Remove 98 `unsafe` blocks from `bun_threading`, `bun_alloc`, the bundler and the transpiler by dylan-conway · Pull Request #47901 · oven-sh/bun

threading: `Semaphore` and `Channel` keep their state in a `Guarded`

claude

committed

0004f1b

threading: `Task::from_node` is a cast, and `Batch::pop` reads its own `len`

claude

committed

4f928f3

threading: `IntrusiveWorkTask` and `OwnedTask` are safe traits

claude

committed

daed865

alloc: `secure_zero` takes `&mut [u8]`

claude

committed

650cee1

collections: drop `VecExt::from_bump_slice` and `VecExt::writable_slice`

claude

committed

9500c26

sema: the stand-ins that ignore their arguments are safe `extern "C" fn`s

claude

committed

3aad198

alloc, opaque: remove dead code that carried `unsafe`

claude

committed

0f38b7e

alloc: `WTFStringImplStruct::m_ref_count` is an `AtomicU32`

claude

committed

dbddc13

alloc: `Mutex::lock` returns a guard that borrows the mutex

claude

committed

ebf7030

alloc: use the reference `MaybeUninit::write` returns, and index a checked slot

claude

committed

eaccd7a

alloc: `Zone::init` takes `&'static CStr`

claude

committed

61b1ec6

threading: a worker's `Thread` is only ever borrowed shared

claude

committed

d0d863b

threading: `Bun__lock` takes `&ReleaseImpl`

claude

committed

039a118

ptr: `DebugData::deinit` takes `&self`

claude

committed

4180b96

sql: `PostgresSQLConnection::drop` zeroes `options_buf` with `secure_zero`

claude

committed

fcab46d

bundler: `zigModuleInfoDeserializeddeinit` takes the `Box` that it drops

claude

committed

12efe51

transpiler: `print_with_source_map` takes `Option<&mut ModuleInfo>`

claude

committed

63f26c1

bundler: five `unsafe` blocks that plain borrows replace

claude

committed

b580702

bundler: `BundleThread::enqueue` takes `&self`; `generation` is a local of the thread

claude

committed

ae5fd67

bundler: `enqueue_entry_points_dev_server` borrows the transpiler where it uses it

claude

committed

8fe8818

bundler: `process_html_import_files` borrows four fields of the parse graph

claude

committed

b1147c9

transpiler: `Linker` takes what it reads as parameters instead of pointing into its `Transpiler`

claude

committed

e85108d

transpiler: `Transpiler::init` builds its value with a struct literal

claude

committed

11e2338

bundler: three worker contexts that only read the linker hold `&LinkerContext`

claude

committed

1e028bb

bundler: `LinkerContext::load` and `link` take the fields they use, not `*mut BundleV2`

claude

committed

a3dff79

bundler: the back-pointers of the tasks name the bundle's lifetime

claude

committed

052ab80

threading: `ThreadPool::each_ptr` hands each task a `&mut V`

claude

committed

5c2f91b

Navigation Menu

Repository navigation

Remove 98 `unsafe` blocks from `bun_threading`, `bun_alloc`, the bundler and the transpiler - #47901

Remove 98 `unsafe` blocks from `bun_threading`, `bun_alloc`, the bundler and the transpiler#47901
dylan-conway merged 27 commits into
mainfrom
claude/remove-unsafe-batch-11

Commits on Nov 4, 2026

threading: `Semaphore` and `Channel` keep their state in a `Guarded`

threading: `Task::from_node` is a cast, and `Batch::pop` reads its own `len`

threading: `IntrusiveWorkTask` and `OwnedTask` are safe traits

alloc: `secure_zero` takes `&mut [u8]`

collections: drop `VecExt::from_bump_slice` and `VecExt::writable_slice`

sema: the stand-ins that ignore their arguments are safe `extern "C" fn`s

alloc, opaque: remove dead code that carried `unsafe`

alloc: `WTFStringImplStruct::m_ref_count` is an `AtomicU32`

alloc: `Mutex::lock` returns a guard that borrows the mutex

alloc: use the reference `MaybeUninit::write` returns, and index a checked slot

alloc: `Zone::init` takes `&'static CStr`

threading: a worker's `Thread` is only ever borrowed shared

threading: `Bun__lock` takes `&ReleaseImpl`

ptr: `DebugData::deinit` takes `&self`

sql: `PostgresSQLConnection::drop` zeroes `options_buf` with `secure_zero`

bundler: `zigModuleInfoDeserializeddeinit` takes the `Box` that it drops

transpiler: `print_with_source_map` takes `Option<&mut ModuleInfo>`

bundler: five `unsafe` blocks that plain borrows replace

bundler: `BundleThread::enqueue` takes `&self`; `generation` is a local of the thread

bundler: `enqueue_entry_points_dev_server` borrows the transpiler where it uses it

bundler: `process_html_import_files` borrows four fields of the parse graph

transpiler: `Linker` takes what it reads as parameters instead of pointing into its `Transpiler`

transpiler: `Transpiler::init` builds its value with a struct literal

bundler: three worker contexts that only read the linker hold `&LinkerContext`

bundler: `LinkerContext::load` and `link` take the fields they use, not `*mut BundleV2`

bundler: the back-pointers of the tasks name the bundle's lifetime

threading: `ThreadPool::each_ptr` hands each task a `&mut V`