Hardening: input validation and bounds tightening across 36 subsystems (round 4) - #31339
Merged
Claude / Claude Code Review
completed
May 25, 2026 in 28m 55s
Code review found 2 important issues
Found 5 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 2 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | test/bundler/transpiler/transpiler.test.js:4560-4564 |
Undiagnosed Windows CI failure: new transpiler.transform() detach test fails with code 1 on all Windows lanes |
| 🔴 Important | test/cli/install/bun-install-registry.test.ts:8801-8810 |
Unaddressed CI core dump: bun-install-registry.test.ts on Linux 3.23 x64 |
Annotations
Check failure on line 4564 in test/bundler/transpiler/transpiler.test.js
claude / Claude Code Review
Undiagnosed Windows CI failure: new transpiler.transform() detach test fails with code 1 on all Windows lanes
This new test still fails with exit code 1 on all three Windows lanes (🪟 2019 x64, 🪟 2019 x64-baseline, 🪟 11 aarch64) in the latest CI build (#57892, commit 82e916df), and the only later commit (05f502a1) touches the install/`O_NOFOLLOW` path, not `JSTranspiler.rs` or this test. Per the resolved thread on this line, the stderr assertion added in d34dbd29 was a diagnostic step and "does not fix the Windows failure itself" — so this remains an undiagnosed, deterministic failure of a test added by
Check failure on line 8810 in test/cli/install/bun-install-registry.test.ts
claude / Claude Code Review
Unaddressed CI core dump: bun-install-registry.test.ts on Linux 3.23 x64
Build #57892 (commit 82e916df) shows `test/cli/install/bun-install-registry.test.ts` core-dumping on the 🐧 3.23 x64 lane, and unlike the other three failures in that build (Windows `.bun-tag` → fixed in 05f502a1; transpiler.test.js → acknowledged as undiagnosed in d34dbd29), this one has no fix or acknowledgment in the timeline. This PR modifies several install code paths every test in this file exercises (NetworkTask.rs URL validation, lockfile.rs `has_trusted_dependency` → `PackageManager::get
Loading