ec: socket + timer + sql) into the #40242 base

cli: remove unsafe from run/test/filter/multi-run and the other CLI commands

Address review: read GlobalMiniEventLoop::loop_ptr through the raw pointer, tidy install helpers and open.rs comment

drop three comments that described the removed raw-pointer/RacyCell shapes

router/interpreter: drop two comments about the removed &mut borrows

shell: the mini-loop tick closure can borrow the interpreter directly

pm pkg/version: drop the ctx parameters that no longer reach anything

VirtualMachine::init writes on_print_error_zig_exception explicitly; get_many_sync owns requests as OwnedThis so the callback ctx keeps its provenance

repl: thread the api-locked &mut VirtualMachine into ReplRunner; io: drop the unused reader= arm of impl_buffered_reader_parent

to_executable/download_to_path take &Loader; build_command holds a shared env borrow across generate_from_cli

CompileTarget::exe_path takes &Loader to match to_executable

filter_run: build the script CStr with from_bytes_until_nul like multi_run

cli: stop reaching singletons under a live &mut (test run log flush, install/pm log print, Scanner dir iterator); drop PmWhyCommand's dead ctx param

filter_run/multi_run: consume cwd, PATH and dep names when building handles instead of keeping them on ScriptConfig; init_global publishes after initialising; Scanner holds leaf copies instead of &…

create_command: refresh progress before lending the node to the request

spawn: ProcessHandle reads through RefPtr's Deref (rebase onto #40478)

Rebase fixups: ProcessHandle keeps main's kill/as_ptr, target_executable/target_builtins take &Loader, test coverage collection goes through ByteRangeMapping::with_map