cli: declare Node's value-taking flags so their value is not parsed as the entrypoint - #34100
Open
robobun wants to merge 3 commits into
Open
cli: declare Node's value-taking flags so their value is not parsed as the entrypoint#34100robobun wants to merge 3 commits into
robobun wants to merge 3 commits into
Claude / Claude Code Review
completed
Jul 14, 2026 in 24m 26s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/runtime/cli/Arguments.rs:320-324 |
Missing value-taking Node flag: --security-revert |
Annotations
Check warning on line 324 in src/runtime/cli/Arguments.rs
claude / Claude Code Review
Missing value-taking Node flag: --security-revert
A few more value-taking Node options are still missing from this list. The concrete one is `--security-revert <CVE>` (and its `--security-reverts` alias) — it binds to `std::vector<std::string> PerProcessOptions::security_reverts` in `node_options.cc` and requires an argument, so `bun --security-revert CVE-2023-1234 app.mjs` still parses `CVE-2023-1234` as the entrypoint. Depending on the target Node version, `--experimental-default-config-file` (an `AddAlias` to `--experimental-config-file`, wh
Loading