Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one
This report summarizes scanner evidence for oven-sh/bun, a Rust project with 96,175 GitHub stars. SynthScan examined 3,619,889 lines of code across 15678 source files, recording 11649 pattern matches distributed across 24 syntactic categories. The legacy adjusted pattern signal is 5.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 7029 finding(s).
Are imports declared and package/API names verified? 251 finding(s).
Are wrappers, guards, and repeated structures necessary? 5314 finding(s).
Which changes need focused human review? 11649 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 11649 distinct pattern matches across 24 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 118 | # ─── Release optimization ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http3-client.test.ts | 519 | // ───── streaming uploads (pull-driven request bodies) ───── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http3-client.test.ts | 594 | // ───── bidirectional ───── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 38 | // ─── raw server with full preface control ──────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 112 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 475 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 477 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 588 | // ─── session-key regressions ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/workers/worker-late-completion.test.ts | 46 | // ── thread pool: bun_jsc::Job ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/workers/worker-late-completion.test.ts | 165 | // ── thread pool: storage inside a JS-owned object ──────────────────────── | COMMENT |
| MEDIUM⚡ | test/js/web/workers/worker-late-completion.test.ts | 179 | // ── HTTP thread ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | test/js/web/workers/worker-late-completion.test.ts | 189 | // ── bundle thread ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | test/js/web/workers/worker-late-completion.test.ts | 196 | // ── weak posters (no ticket): delivered while draining, or refused ─────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 75 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 77 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 127 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 129 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 153 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 155 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 202 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 204 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 278 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 280 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 328 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 330 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 27 | // this file should be runnable standalone) ──────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 146 | // ─── 1. format confusion / lying magic bytes ───────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 181 | // ─── 2. truncation at every boundary ───────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 310 | // ─── 3. lying / overflowing header fields ──────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 389 | // ─── 4. malformed PNG chunk structure ──────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 444 | // ─── 5. malformed JPEG / EXIF ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 480 | // ─── 5b. JPEG that libjpeg decodes with a warning ──────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 753 | // ─── 5c. lossless JPEG (SOF3) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 953 | // ─── 6. lossless roundtrip parity ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1017 | // ─── 7. memory hygiene under repetition ────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1072 | // ─── 8. hostile JS option objects ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1192 | // ─── 9. concurrency / re-use ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1227 | // ─── 10. random-byte fuzz (cheap, bounded) ─────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-kernels.test.ts | 10 | // ─── plumbing (PNG build/read; same shape as image.test.ts) ───────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-kernels.test.ts | 105 | // ─── resize filters ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-kernels.test.ts | 228 | // ─── Floyd–Steinberg dither ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-vs-sharp.test.ts | 34 | // failure modes; small so the fixture stays a few-hundred KB) ──────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-vs-sharp.test.ts | 73 | // ─── PNG plumbing (same hand-roller as the other suites) ──────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-vs-sharp.test.ts | 165 | // back, in the same iteration order the test uses. ───────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 7 | // ─── Fixture builders ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 157 | // ─── Tests ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 1457 | // ── LZW pack ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 1505 | // ── container ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 46 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 48 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 74 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 76 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 121 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 123 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 157 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 159 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 191 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 194 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 230 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 233 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| 4298 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 121 | # CGUs ≈ 1680 separately-optimized units with NO cross-crate inlining beyond | COMMENT |
| LOW | Cargo.toml | 141 | panic = "abort" | COMMENT |
| LOW | Cargo.toml | 161 | # `#![no_std]`/`#![no_main]` + a custom `/ENTRY:` (no CRT), and the build | COMMENT |
| LOW | Cargo.toml | 181 | overflow-checks = false | COMMENT |
| LOW | rustfmt.toml | 1 | # rustfmt config for the Cargo workspace. Formatting is the toolchain default | COMMENT |
| LOW | mordant.toml | 1 | [mordant] | COMMENT |
| LOW | bunfig.toml | 1 | [test] | COMMENT |
| LOW | rust-toolchain.toml | 1 | [toolchain] | COMMENT |
| LOW | bench/snippets/buffer.js | 21 | // time("DataView.getBigInt64 (BE)", () => view.getBigInt64(0, false)); | COMMENT |
| LOW | bench/snippets/buffer.js | 41 | time("Buffer.readFloatLE ", () => buf.readFloatLE(0)); | COMMENT |
| LOW | bench/snippets/buffer.js | 61 | // console.log(""); | COMMENT |
| LOW | bench/snippets/buffer.js | 81 | time("Buffer.writeBigUInt64BE", () => buf.writeBigUInt64BE(BigInt(0), 0)); | COMMENT |
| LOW | bench/snippets/buffer.js | 101 | // console.log(""); | COMMENT |
| LOW | bench/snippets/deep-equals.js | 341 | // get foo() { | COMMENT |
| LOW | bench/install/next-env.d.ts | 1 | /// <reference types="next" /> | COMMENT |
| LOW | test/no-validate-leaksan.txt | 381 | test/js/node/test/parallel/test-https-localaddress-bind-error.js | COMMENT |
| LOW | test/expectations.txt | 1 | # Format: [modifier] test-name [[ expectations ]] [# comment] | COMMENT |
| LOW | test/expectations.txt | 21 | # agents have no ClangCL toolset ("MSB8020: The build tools for ClangCL cannot | COMMENT |
| LOW | test/flaky-tests.txt | 1 | # Test files known to be flaky in CI. The runner (scripts/runner.node.ts) | COMMENT |
| LOW | test/v8/v8-module/main.cpp | 1 | #include <node.h> | COMMENT |
| LOW | test/snippets/lodash-regexp.js | 21 | // export function test() { | COMMENT |
| LOW | test/docker/coordinator.ts | 41 | COMMENT | |
| LOW | test/js/workerd/html-rewriter-leak.test.ts | 121 | expect(after.protectedException).toBeLessThanOrEqual(before.protectedException); | COMMENT |
| LOW | test/js/workerd/html-rewriter-leak.test.ts | 341 | // LOLHTMLContext.deinit() must destroy those allocations. Previously it only | COMMENT |
| LOW | test/js/web/structured-clone-blob-file.test.ts | 361 | }); | COMMENT |
| LOW | …/js/web/abort/abort-signal-event-listener-leak.test.ts | 1 | import { estimateShallowMemoryUsageOf } from "bun:jsc"; | COMMENT |
| LOW | …bsocket/websocket-proxy-tunnel-upgrade-leak-fixture.ts | 1 | // Repro for HTTPUpgradeClient leak on wss:// through an HTTP CONNECT proxy | COMMENT |
| LOW | …b/websocket/websocket-proxy-tunnel-client-leak.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | test/js/web/websocket/websocket-utf16-headers.test.ts | 1 | // Regression test for WebSocket upgrade request crash on non-ASCII inputs. | COMMENT |
| LOW | test/js/web/websocket/websocket-proxy.test.ts | 361 | // were read as frame headers and the connection failed. | COMMENT |
| LOW | test/js/web/websocket/websocket.tls.ipv6.test.ts | 1 | // Regression test for the WebSocket side of | COMMENT |
| LOW | …ebsocket/websocket-proxy-tunnel-client-leak-fixture.ts | 1 | // Repro for NewWebSocketClient(false) leak on wss:// through an HTTP CONNECT | COMMENT |
| LOW | test/js/web/websocket/websocket-close-code.test.ts | 1 | // WebSocket#close() argument validation and the close-code handling that | COMMENT |
| LOW | test/js/web/intl/intl.test.ts | 1 | // ECMA-402 Intl coverage. Doubles as the regression net for the per-item zstd | COMMENT |
| LOW | test/js/web/timers/timers-fixture-unref.js | 81 | // See https://github.com/nodejs/node/issues/9561 | COMMENT |
| LOW | test/js/web/streams/compression.test.ts | 661 | return source.pulls; | COMMENT |
| LOW | test/js/web/streams/streams-leak.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | test/js/web/streams/native-source-onclose-leak.test.ts | 1 | import { heapStats } from "bun:jsc"; | COMMENT |
| LOW | test/js/web/encoding/text-decoder-cjk.test.ts | 281 | // 8F A1 starts a JIS X 0212 sequence; 0x61 aborts it. A1 A1 is then a | COMMENT |
| LOW | test/js/web/encoding/text-encoder-stream.test.ts | 301 | // Latin-1: the up-front reservation (one byte per input byte) is above the cap. | COMMENT |
| LOW | …t/js/web/html/FormData-multipart-serialization.test.ts | 161 | // Serializing an in-memory blob entry borrows its bytes; the only blob-sized | COMMENT |
| LOW | test/js/web/html/FormData-file-error-leak.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | test/js/web/html/FormData-file-error-leak-fixture.ts | 1 | // Fixture for FormData → multipart body memory leak on readFile failure. | COMMENT |
| LOW | …/js/web/broadcastchannel/message-event-init-gc.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | …b/broadcastchannel/broadcast-channel-worker-gc.test.ts | 101 | ); | COMMENT |
| LOW | …b/broadcastchannel/broadcast-channel-worker-gc.test.ts | 181 | expect(filterStderr(stderr)).toBe(""); | COMMENT |
| LOW | test/js/web/fetch/http-chunked-server.c | 1 | // Simple HTTP server that reproduces a streaming response body bug. | COMMENT |
| LOW | test/js/web/fetch/fetch-tcp-keepalive.test.ts | 1 | // Verifies that fetch() enables TCP keepalive (SO_KEEPALIVE + TCP_KEEPIDLE) | COMMENT |
| LOW | test/js/web/fetch/fetch-tcp-keepalive.test.ts | 161 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | test/js/web/fetch/fetch-buffer-peak-fixture.ts | 1 | // Measures the client-side resident set across a single large buffered | COMMENT |
| LOW | …st/js/web/fetch/fetch-proxy-tls-intern-race-fixture.ts | 1 | // Subprocess fixture for fetch-proxy-tls-intern-race.test.ts. | COMMENT |
| LOW | test/js/web/fetch/fetch-abort-queued.test.ts | 1 | // When `active_requests_count >= max_simultaneous_requests`, new fetch() | COMMENT |
| LOW | test/js/web/fetch/blob.test.ts | 321 | expect([a.name, b.name]).toEqual(["a.txt", "b.txt"]); | COMMENT |
| LOW | test/js/web/fetch/fetch-http3-client.test.ts | 401 | const res = await fetch(`${base}${path}`, { ...h3, method: "POST", body: "x", headers }); | COMMENT |
| LOW | test/js/web/fetch/fetch-http3-client.test.ts | 941 | } | COMMENT |
| LOW | …js/web/fetch/fetch-stream-body-ended-inline-fixture.ts | 1 | // Regression: fetch() with a native ByteStream request body (an upstream | COMMENT |
| LOW | test/js/web/fetch/body.test.ts | 1301 | // by GC in this build independently of bodies — `Buffer.alloc(2e6).toString()` | COMMENT |
| LOW | test/js/web/fetch/body.test.ts | 1401 | COMMENT | |
| LOW | …/js/web/fetch/fetch.tls.cert-mismatch-churn.fixture.ts | 1 | // Fixture for "rejects a trusted cert with a mismatched hostname cleanly under churn". | COMMENT |
| LOW | …/js/web/fetch/fetch.tls.cert-mismatch-churn.fixture.ts | 21 | COMMENT | |
| 5776 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/harness.ts | 186 | async function findOrDownloadAbiMatchingNode(): Promise<string> { | CODE |
| LOW | test/harness.ts | 471 | export function makeTreeSyncFromDirectoryTree(base: string, tree: DirectoryTree) { | CODE |
| LOW | test/harness.ts | 642 | export function randomInvalidSurrogatePair() { | CODE |
| LOW | test/harness.ts | 1347 | function failTestsOnBlockingWriteCall() { | CODE |
| LOW | test/harness.ts | 1820 | export function fileDescriptorLeakChecker() { | CODE |
| LOW | test/_util/numeric.ts | 93 | export function computePearsonCorrelation(xs: number[], ys: number[]): number { | CODE |
| LOW | test/_util/numeric.ts | 160 | export function computeAverageAbsoluteDeviation(xs: number[]): number { | CODE |
| LOW | test/js/deno/crypto/random.test.ts | 51 | test(function getRandomValuesReturnValue() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 506 | test(async function subtleCryptoHmacImportExport() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 755 | test(async function testHkdfDeriveBitsWithLargeKeySize() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 768 | test(async function testEcdhDeriveBitsWithShorterLength() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 782 | test(async function testEcdhDeriveBitsWithLongerLength() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 795 | test(async function testEcdhDeriveBitsWithNullLength() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 1063 | test(async function testDecryptWithInvalidIntializationVector() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 2559 | test(async function ecPrivateKeyMaterialExportSpki() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 2603 | test(async function testImportLeadingZeroesKey() { | CODE |
| LOW | test/js/deno/abort/abort-controller.test.ts | 52 | test(function controllerHasProperToString() { | CODE |
| LOW | test/js/deno/encoding/encoding.test.ts | 285 | test(function toStringShouldBeWebCompatibility() { | CODE |
| LOW | test/js/deno/encoding/encoding.test.ts | 291 | test(function textEncoderShouldCoerceToString() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 6 | test(function urlSearchParamsWithMultipleSpaces() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 13 | test(function urlSearchParamsWithExclamation() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 23 | test(function urlSearchParamsWithQuotes() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 33 | test(function urlSearchParamsWithBraket() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 53 | test(function urlSearchParamsInitString() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 58 | test(function urlSearchParamsInitStringWithPlusCharacter() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 66 | test(function urlSearchParamsInitStringWithMalformedParams() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 114 | test(function urlSearchParamsAppendSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 119 | test(function urlSearchParamsDeleteSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 125 | test(function urlSearchParamsGetAllSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 137 | test(function urlSearchParamsGetSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 144 | test(function urlSearchParamsHasSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 151 | test(function urlSearchParamsSetReplaceFirstAndRemoveOthers() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 157 | test(function urlSearchParamsSetAppendNew() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 163 | test(function urlSearchParamsSortSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 169 | test(function urlSearchParamsForEachSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 190 | test(function urlSearchParamsMissingName() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 196 | test(function urlSearchParamsMissingValue() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 202 | test(function urlSearchParamsMissingEqualSign() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 208 | test(function urlSearchParamsMissingPair() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 213 | test(function urlSearchParamsForShortEncodedChar() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 221 | test(function urlSearchParamsShouldThrowTypeError() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 86 | test(function urlSearchParamsInitIterable() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 100 | test(function urlSearchParamsInitRecord() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 256 | test(function urlSearchParamsAppendArgumentsCheck() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 299 | test(function urlSearchParamsDeletingAppendedMultiple() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 311 | test(function urlSearchParamsCustomSymbolIterator() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 322 | test(function urlSearchParamsCustomSymbolIteratorWithNonStringParams() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 333 | test(function urlSearchParamsOverridingAppendNotChangeConstructorAndSet() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 354 | test(function urlSearchParamsOverridingEntriesNotChangeForEach() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 266 | test(function deletingAllParamsRemovesQuestionMarkFromURL() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 273 | test(function removingNonExistentParamRemovesQuestionMarkFromURL() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 280 | test(function sortingNonExistentParamRemovesQuestionMarkFromURL() { | CODE |
| LOW | test/js/deno/url/url.test.ts | 293 | test(function throwForInvalidPortConstructor() { | CODE |
| LOW | test/js/deno/url/url.test.ts | 307 | test(function doNotOverridePortIfInvalid() { | CODE |
| LOW | test/js/deno/url/url.test.ts | 313 | test(function emptyPortForSchemeDefaultPort() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 332 | test(function assigningPortPropertyAffectsReceiverOnly() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 339 | test(function urlSearchParamsIdentityPreserved() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 346 | test(function urlTakeURLObjectAsParameter() { | CODE |
| LOW | test/js/deno/fetch/blob.test.ts | 111 | test(function blobConstructorNameIsBlob() { | CODE |
| LOW | test/js/deno/fetch/blob.test.ts | 115 | test.ignore(function blobCustomInspectFunction() { | CODE |
| 884 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 228 | print("Hello, world!"); | CODE |
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 229 | print("Goodbye, world!"); | CODE |
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 233 | print("Hello, world!"); | CODE |
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 234 | print("Goodbye, world!"); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 116 | print({ defaultIsExportsObject: ns.default === fs, readFileSync: typeof readFileSync, kinds: kinds() }); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 125 | print({ kinds: kinds(), isTheClass: typeof ReadStream === "function" && ReadStream === fs.ReadStream }); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 139 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 164 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 182 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 220 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 266 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 300 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 355 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 395 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 436 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 498 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 531 | print({ addedBeforeLoad: ns.addedBeforeLoad, exportsAddedAfterLoad: "addedAfterLoad" in ns }); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 547 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 583 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 631 | print({ log, e, x }); | CODE |
| HIGH | test/js/bun/shell/bunshell.test.ts | 2423 | elif echo baz;then echo qux;fi` | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 66 | print({ url: view.url, title: view.title, value, undef }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 82 | print({ length: value.length, equal: value === big }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 93 | print(await view.evaluate(JSON.stringify(big) + " === " + ${JSON.stringify(BIG)})); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 105 | print({ type: blob.type, size: bytes.length, hash: String(Bun.hash(bytes)) }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 120 | print({ urls: views.map(view => view.url), values }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 133 | print(await outcome(view.evaluate("(() => { throw new Error('inside the fake'); })()"))); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 156 | print({ death, second: await second.evaluate("'alive again'") }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 175 | print(unhandled); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 194 | print({ heldOutcome, unhandled }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 223 | print(unhandled); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 248 | print({ held, failedMessage: failed.message, loadingAfterFail, unhandled }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 279 | print({ failedMessage: failed.message, loadingAfterFail, unhandled }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 306 | print(unhandled); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 334 | print(outcomeStr); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 400 | print(await outcome(view.evaluate("__fake_close_replies()"))); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 411 | print({ closing, next }); | CODE |
| HIGH | test/js/node/http2/http2-option-checks.fixture.js | 144 | print( | CODE |
| HIGH | test/js/node/http2/http2-option-checks.fixture.js | 160 | print("other calls", [ | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 153 | print(<div>Hello World</div>) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 154 | print(<div className="container"><Component prop={2}><h1 onClick={() => 1}>hello</h1></Component></div>) | CODE |
| HIGH⚡ | test/bundler/bundler_jsx.test.ts | 175 | print(<div>Hello World</div>) | CODE |
| HIGH⚡ | test/bundler/bundler_jsx.test.ts | 176 | print(<div className="container"><Component prop={2}><h1 onClick={() => 1}>hello</h1></Component></div>) | CODE |
| HIGH⚡ | test/bundler/bundler_jsx.test.ts | 177 | print(<>Fragment</>) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 198 | print([typeof F, typeof el]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 221 | print([el, a, b, c]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 306 | print([<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 327 | print([<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 349 | print([<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH⚡ | test/bundler/bundler_jsx.test.ts | 378 | print(['classic.jsx',<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH⚡ | test/bundler/bundler_jsx.test.ts | 386 | print(['classic-renamed.jsx',<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH⚡ | test/bundler/bundler_jsx.test.ts | 390 | print(['automatic.jsx',<div props={123}>Hello World</div>, process.env.NODE_ENV === 'production' ? '' : <>Fragme | CODE |
| HIGH⚡ | test/bundler/bundler_jsx.test.ts | 395 | print(['automatic-source2.jsx',<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 421 | print([<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 443 | print([<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 471 | print([<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 491 | print([<div props={123}>Hello World</div>, <>Fragment</>]) | CODE |
| HIGH | …-compiler-fixtures/hoisting-nested-block-statements.js | 6 | print(x); | CODE |
| HIGH | …-compiler-fixtures/hoisting-nested-block-statements.js | 10 | print(x); | CODE |
| HIGH⚡ | …eact-compiler-fixtures/flag-enable-emit-hook-guards.ts | 13 | print(identity(CONST_STRING0)); | CODE |
| 9 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …mpiler-fixtures/readonly-object-method-calls.expect.md | 16 | const posts = user.timeline.posts.edges.nodes.map(node => ( | CODE |
| CRITICAL | …mpiler-fixtures/readonly-object-method-calls.expect.md | 45 | posts = user.timeline.posts.edges.nodes.map(_temp); | CODE |
| CRITICAL | …/readonly-object-method-calls-mutable-lambda.expect.md | 17 | const posts = user.timeline.posts.edges.nodes.map(node => { | CODE |
| CRITICAL | …/readonly-object-method-calls-mutable-lambda.expect.md | 46 | const posts = user.timeline.posts.edges.nodes.map((node) => { | CODE |
| CRITICAL | …ixtures/readonly-object-method-calls-mutable-lambda.js | 13 | const posts = user.timeline.posts.edges.nodes.map(node => { | CODE |
| CRITICAL | …eact-compiler-fixtures/readonly-object-method-calls.js | 12 | const posts = user.timeline.posts.edges.nodes.map(node => ( | CODE |
| CRITICAL | src/install/PackageManager/runTasks.rs | 1147 | task.request.local_tarball.tarball.url.slice() | CODE |
| CRITICAL | src/install/PackageManager/security_scanner.rs | 160 | let string_buf = self.manager.lockfile.buffers.string_bytes.as_slice(); | CODE |
| CRITICAL | src/install/PackageManager/security_scanner.rs | 191 | let string_buf = self.manager.lockfile.buffers.string_bytes.as_slice(); | CODE |
| CRITICAL | src/install/PackageManager/security_scanner.rs | 615 | let resolutions = self.manager.lockfile.buffers.resolutions.as_slice(); | CODE |
| CRITICAL | src/install/PackageManager/security_scanner.rs | 719 | let string_buf = self.manager.lockfile.buffers.string_bytes.as_slice(); | CODE |
| CRITICAL | src/runtime/cli/pack_command.rs | 2046 | if ctx.manager.options.publish_config.tag.is_empty() { | CODE |
| CRITICAL | src/runtime/cli/pack_command.rs | 2051 | if ctx.manager.options.publish_config.access.is_none() { | CODE |
| CRITICAL | src/runtime/cli/test_command.rs | 1359 | let report = this.jest.test_options.reporters.junit.then(|| { | CODE |
| CRITICAL | src/runtime/cli/publish_command.rs | 871 | bstr::BStr::new(if !ctx.manager.options.publish_config.tag.is_empty() { | CODE |
| CRITICAL | src/runtime/cli/publish_command.rs | 902 | if !ctx.manager.options.publish_config.otp.is_empty() { | CODE |
| CRITICAL | src/runtime/cli/publish_command.rs | 1980 | let tag: &[u8] = if !ctx.manager.options.publish_config.tag.is_empty() { | CODE |
| CRITICAL | src/runtime/api/JSTranspiler.rs | 358 | let Ok(Some(json)) = vm.transpiler.resolver.caches.json.parse_json( | CODE |
| CRITICAL | src/sema/check/errors_collisions.rs | 315 | let module = self.p.files.options.module.name(); | CODE |
| CRITICAL | src/sema/check/errors.rs | 1692 | let types = self.p.files.options.types.as_ref(); | CODE |
| CRITICAL | src/js_parser/visit/visit_stmt.rs | 1143 | let new_len = if !(data.is_export && p.options.features.replace_exports.entries.len() > 0) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bench/snippets/buffer-includes.js | 2 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | bench/snippets/buffer-includes.js | 2 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | bench/snippets/_fixture.txt | 1191 | <td id="LC98" class="blob-code blob-code-inner js-file-line"><span class="pl-s"> Lorem ipsum dolor sit amet, | CODE |
| LOW | bench/snippets/_fixture.txt | 1191 | <td id="LC98" class="blob-code blob-code-inner js-file-line"><span class="pl-s"> Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1339 | <td id="LC135" class="blob-code blob-code-inner js-file-line"> let string_long_escaped = "\n Lorem ip | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1339 | <td id="LC135" class="blob-code blob-code-inner js-file-line"> let string_long_escaped = "\n Lorem ip | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1343 | <td id="LC136" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> string_short <sp | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1343 | <td id="LC136" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> string_short <sp | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1351 | <td id="LC138" class="blob-code blob-code-inner js-file-line"> <span class="pl-s">"Lorem ipsum dolor | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1351 | <td id="LC138" class="blob-code blob-code-inner js-file-line"> <span class="pl-s">"Lorem ipsum dolor | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1355 | <td id="LC139" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> no_escape <span | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1355 | <td id="LC139" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> no_escape <span | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1363 | <td id="LC141" class="blob-code blob-code-inner js-file-line"><span class="pl-s">Lorem ipsum dolor sit amet, con | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1363 | <td id="LC141" class="blob-code blob-code-inner js-file-line"><span class="pl-s">Lorem ipsum dolor sit amet, con | CODE |
| LOW | test/js/workerd/html-rewriter.test.js | 1929 | .transform(new Response("<p>Lorem ipsum!</p>")) | CODE |
| LOW | test/js/workerd/html-rewriter.test.js | 1944 | .transform(new Response("<p>Lorem ipsum!<br></p><div />")) | CODE |
| LOW | test/js/workerd/html-rewriter.test.js | 1962 | .transform(new Response("<p>Lorem ipsum!<br></p><div /><svg><circle /></svg>")) | CODE |
| LOW | test/js/web/streams/compression.test.ts | 1309 | text += `<section id="s${i}"><p>${rand().toString(36).slice(2)} lorem ipsum ${((i * 2654435761) >>> 0).toString(36)} | CODE |
| LOW | test/js/web/fetch/fetch-backpressure.test.ts | 865 | const raw = Buffer.alloc(SIZE, "alpha beta gamma delta lorem ipsum "); | CODE |
| LOW | test/js/valkey/integration/complex-operations.test.ts | 191 | await ctx.redis.set(`${baseKey}:name`, "John Doe"); | CODE |
| LOW | test/js/valkey/integration/complex-operations.test.ts | 219 | expect(nameValue).toBe("John Doe"); | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4093 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4093 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4095 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4095 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 654 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 654 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 656 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 656 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW | test/js/bun/test/fake-timers/sinonjs/issue-437.test.ts | 18 | return "Lorem ipsum"; | CODE |
| LOW | test/js/bun/test/fake-timers/sinonjs/issue-437.test.ts | 25 | assert.equals(dateTime.foo(), "Lorem ipsum"); | CODE |
| LOW | test/js/bun/io/bun-write.test.js | 285 | "existing.bin": "placeholder", | CODE |
| LOW | test/js/bun/http/bun-serve-routes.test.ts | 60 | id: "user@example.com", | CODE |
| LOW | test/js/bun/http/decodeURIComponentSIMD.test.ts | 21 | "user@example.com", | CODE |
| LOW | test/js/bun/http/serve-http3.test.ts | 1842 | "user@example.com", | CODE |
| LOW | test/js/bun/http/serve-http3.test.ts | 1858 | "user@example.com": "200 /index", | CODE |
| LOW | test/js/bun/http/proxy.test.ts | 2722 | () => ({ HTTP_PROXY: "placeholder" }), | CODE |
| LOW | test/js/bun/http/request-smuggling.test.ts | 1712 | ["user@example.com"], | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 142 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 142 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 149 | <p>Lorem ipsum dolor sit amet.</p> | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 149 | <p>Lorem ipsum dolor sit amet.</p> | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 170 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 170 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 180 | <tr><td>Lorem ipsum dolor sit amet.</td><td></td></tr> | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 180 | <tr><td>Lorem ipsum dolor sit amet.</td><td></td></tr> | CODE |
| LOW | test/js/bun/md/spec.txt | 9453 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9512 | > Lorem ipsum dolor | CODE |
| LOW | test/js/bun/md/spec.txt | 9527 | > Lorem ipsum dolor | CODE |
| LOW | test/js/bun/md/spec.txt | 9539 | "Lorem ipsum dolor" | CODE |
| LOW | test/js/bun/md/spec.txt | 9555 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9573 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9595 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9618 | str "Lorem ipsum dolor" | CODE |
| LOW | test/js/third_party/next-auth/fixture/src/auth.ts | 44 | if (credentials?.email === "user@example.com" && credentials?.password === "password") { | CODE |
| LOW | test/js/third_party/next-auth/fixture/src/auth.ts | 47 | email: "user@example.com", | CODE |
| LOW | …ird_party/body-parser/express-body-parser-test.test.ts | 82 | expect(req.body).toEqual({ "name": "John Doe", "email": "john.doe@example.com" }); | CODE |
| LOW | …ird_party/body-parser/express-body-parser-test.test.ts | 89 | const payload = Buffer.from(JSON.stringify({ "name": "John Doe", "email": "john.doe@example.com" })); | CODE |
| LOW | test/js/third_party/astro/astro-post.test.js | 74 | formData.append("name", "John Doe"); | CODE |
| LOW | test/js/third_party/astro/astro-post.test.js | 87 | name: "John Doe", | CODE |
| 96 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/net/tls-low-prio-queue-fixture.ts | 368 | // Step 2: every ClientHello becomes readable in the next iteration. | COMMENT |
| LOW | …est/parallel/test-http-agent-free-socket-data-guard.js | 31 | // Step 1: Send request1 | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 55 | // Step 2: Server injects a poisoned response while socket is idle | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 64 | // Step 3: Allow the event loop to poll I/O so the guard can fire. | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 73 | // Step 4: Send request2 — should get a fresh connection | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 417 | // Step 4: convert V with ECMA-262 ToNumber. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 420 | // Step 5: normalize -0 to +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 425 | // Step 6: [EnforceRange] rejects non-finite and out-of-range values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 447 | // Step 7: [Clamp] clamps, rounds, and returns non-NaN values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 455 | // Step 8: NaN, +0, -0, and infinities become +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 460 | // Step 9: truncate to IntegerPart(x). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 483 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 488 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 505 | // Step 10: reduce modulo 2^bitLength. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 509 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 514 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 636 | // Step 2: throw unless S is one of the enumeration values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 643 | // Step 3: return the matching enumeration value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 713 | // Step 1: reject non-object, non-null, non-undefined values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 721 | // Step 2: create the IDL dictionary value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 782 | // Step 2: GetMethod(V, %Symbol.iterator%). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 784 | // Step 3: throw if the iterator method is undefined, null, or not callable. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 559 | // Step 2: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 762 | // Step 5: return the IDL dictionary. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 839 | // Step 2: otherwise throw. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 881 | // Step 3: reject non-fixed SharedArrayBuffer backing stores unless | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 950 | // Step 5: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 1016 | // Step 4: return a reference to the same ArrayBuffer. | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 674 | // Step 1: Insert a row (succeeds) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 680 | // Step 2: Try to insert conflicting row (throws expected error) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 689 | // Step 3: Try another query - THIS WILL HANG | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 25 | // Step 1: Check if stdin is piped | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 34 | // Step 2: After stdin EOF, try to reopen /dev/tty | COMMENT |
| LOW | test/bundler/bundler_compile.test.ts | 1492 | // Step 2: Run bun build with compile, minify, sourcemap, and bytecode | COMMENT |
| LOW | packages/bun-uws/src/HttpContext.h | 586 | /* First of all we need to check if this socket was deleted due to upgrade */ | COMMENT |
| LOW | packages/bun-uws/src/HttpContext.h | 828 | /* We need to check if we should close this socket here now */ | COMMENT |
| LOW | packages/bun-uws/src/HttpResponse.h | 308 | /* We need to check if we should close this socket here now */ | COMMENT |
| LOW | packages/bun-uws/src/HttpResponse.h | 371 | /* We need to check if we should close this socket here now */ | COMMENT |
| LOW | src/install/npm.rs | 1607 | // stability check - if the previous package is blocked from age, we need to check if the current packag | COMMENT |
| LOW | src/install/npm.rs | 1774 | // stability check - if the previous package is blocked from age, we need to check if the current package wa | COMMENT |
| LOW | src/js/internal/streams/readable.ts | 1076 | // We need to check if there is someone still listening to | COMMENT |
| LOW | src/js/internal/streams/readable.ts | 1095 | // We need to check if there is someone still listening to | COMMENT |
| LOW | src/js/internal/repl/completion.js | 725 | // If a getter/proxy hasn't been found by the recursion call we need to check if maybe a getter/proxy | COMMENT |
| LOW⚡ | src/js/internal/sql/shared.ts | 1708 | // Step 1: Determine the options object and initial URL | COMMENT |
| LOW | src/js/internal/sql/shared.ts | 1761 | // Step 3: Parse protocol and ensure URL format for non-SQLite databases | COMMENT |
| LOW⚡ | src/js/internal/sql/shared.ts | 1792 | // Step 4: Set adapter from environment if not already set, but ONLY if not | COMMENT |
| LOW⚡ | src/js/internal/sql/shared.ts | 1798 | // Step 5: Return early if adapter is explicitly specified | COMMENT |
| LOW | src/js/internal/sql/shared.ts | 1811 | // Step 6: Infer adapter from protocol | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 116 | // Step 1: Merge affected scopes to their canonical root. | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 163 | // Step 2: Repoint identifiers whose scopes were merged | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 266 | // Step 1: Collect rewrites | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 269 | // Step 2: Apply rewrites by splitting blocks | COMMENT |
| LOW | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 333 | // Step 3: Repoint phis when they refer to a rewritten block | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 353 | // Step 4: Fixup HIR to restore RPO, correct predecessors, renumber instructions | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 358 | // Step 5: Fix scope and identifier ranges to account for renumbered instructions | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 92 | // Step 2: Calculate hoistable dependencies using the tree. | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 98 | // Step 3: Reduce dependencies to a minimal set. | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1018 | // Step 1: Collect identifier to function expression mappings | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1046 | // Step 2: Forward pass to analyze assumed function calls | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1119 | // Step 3: Propagate assumed-invoked status through mayInvoke chains | COMMENT |
| 20 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/net/tls-low-prio-queue-fixture.ts | 368 | // Step 2: every ClientHello becomes readable in the next iteration. | COMMENT |
| LOW | …est/parallel/test-http-agent-free-socket-data-guard.js | 31 | // Step 1: Send request1 | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 55 | // Step 2: Server injects a poisoned response while socket is idle | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 64 | // Step 3: Allow the event loop to poll I/O so the guard can fire. | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 73 | // Step 4: Send request2 — should get a fresh connection | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 417 | // Step 4: convert V with ECMA-262 ToNumber. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 420 | // Step 5: normalize -0 to +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 455 | // Step 8: NaN, +0, -0, and infinities become +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 460 | // Step 9: truncate to IntegerPart(x). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 483 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 488 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 505 | // Step 10: reduce modulo 2^bitLength. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 509 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 514 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 636 | // Step 2: throw unless S is one of the enumeration values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 643 | // Step 3: return the matching enumeration value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 713 | // Step 1: reject non-object, non-null, non-undefined values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 721 | // Step 2: create the IDL dictionary value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 782 | // Step 2: GetMethod(V, %Symbol.iterator%). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 784 | // Step 3: throw if the iterator method is undefined, null, or not callable. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 559 | // Step 2: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 762 | // Step 5: return the IDL dictionary. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 839 | // Step 2: otherwise throw. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 881 | // Step 3: reject non-fixed SharedArrayBuffer backing stores unless | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 950 | // Step 5: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 1016 | // Step 4: return a reference to the same ArrayBuffer. | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 674 | // Step 1: Insert a row (succeeds) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 680 | // Step 2: Try to insert conflicting row (throws expected error) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 689 | // Step 3: Try another query - THIS WILL HANG | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 25 | // Step 1: Check if stdin is piped | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 34 | // Step 2: After stdin EOF, try to reopen /dev/tty | COMMENT |
| LOW | test/bundler/bundler_compile.test.ts | 1492 | // Step 2: Run bun build with compile, minify, sourcemap, and bytecode | COMMENT |
| LOW | packages/bun-lambda/README.md | 21 | ### Step 1: Create a Bun Lambda handler function | COMMENT |
| LOW | packages/bun-lambda/README.md | 58 | ### Step 2: Build the Bun handler | COMMENT |
| LOW | packages/bun-lambda/README.md | 65 | ### Step 3: Create the Lambda function on AWS | COMMENT |
| LOW⚡ | src/js/internal/sql/shared.ts | 1708 | // Step 1: Determine the options object and initial URL | COMMENT |
| LOW | src/js/internal/sql/shared.ts | 1761 | // Step 3: Parse protocol and ensure URL format for non-SQLite databases | COMMENT |
| LOW⚡ | src/js/internal/sql/shared.ts | 1792 | // Step 4: Set adapter from environment if not already set, but ONLY if not | COMMENT |
| LOW⚡ | src/js/internal/sql/shared.ts | 1798 | // Step 5: Return early if adapter is explicitly specified | COMMENT |
| LOW | src/js/internal/sql/shared.ts | 1811 | // Step 6: Infer adapter from protocol | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 116 | // Step 1: Merge affected scopes to their canonical root. | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 163 | // Step 2: Repoint identifiers whose scopes were merged | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 266 | // Step 1: Collect rewrites | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 269 | // Step 2: Apply rewrites by splitting blocks | COMMENT |
| LOW | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 333 | // Step 3: Repoint phis when they refer to a rewritten block | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 353 | // Step 4: Fixup HIR to restore RPO, correct predecessors, renumber instructions | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 358 | // Step 5: Fix scope and identifier ranges to account for renumbered instructions | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 92 | // Step 2: Calculate hoistable dependencies using the tree. | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 98 | // Step 3: Reduce dependencies to a minimal set. | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1018 | // Step 1: Collect identifier to function expression mappings | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1046 | // Step 2: Forward pass to analyze assumed function calls | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1119 | // Step 3: Propagate assumed-invoked status through mayInvoke chains | COMMENT |
| LOW | src/runtime/server/StaticRoute.rs | 498 | // Step 1: If-Match (strong comparison); step 2: If-Unmodified-Since | COMMENT |
| LOW⚡ | src/runtime/server/StaticRoute.rs | 515 | // Step 3: If-None-Match (weak comparison). Presence suppresses step 4. | COMMENT |
| LOW⚡ | src/runtime/server/StaticRoute.rs | 521 | // Step 4: If-Modified-Since (only when If-None-Match is absent). | COMMENT |
| LOW | src/runtime/webcore/Body.rs | 1831 | // Step 1: If this is unusable, throw a TypeError. | COMMENT |
| LOW | src/runtime/webcore/Body.rs | 1846 | // Step 2: null body → a new empty closed ReadableStream. | COMMENT |
| LOW | src/jsc/bindings/NodeVM.cpp | 1447 | // Step 1: Argument validation | COMMENT |
| LOW | src/jsc/bindings/NodeVM.cpp | 1490 | // Step 3: Create a new function | COMMENT |
| LOW | src/jsc/bindings/BunHeapProfiler.cpp | 280 | // Step 1: Build post-order indexes via DFS from root (node 0) | COMMENT |
| 9 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 16 | var iC=Object.create;var{getPrototypeOf:tC,defineProperty:XE,getOwnPropertyNames:JC}=Object;var VC=Object.prototype.hasO | CODE |
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 16 | var iC=Object.create;var{getPrototypeOf:tC,defineProperty:XE,getOwnPropertyNames:JC}=Object;var VC=Object.prototype.hasO | CODE |
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 42 | $RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a | CODE |
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 42 | $RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a | CODE |
| MEDIUM | bench/site/bench/bundler.sh | 2 | # rolldown/benchmarks harness on apps/10000 (10k React components / ~19k modules): vite, rsbuild, rspack, rollup, rolldo | COMMENT |
| MEDIUM | bench/site/bench/bundler.sh | 3 | # The harness runs `bun build` via `bun` on PATH, so a shim dir pointing at $BUN goes first on PATH. | COMMENT |
| MEDIUM | test/js/web/structured-clone-blob-file.test.ts | 379 | // payload; keeps the test robust against wire-format header changes. | COMMENT |
| MEDIUM | test/js/web/structured-clone-blob-file.test.ts | 728 | // test stays robust against outer serializer framing changes. | COMMENT |
| MEDIUM | …js/bun/http/serve-response-stream-sink-leak-fixture.ts | 71 | // is robust to both ends; a min would pass on one dip even while the sink leaks. | COMMENT |
| MEDIUM | test/js/bun/gc/gc-controller-cadence.test.ts | 138 | // Observed ~128 before the fix. A generous ceiling keeps this robust | COMMENT |
| MEDIUM | …/node/test/parallel/test-timers-unrefed-in-callback.js | 14 | // robust is that: | COMMENT |
| MEDIUM | …st/js/node/test/parallel/test-http2-session-timeout.js | 50 | // connection as the timeout should be robust. Double it anyway for good | COMMENT |
| MEDIUM | test/cli/install/registry/verdaccio.yaml | 3 | # please read carefully the documentation and best practices to | COMMENT |
| MEDIUM | test/cli/install/registry/verdaccio.yaml | 9 | # Read about the best practices | COMMENT |
| MEDIUM | test/regression/issue/29585.test.ts | 16 | // pattern) keeps the check robust against any future naming scheme. | COMMENT |
| MEDIUM | packages/h3blast/src/h3blast.c | 790 | // Rewind and erase the previous frame in one shot — robust to wrapped lines. | COMMENT |
| MEDIUM | .github/workflows/source-lints.yml | 84 | # paths, or `harness` (resolved via test/tsconfig.json `paths`), so a | COMMENT |
| MEDIUM | src/js/internal/repl/completion.js | 602 | // upstream-todo(dario-piotrowicz): make this more robust, right now we only split by spaces | COMMENT |
| MEDIUM | src/js/node/http2.ts | 2655 | // seamless compatibility with http1. When the session is being torn down with an error | COMMENT |
| MEDIUM | src/bun_core/env_var.rs | 13 | //! but environment variables are not meant to be a robust configuration mechanism. If you do think | COMMENT |
| MEDIUM | src/bun_core/env_var.rs | 516 | /// Note that deserialization errors cannot panic. If you need more robust means of | COMMENT |
| MEDIUM | src/react_compiler/Cargo.toml | 10 | # Fixture-harness support: test-only `// @pragma` parsing, the pragma-gated | COMMENT |
| MEDIUM | …c/react_compiler/optimization/dead_code_elimination.rs | 436 | // Definitely safe to prune since they are read-only | COMMENT |
| MEDIUM | src/runtime/shell/interpreter.rs | 7 | //! performance reasons and also to leverage Bun's existing IO/FS code | COMMENT |
| MEDIUM | src/runtime/allocators/LinuxMemFdAllocator.rs | 2 | //! leverage copy-on-write memory to avoid actually copying the data. To do that | COMMENT |
| MEDIUM | src/runtime/bake/FrameworkRouter.rs | 1230 | /// Fast enough for development to be seamless, but avoids building a | COMMENT |
| MEDIUM | src/runtime/bake/dev_server/source_map_store.rs | 360 | /// utilize the bottom 32 bits of their keys. This is because the bottom | COMMENT |
| MEDIUM | src/runtime/bake/bun-framework-react/server.tsx | 195 | // The RSC payload is provided so client-side can use this file for seamless | COMMENT |
| MEDIUM | src/runtime/socket/WindowsNamedPipe.rs | 6 | //! and Windows Named Pipe operations, enabling seamless cross-platform | COMMENT |
| MEDIUM | src/ast/expr.rs | 2513 | break 'brk left; // Definitely not null or undefined | CODE |
| MEDIUM | src/ast/expr.rs | 2517 | break 'brk PrimitiveType::Mixed; // Definitely some kind of primitive | CODE |
| MEDIUM | src/crash_handler/lib.rs | 1977 | // https://github.com/go-delve/delve/pull/1384 | COMMENT |
| MEDIUM | src/jsc/bindings/js_classes.ts | 3 | // tests if a value is an instanceof a native class in a robust cross-realm manner | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/hawk/README.md | 22 | git checkout -- src/runtime/Cargo.toml && rm -f src/runtime/hawk_root.rs # revert the scaffolding | CODE |
| MEDIUM | scripts/orderfile/app/servers.js | 2 | // The child is this same executable (`<app> netserver`, see scaffold.js). It is | COMMENT |
| MEDIUM | scripts/orderfile/app/scaffold.js | 3 | // bun scaffold.js <outdir> | COMMENT |
| MEDIUM⚡ | src/runtime/api.rs | 152 | // ─── shared scaffold for Bun.{TOML,JSONC,JSON5,YAML}.parse ─────────────────── | COMMENT |
| MEDIUM⚡ | src/runtime/api.rs | 157 | // (c) parse-error class + Expr→JS tail — so this helper owns ONLY the scaffold | COMMENT |
| MEDIUM | src/runtime/test_runner/expect.rs | 1701 | /// the matcher-scaffold family alongside [`Self::run_unary_predicate`] and | COMMENT |
| MEDIUM⚡ | src/runtime/test_runner/expect.rs | 1972 | // ─── unary-predicate matcher scaffold ──────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/runtime/test_runner/expect.rs | 1977 | /// Shared scaffold for zero-arg `expect(v).toBeX()` matchers whose pass/fail | COMMENT |
| MEDIUM | src/runtime/test_runner/expect.rs | 2005 | /// Shared scaffold for one-arg `expect(v).toStartWith/toEndWith/toInclude(expected)` | COMMENT |
| MEDIUM⚡ | src/runtime/timer/mod.rs | 34 | // Shared scaffold for `TimeoutObject` / `ImmediateObject`: both are a | COMMENT |
| MEDIUM | src/runtime/api/XMLObject.rs | 68 | // The scaffold hands the string's code units over as bytes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 992 | except: | CODE |
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 925 | except: | CODE |
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 616 | except: | CODE |
| HIGH | test/js/node/readline/run-with-pty.py | 33 | except: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/js/web/fetch/fixture.html | 1115 | bun implements Node.js' module resolution algorithm, so you can use npm packages in Bun. ESM and | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 1579 | '[fruit]\napple.color = "red"\napple.taste.sweet = true\n\n# [fruit.apple] # INVALID\n# [fruit.apple.taste] # IN | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 1696 | '# This makes the key "fruit" into a table.\nfruit.apple.smooth = true\n\n# So then you can add to the table "frui | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 6546 | '[fruit]\napple.color = "red"\napple.taste.sweet = true\n\n[fruit.apple] # INVALID\n# [fruit.apple.taste] # INVA | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 6559 | '[fruit]\napple.color = "red"\napple.taste.sweet = true\n\n# [fruit.apple] # INVALID\n[fruit.apple.taste] # INVA | CODE |
| LOW | test/js/bun/css/files/tachyons.css | 692 | 2. Don't forget to clearfix your floats with .cf | CODE |
| LOW | packages/bun-usockets/src/internal/internal.h | 111 | #define POLL_TYPE_BITSIZE 5 // make sure to update epoll_kqueue.h if you change this | COMMENT |
| LOW | packages/bun-usockets/src/internal/loop_data.h | 35 | // IMPORTANT: When changing this, don't forget to update the Rust mirror in src/uws_sys/InternalLoopData.rs as well! | COMMENT |
| LOW | src/sql_jsc/postgres/PostgresSQLConnection.rs | 2357 | // explicit use switch without else so if new modes are added, we don't forget to check for duplicate fi | COMMENT |
| LOW | src/jsc/bindings/sqlite/JSSQLStatement.cpp | 2461 | // Don't forget to reset before releasing the exception. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 87 | # Extract the content and convert to JS array.toString() format | COMMENT |
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 104 | # JavaScript Object.toString() returns "[object Object]" | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/shell/bunshell.test.ts | 2035 | # Check if we got a non-empty, non-null version string | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 83 | # Check if this is a stringified collection from yaml package | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 168 | # Check if this is a simple object | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 837 | # Check if it's in an array context | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 841 | # Check if it's in mapping values (not keys) | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 465 | # Check if this is an error test (has 'error' file) | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 699 | # Check if YAML has anchors/aliases | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 914 | # Check if yaml package is installed (for getting expected values) | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 939 | # Check if this is a test directory (has in.yaml) | STRING |
| LOW | scripts/lldb-inline.sh | 11 | # Check if we need to rebuild | COMMENT |
| LOW | packages/bun-types/test.d.ts | 76 | * ## Set Date to a specific time | COMMENT |
| LOW | misctools/lldb/bun_pretty_printer.py | 75 | # Check if it's a pointer type and dereference if needed | COMMENT |
| LOW | misctools/lldb/bun_pretty_printer.py | 85 | # Check if it's 8-bit (latin1) or 16-bit (utf16) string | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/node/url/url-null-char.test.js | 6 | // TODO: Fix error properties | COMMENT |
| LOW | test/bake/dev/esm.test.ts | 261 | const esmImport = await import('./esm'); // TODO: implement sync ESM | CODE |
| LOW | src/js/thirdparty/ws.js | 1302 | // TODO: implement this more proper | COMMENT |
| LOW | src/runtime/cli/run_command.rs | 391 | let ipc_fd: Option<bun_sys::Fd> = None; // TODO: implement on Windows | CODE |
| LOW | src/runtime/bake/DevServer.rs | 1950 | // TODO: implement a proper solution here | COMMENT |
| LOW | src/runtime/bake/dev_server/mod.rs | 1392 | // TODO: implement that. for now it ignores (BUN-10968) | COMMENT |
| LOW | src/runtime/webcore/Blob.rs | 4787 | // TODO: implement a writev() fast path | COMMENT |
| LOW | src/ast/fold_string_addition.rs | 58 | // TODO: implement foldAdditionPreProcess to fold some more things :) | COMMENT |
| LOW | src/js_parser/parse/mod.rs | 1964 | // TODO: implement saveExprCommentsHere and use using_loc here | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 12 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 59 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 124 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 197 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 437 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 899 | CODE | |
| LOW | misctools/lldb/lldb_webkit.py | 1179 | CODE | |
| LOW | misctools/lldb/bun_pretty_printer.py | 70 | CODE | |
| LOW | misctools/lldb/bun_pretty_printer.py | 167 | CODE | |
| LOW | misctools/lldb/bun_pretty_printer.py | 247 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/js/node/test/sequential/test-init.js | 52 | // test-init-index is in fixtures dir as requested by ry, so go there | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/zlib/lib.rs | 106 | /// In this implementation, inflate() always flushes as much output as possible to the output buffer, and always use | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/third_party/remix/remix-build/server/index.js | 8 | function handleRequest(request, responseStatusCode, responseHeaders, remixContext, loadContext) { | CODE |
| LOW | …st/js/node/test/parallel/test-http2-ip-address-host.js | 34 | function handleRequest(url) { | CODE |
| LOW | …rallel/test-async-hooks-stack-overflow-nested-async.js | 31 | function processData(data, depth = 0) { | CODE |
| LOW | test/bake/dev/hot.test.ts | 70 | export function doSomething() { | CODE |
| LOW | test/bake/dev/server-sourcemap.test.ts | 125 | "lib/utils.ts": `export function doSomething() { | CODE |
| LOW | test/regression/issue/25648.test.ts | 15 | export function doSomething(fn: () => number) { | CODE |
| LOW | test/bundler/bundler_edgecase.test.ts | 3390 | export function getData() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 929 | print("Error: yaml package is not installed. Please run: npm install yaml") | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 431 | except Exception as e: | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 1025 | except Exception as e: | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 1072 | except Exception as e: | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 1117 | except Exception as e: | STRING |
| LOW | misctools/lldb/bun_pretty_printer.py | 302 | except Exception as e: | CODE |
| MEDIUM | misctools/lldb/bun_pretty_printer.py | 43 | def bun_BabyList_SummaryProvider(value, _=None): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync-react-compiler.sh | 14 | # Usage: | COMMENT |
| LOW | scripts/update-sqlite-amalgamation.sh | 8 | # Usage: | COMMENT |
| LOW | misctools/unicode-generator.ts | 119 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 384 | # Create a temporary JavaScript file to parse the YAML | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 6 | CODE | |
| LOW | test/js/node/readline/run-with-pty.py | 5 | CODE | |
| LOW | misctools/lldb/bun_pretty_printer.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | misctools/lldb/lldb_webkit.py | 648 | CODE |