[robobun]

Behaviour change: none

Problem

• bun_sema lists bun_semver under [dependencies] (src/sema/Cargo.toml:18). No file of the crate names bun_semver. bun check - a TypeScript type checker builtin to Bun #44361 added the crate with this entry.
• Cargo reports it on every check: warning: unused dependency `bun_semver` (cargo::unused_dependencies). The warning comes from cargo, not from rustc, so the workspace's deny lints do not stop the build.

Fix

• Remove the entry from src/sema/Cargo.toml and the matching line from Cargo.lock.
• Correct because rg bun_semver src/sema finds only the manifest line. The checker compares versions with its own port of semver.Version in src/sema/resolve.rs.
• Verified: bun bd, bun run rust:check-all (12 targets), cargo check --all-targets for the four sema crates (also --release, and with --cfg bun_debug --cfg bun_asan), and test/cli/check/entry-points.test.ts (158 pass).

Background

• A [dependencies] entry makes cargo build that crate first and pass it to rustc with --extern. An entry that no code names only adds an edge to the build graph.
• Eight other crates still depend on bun_semver, so the link takes the same set of rlibs.
• Considered a deny of unused_dependencies for the whole workspace. Cargo reports nine more entries on linux. Six have a user on another target, under a build cfg, or in unit tests, and Remove dead code from bun-uws, bun-usockets, the require.extensions FFI, and unused Cargo dependencies #40294 removes the other three (Notes). That is a separate change.

Downsides

• None found. Checked every target and profile above, the baselines feature, and the test targets of the four sema crates. No source file changes.

Notes

Why this pull request is small

This is the result of a full dead-code scan of main at bbdc5a5. 41 dead-code pull requests are open. Together they remove 58,944 lines in 1,017 files. Outside those diffs, the scan found one item that is certain: this dependency entry.

The other nine unused_dependencies warnings on linux

Entry	Why it stays here
bun_ini -> bun_js_parser, bun_platform -> bun_core, bun_ptr -> scopeguard	#40294 removes them.
bun_resolver -> bun_zstd	Used under cfg(bun_codegen_embed) (src/resolver/node_fallbacks.rs:55).
bun_wyhash -> bstr	Used by unit tests (src/wyhash/lib.rs:1017).
bun_errno -> bun_windows_sys, bun_libuv_sys -> libc, bun_libuv_sys -> strum	Used on Windows.
bun_perf -> bun_sys	Used on macOS (src/perf/lib.rs:133).

What the scan covered, and what it found

Each candidate was compared with the lines that the 41 open pull requests remove.

• Reference count: 313,346 identifiers over 19,335 files (src, packages, scripts, test, bench, generated code), comments excluded. Each definition with no other use is one of these: a test, an FFI export with a C++ user, a host function that the codegen names, a config macro that ENABLE(), USE() or HAVE() reads, or a deletion that an open pull request has.
• File level: 47 of 1,654 .rs files are not compiled on linux. Each has a mod declaration (platform, test, bench, build.rs). 16 of 609 C and C++ sources are not compiled on linux (platform, tools, #included parts). Each header has an includer, except v8config.h (Remove dead code from bun_runtime, bun_core, bun_ast, bun_io, and an orphaned package #40969).
• clang: all 602 translation units of bun's own C and C++ with -Wunused-function -Wunused-member-function -Wunused-template -Wunneeded-internal-declaration -Wunused-macros -Wunused-const-variable. The build passes -Wno-unused-function. Result: 8 functions, 8 macros, 5 templates, 1 member function. Each has a user on another platform or in another translation unit, is a config macro or an include guard, or is in Remove dead code from bun-uws, bun-usockets, the require.extensions FFI, and unused Cargo dependencies #40294, Remove dead code from bun_core, bun_jsc, bun_css, react_compiler, and two C++ bindings #40367, Remove dead code from the JSC bindings, the codegen scripts, the CI scripts, bun_core, and bun_jsc #40492, Remove dead code from the JSC, WebCore, and node bindings, uWS/uSockets, SecretsLinux, and seven Rust crates #42431 or Remove dead code from the class and sink generators, JSBuffer, the bake client, bun-error, and the build scripts #43378. The exception is the WriteBarrier<T> overload of visitGlobalObjectMember, which ZigGlobalObject.h documents as the extension point of the member list.
• tsc --noUnusedLocals over src/js: 5 diagnostics. 4 are loop bindings. #onConnect in http2.ts has a caller (this.#onConnect(arguments)).
• mordant unused_pub with no baseline, 3 targets: 167 items. 128 are in open pull requests (91 in Remove dead code from the Windows bunx shim, bun_sys, libuv_sys and mimalloc_sys #40172). Of the other 39, 25 are the E-prefixed errno aliases of windows_errno.rs, which exist so that one source compiles on both targets. The others have a user that the run does not compile, or are table entries: StoredTrace::from (cfg(bun_debug)), inflate_embedded (cfg(bun_codegen_embed)), CowSliceZ::init_dupe (unit test), host_fn_setter and host_fn_this_value (the class generator emits them for classes that are not shared).
• hawk dead_public, release profile, aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc and aarch64-apple-darwin: 807 findings. 659 are fields of FFI and serialized structs, so the layout needs them. 122 are constants and enum variants of code tables, most of them in Remove dead code from the Windows bunx shim, bun_sys, libuv_sys and mimalloc_sys #40172. Of the 9 functions and 7 methods, 7 are in Remove dead code from the Windows bunx shim, bun_sys, libuv_sys and mimalloc_sys #40172, Remove dead code from the WebCore bindings and 20 Rust crates #40525 or Remove dead code from bun_jsc, bun_runtime, bun_core, and the JSC bindings #40824, 2 are the host_fn helpers above, and 6 have their callers under cfg(debug_assertions) or cfg(bun_debug) (dump_stack_trace, StoredTrace::capture, has_resolve_breakpoint, TaskTag::name). ArrayHashMap::unlock_pointers has two callers in source. The 5 modules, 4 type aliases and 1 re-export are visibility findings (the module is used inside its crate), stubs or aliases for other platforms, the Result alias that each crate re-exports by convention, or in open pull requests. bun_sema has no finding.
• Linker: a second link of the debug build with --gc-sections --print-gc-sections. It drops 1,434 functions of bun's own C and C++ (sqlite and the highway target clones excluded). The names of 1,336 are on lines that open pull requests remove. The other 98 have a user on Windows or macOS, are unused copies of static inline functions, are --wrap shims, or are the llhttp API. It drops 153 Rust functions that map to one source location. 14 are in open pull requests. The others are const fn used at compile time, copies of #[inline] functions, Windows path helpers, or the btjs debugger entry.
• Trait impls: 101 hand-written impl blocks have no kept method in that link. 61 are in open pull requests. Of the other 40, 13 are Debug impls and 2 are Drop impls. 24 predate Remove dead code: 49 trait impls nothing uses, across 12 crates #43664, which did not remove them. Its notes say that such candidates do not compile away, or stayed by choice. The one new block, impl Alloc for Global in src/sema/table.rs, is the default of the A: Alloc type parameter.
• Commented-out code in C, C++ and TypeScript: 32 comment runs look like code. Each is an example inside a prose comment, or an open pull request removes it. The Rust sources are from 2026-05-14, so no Rust comment is older than 6 months.
• Cargo features and custom cfgs: each of the 8 features and 5 cfgs is enabled by a manifest or by scripts/build/rust.ts, is combined with debug_assertions, or is a documented manual switch.

Tools

• hawk: oven-sh/hawk at c9ca301 does not build with nightly-2026-09-15. Two imports moved: rustc_session::config::CrateType is now rustc_structures::CrateType, and rustc_session::lint::Level is now rustc_lint_defs::Level. With those two changes it builds and the analysis completes.
• mordant: c5e56d0 with nightly-2026-09-01, MORDANT_TOML without the baseline line, MORDANT_RUSTFLAGS="-A unknown_lints --cap-lints=warn".

Still dead on main, not in this diff (unchanged from the notes in #43664 and #43976)

• The PerformanceResourceTiming cluster in src/jsc/bindings/webcore (about 2,000 lines). The linker drops every constructor. The two globals are public, so a removal is a rewrite of the two wrappers and needs a decision.
• Clone for JsPoster and the JsPosterVTable::clone slot. Display for ErrorLocation and the filename field that only it reads. Each is a small refactor.
• 13 hand-written Debug impls that nothing formats. They are a debugging aid.
• Bun__napi_get_version in napi.cpp. Remove dead code from the JSC bindings, headers.h, the console builtin, and bun_jsc #40232 has the hunk under the old name of the function.
• The <Type>Class__call shims that the class generator emits for the seven Expect* matchers.
• packages/h3blast and the scripts that a person runs by hand.

Tests

test/cli/check/entry-points.test.ts with the debug build: 158 pass with --timeout 120000. With the default 5 s timeout, 4 tests time out in this container under ASAN (the slowest takes 5.1 s). test/internal/source-lints/workspace-lints.test.ts and build-rust.test.ts: 14 pass.

---

[policy-decision:dep] gate passed · iteration 0 · 2 files touched

passes on PR (with fix)

Dependency/toolchain change; no test proof to run.

diff hotspot

Cargo.lock          | 1 -
 src/sema/Cargo.toml | 1 -
 2 files changed, 2 deletions(-)

gate history · 1 passed · 0 rejected · iteration 0

evidence per changed file

file                 reads  edits  tests
Cargo.lock               0      0      0
src/sema/Cargo.toml      1      1      0

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: oven-sh/bun/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 913100a0-d517-4045-8a9d-494fde9b44da

📥 Commits

Reviewing files that changed from the base of the PR and between bbdc5a5 and 87a827a.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• src/sema/Cargo.toml

💤 Files with no reviewable changes (1)

• src/sema/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

Walkthrough

The bun_semver.workspace dependency was removed from src/sema/Cargo.toml.

Changes

Sema manifest update

Layer / File(s)	Summary
Remove semver dependency src/sema/Cargo.toml	The manifest no longer declares bun_semver as a workspace dependency.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 87a82

No actionable risk from the dependency removal remains; the PR is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the main change: removing the unused bun_semver dependency from bun_sema.
Description check	✅ Passed	The description explains the problem, the fix, and how the author verified it. It does not use the template’s exact section headings, but it provides the required information.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[robobun]

Status: ready for review. buildkite/bun, cargo clippy, cargo miri test, mordant, Format and Lint JavaScript pass.

How to reproduce: on main, run cargo check -p bun_sema. Cargo prints:

warning: unused dependency `bun_semver`
  --> src/sema/Cargo.toml:18:1

On this branch the same command prints no unused dependency warning for bun_sema.

The red check: claude-find-issues does not build or test this change. It looks for related issues. The same job also failed on the last 11 completed runs for other branches.

[claude]

LGTM, straightforward removal of an unused manifest entry.

What was reviewed:

• Searched all of src/sema/ (including the baselines, driver, and standalone sub-crates; no build.rs exists) for bun_semver — no code, cfg-gated, or test references, only the manifest line being removed.
• Checked Cargo.lock: only the bun_sema dependency-list entry is dropped; the bun_semver package itself stays, since other crates still consume it.
• Confirmed the lockfile edit matches the manifest edit, so the ninja/cargo build plan stays consistent.

Extended reasoning...

The change deletes one bun_semver.workspace = true line from src/sema/Cargo.toml and the matching entry in the bun_sema dependency list in Cargo.lock; nothing is added and no source files change. It touches no security-sensitive surface. A repo-wide search of src/sema finds no reference to bun_semver in any Rust file, sub-crate manifest, or build script, and bun_semver remains a workspace package with other consumers in Cargo.lock. The changed paths are not covered by .github/CODEOWNERS, and the bug hunt ran dry with no findings, so this is a mechanical two-line manifest cleanup safe to approve.