Remove unused Cargo boilerplate deps from 70 crates + misc dead C++/Rust

[robobun]

What changed

-851 / +95 across 79 files (net -756 after rebase onto 301696e). Two independent cleanups:

1. Unused Cargo [dependencies] boilerplate (~400 dep edges across 69 crates)

The Zig-to-Rust port scaffolding stamped the same 8-dep block into nearly every crate manifest:

strum.workspace = true
bstr.workspace = true
scopeguard.workspace = true
const_format.workspace = true
enum-map.workspace = true
enumset.workspace = true
libc.workspace = true
bitflags.workspace = true

Most crates use few or none of these. For each dep in each crate, verified zero references (crate name, underscore-converted name, and derive/attr macro patterns like formatcp!, EnumSetType, bitflags!, #[error() across all .rs files, then removed. bun run rust:check-all passes on all 10 target triples afterwards, so nothing was cfg-gated. Cargo.lock drops 393 lines of dead edges as a result.

Skipped src/{collections,css,glob,io,paths,router}/Cargo.toml which are touched by open PRs.

2. Dead C++/Rust symbols

Removed	Why dead
BakeSourceProvider.cpp: BakeRegisterProductionChunk	No Rust extern, no C++ caller, not declared in any header.
BakeProduction.h	Declared an empty namespace Bake {}, only included by its own .cpp.
subprocess/Readable.rs: on_close, on_ready; Writable.rs: on_ready + BlobSizeType import	Never wired into any SignalHandler; the live Writable::on_close is the trait impl at :559 which has its own body.
io/posix_event_loop.rs: Waker/Closer/KEventWaker re-exports	All callers use bun_io::{Waker,Closer} via lib.rs.
bake/DevServer.rs: ig_log! macro + declare_scope!(IncrementalGraph)	Declared via define_scoped_log!, never invoked (debug_log!/map_log! are); the static has no linker-section side effect.
webcore/blob/write_file.rs: commented-out setFileOffset block	Carried-over Zig syntax, dead since 2023.

(After rebase, main had independently removed the helpers.h dead statics and FSWatcher::event_loop() that were in the original diff; those hunks auto-merged to no-ops.)

Verification

• bun bd builds clean (debug + ASAN)
• bun run rust:check-all: 10/10 targets pass (linux/darwin/windows/freebsd/android × x64/aarch64, plus musl)
• bun bd test test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts: 11/11 pass (all fail on main)
• bun bd test test/internal/source-lints/dead-code-escapes.test.ts: passes
• bun bd test test/js/node/watch/fs.watch.test.ts: 42/42 pass

Not done (follow-up candidates)

• src/runtime/api/bun/h2/connection.rs has a ~200-line outbound API (begin_header_block/encode_header/send_data/send_push_promise) with no non-test callers, but it's scaffolding for the in-progress node:http2 rewrite (node:http2: rewritten inbound engine, batched write path, server push, +290 node v26.3.0 tests (79% passing) #31584), so left alone.
• OutputFile::Value::{Move,Pending} are never constructed but have match arms across two files; removing them is a refactor rather than a pure deletion.

---

[review] gate passed · iteration 7 · 79 files touched

fails on main (without fix)

ASAN without fix: 11 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts
bun test v1.4.0 (702e6016f)

test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts:
69 | 
70 |   for (const [rel, deps] of Object.entries(crates)) {
71 |     test(rel, () => {
72 |       const toml = readFileSync(join(repoRoot, rel), "utf8");
73 |       const present = deps.filter(d => new RegExp(`^${d}(\\.workspace\\s*=|\\s*=)`, "m").test(toml));
74 |       expect(present).toEqual([]);
                           ^
error: expect(received).toEqual(expected)

- []
+ [
+   "strum",
+   "scopeguard",
+   "const_format",
+   "enum-map",
+   "enumset",
+   "libc",
+   "bitflags",
+ ]

- Expected  - 1
+ Received  + 9

      at <anonymous> (/workspace/bun/test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts:74:23)
(fail) unused boilerplate Cargo deps stay removed > src/wyhash/Cargo.toml [14.80ms]
69 | 
70 |   for (const [rel, deps] of Object.entries(crates)) {
71 |     test(rel, () => {
72 |       const toml = readFileSync(join(repoRoot, rel), "utf8");
7
... (truncated)

release without fix: 11 FAILED
bun test v1.4.0-canary.1 (dd84fabaa)

test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts:
69 | 
70 |   for (const [rel, deps] of Object.entries(crates)) {
71 |     test(rel, () => {
72 |       const toml = readFileSync(join(repoRoot, rel), "utf8");
73 |       const present = deps.filter(d => new RegExp(`^${d}(\\.workspace\\s*=|\\s*=)`, "m").test(toml));
74 |       expect(present).toEqual([]);
                           ^
error: expect(received).toEqual(expected)

- []
+ [
+   "strum",
+   "scopeguard",
+   "const_format",
+   "enum-map",
+   "enumset",
+   "libc",
+   "bitflags",
+ ]

- Expected  - 1
+ Received  + 9

      at <anonymous> (/workspace/bun/test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts:74:23)
(fail) unused boilerplate Cargo deps stay removed > src/wyhash/Cargo.toml [0.37ms]
69 | 
70 |   for (const [rel, deps] of Object.entries(crates)) {
71 |     test(rel, () => {
72 |       const toml = readFileSync(join(repoRoot, rel), "utf8");
73 |       const present = deps.filter(d => new RegExp(`^${d}(\\.workspace\\s*=|\\s*=)`, "m").test(toml));
74 |       expect(present).toEqual([]);
                           ^
error: expect(re
... (truncated)

passes on PR (with fix)

ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts
bun test v1.4.0 (702e6016f)

test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts:
(pass) unused boilerplate Cargo deps stay removed > src/wyhash/Cargo.toml [12.11ms]
(pass) unused boilerplate Cargo deps stay removed > src/ptr/Cargo.toml [2.95ms]
(pass) unused boilerplate Cargo deps stay removed > src/base64/Cargo.toml [5.85ms]
(pass) unused boilerplate Cargo deps stay removed > src/brotli_sys/Cargo.toml [2.27ms]
(pass) unused boilerplate Cargo deps stay removed > src/mimalloc_sys/Cargo.toml [1.49ms]
(pass) unused boilerplate Cargo deps stay removed > src/simdutf_sys/Cargo.toml [1.82ms]
(pass) unused boilerplate Cargo deps stay removed > src/sha_hmac/Cargo.toml [1.30ms]
(pass) dead symbols stay removed > src/runtime/bake/BakeSourceProvider.cpp has no "BakeRegisterProductionChunk" [2.30ms]
(pass) dead symbols stay removed > src/runtime/bake/BakeProduction.cpp has no "#include \"BakeProduction.h\"" [0.78ms]
(pass) dead symbols stay removed > src/runtime/api/bu
... (truncated)

release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 703ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/139] gen cpp.rs (cppbind)
[2/139] gen generated_host_exports.rs
generated_host_exports.rs: 94 exports (host=3, lazy=10, generic=81, rust=0); 239 extern-C blocks audited
[3/139] gen JS modules (bundle-modules)
Preprocess modules (8850ms)
Bundle modules (43ms)
Postprocesss modules (222ms)
Bundle Functions (774ms)
Generate Code (36ms)

[9.94s] Bundled "src/js" for production
  2561 kb
  193 internal modules
  13 native modules
  90 internal functions across 19 files
[3/139] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19)

�[1m�[92m   Compiling�[0m bun_core v0.0.0 (/workspace/bun/src/bun_core)
�[1m�[92m   Compiling�[0m bun_errno v0.0.0 (/workspace/bun/src/errno)
�[1m�[92m   Compiling�[0m bun_ptr v0.0.0 (/workspace/bun/src/ptr)
�[1m�[92m   Compiling�[0m bun_boringssl_sys v0.0.0 (/workspace/bun/src/boringssl_sys)
�[1m�[92m   Compiling�[0m bun_safety v0.0.0 (/workspace/bun/src/safety)
�[1m
... (truncated)

diff hotspot

Cargo.lock                                         | 393 ---------------------
 src/ast/Cargo.toml                                 |   2 -
 src/ast_jsc/Cargo.toml                             |   8 -
 src/base64/Cargo.toml                              |   7 -
 src/boringssl/Cargo.toml                           |   7 -
 src/boringssl_sys/Cargo.toml                       |   8 -
 src/brotli_sys/Cargo.toml                          |   9 -
 src/bun_alloc/Cargo.toml                           |   6 -
 src/bundler/Cargo.toml                             |   2 -
 src/bundler_jsc/Cargo.toml                         |   6 -
 src/bunfig/Cargo.toml                              |   5 -
 src/cares_sys/Cargo.toml                           |   7 -
 src/clap/Cargo.toml                                |   6 -
 src/crash_handler/Cargo.toml                       |   3 -
 src/csrf/Cargo.toml                                |   7 -
 src/css_jsc/Cargo.toml                             |   7 -
 src/dns/Cargo.toml                                 |   6 -
 src/dotenv/Cargo.toml                              |   7 -
 src/errno/Cargo.toml                               |   7 -
 src/event_loop/Cargo.toml                          |   7 -
 src/exe_format/Cargo.toml                          |   6 -
 src/highway/Cargo.toml                             |   7 -
 src/http/Cargo.toml                                |   5 -
 src/http_jsc/Cargo.toml                            |   6 -
 src/http_types/Cargo.toml                          |   5 -
 src/ini/Cargo.toml                                 |   7 -
 src/install/Cargo.toml                             |   2 -
 src/install_jsc/Cargo.toml                         |   6 -
 src/install_types/Cargo.toml                       |   5 -
 src/io/posix_event_loop.rs                         |  15 -
 src/js_parser/Cargo.toml                           |   3 -
 src/js_parser_jsc/Cargo.toml                       |   6 -
 src/js_printer/Cargo.toml                   
... (truncated)

gate history · 4 passed · 1 rejected · iteration 7

evidence per changed file

file                          reads  edits  tests
Cargo.lock                        0      0      0
src/ast/Cargo.toml                0      0      0
src/ast_jsc/Cargo.toml            0      0      0
src/base64/Cargo.toml             0      0      0
src/boringssl/Cargo.toml          0      0      0
src/boringssl_sys/Cargo.toml      0      0      0
src/brotli_sys/Cargo.toml         0      0      0
src/bun_alloc/Cargo.toml          0      0      0
src/bundler/Cargo.toml            0      0      0
src/bundler_jsc/Cargo.toml        0      0      0
src/bunfig/Cargo.toml             0      0      0
src/cares_sys/Cargo.toml          0      0      0
src/clap/Cargo.toml               0      0      0
src/crash_handler/Cargo.toml      0      0      0
src/csrf/Cargo.toml               0      0      0
src/css_jsc/Cargo.toml            0      0      0
(+ 63 more files)

[coderabbitai]

Walkthrough

Changes

Dependency and dead-symbol cleanup

Layer / File(s)	Summary
Workspace dependency pruning src/*/Cargo.toml	Workspace manifests remove unused boilerplate dependencies and add or retain crate-specific Bun dependencies.
Runtime and binding cleanup src/io/posix_event_loop.rs, src/runtime/api/bun/subprocess/*, src/runtime/bake/*, src/runtime/webcore/blob/write_file.rs	Obsolete callbacks, re-exports, bake symbols, logging declarations, and offset comments were removed or adjusted.
Cleanup validation test/internal/source-lints/dead-symbols-cargo-boilerplate.test.ts, src/io/posix_event_loop.rs	Tests verify removed dependencies and symbols stay absent and validate EV_ERROR errno decoding.

Possibly related PRs

• oven-sh/bun#36123: Removes unused scopeguard declarations across manifests.
• oven-sh/bun#36390: Covers related dead-code cleanup and source-lint checks.
• oven-sh/bun#35437: Covers unused Cargo dependencies and dead-symbol regression tests.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the removal of unused Cargo dependencies and miscellaneous dead C++/Rust code.
Description check	✅ Passed	The description explains the changes, scope, exclusions, dead symbols, and verification results in sufficient detail.

---

_{Comment @coderabbitai help to get the list of available commands.}

[robobun]

^{Updated 4:42 AM PT - Aug 2nd, 2026}

✅ @robobun, your commit 702e6016ff3679629849a89b66a0806b21e74f63 passed in Build #87742! 🎉

---

🧪   To try this PR locally:

bunx bun-pr 35880

That installs a local version of the PR into your bun-35880 executable, so you can run:

bun-35880 --bun

[claude]

LGTM — pure dead-code removal, compiler-verified.

What was reviewed:

• Cargo dep removals across 70 crates: rust:check-all on 10 targets is the proof; Cargo.lock regen matches.
• Grepped for callers of the deleted C++ symbols (BakeRegisterProductionChunk, toStringNotConst, BunStringCwd/ZigStringCwd, Zig::toAtomString(ZigString), Zig::toStringView(ZigString)) and the removed posix_event_loop::{Waker,Closer,KEventWaker} re-exports — none found; bun_io::{Waker,Closer} resolve via lib.rs.
• Confirmed Writable.rs still keeps its BlobSizeType import for the live SignalHandler::on_ready trait impl (distinct from the deleted inherent method).
• Prior nit (orphaned declare_scope!(IncrementalGraph)) addressed in 0417481.

Extended reasoning...

Overview

Two-part cleanup: (1) removes ~408 unused [dependencies] entries stamped by the Zig→Rust port scaffolding across 70 crate manifests plus the corresponding Cargo.lock edges; (2) deletes a handful of dead C++/Rust symbols — six unreferenced Zig:: helpers in helpers.h, the never-called extern "C" BakeRegisterProductionChunk, an empty BakeProduction.h, three never-wired on_close/on_ready inherent methods on subprocess::{Readable,Writable}, an unused FSWatcher::event_loop() accessor, dead re-exports in posix_event_loop.rs, an unused ig_log! scoped-log pair in DevServer.rs, and a commented-out Zig block in blob/write_file.rs. A source-lint test pins a subset so the boilerplate doesn't creep back.

Security risks

None. No control-flow, validation, or data handling is touched — every change is a deletion of code with zero call sites, or a manifest entry the compiler proves unused.

Level of scrutiny

Low-to-moderate. The Cargo.toml changes are self-verifying: an actually-used dep would fail cargo check on at least one of the 10 targets in rust:check-all, and the PR evidence shows both debug+ASAN and release builds succeeding. The C++ deletions warranted a manual grep because static inline helpers in a widely-included header and extern "C" symbols escape lints — I confirmed zero references for each. The removed posix_event_loop re-exports were the one item that could silently break downstream path-qualified imports; grep shows all consumers already go through bun_io::{Waker,Closer} in lib.rs.

Other factors

My earlier review flagged that deleting define_scoped_log!(ig_log, ...) orphaned its paired declare_scope!(IncrementalGraph); that was addressed in 0417481 and the thread is resolved. Subsequent commits (0d71d09, e61e32a) cleaned up an accidentally-restored BakeProduction.h and adjusted the lint test accordingly. The deleted Readable::on_close/on_ready and Writable::on_ready are inherent methods, distinct from the live SignalHandler trait impls that remain (Writable.rs:559-560); the BlobSizeType import in Writable.rs is correctly retained for the trait impl while the now-unused import in Readable.rs is removed. Wide but mechanical — nothing here needs a human's judgment call.

[robobun]

CI status on #82164: diff is green; remaining reds are unrelated to this change.

• binary-size (+~530 KB on all 12 targets): soft-failed via [skip size check]. The check compares against canary main #79916, but that's the last passing main build; main is currently at #81770 (44f6469, this PR's base) and has been red since. The growth is from main commits in that window. This PR only removes code (Cargo.lock diff is 410 lines of pure removal; no dependency version changes).
• darwin 14 aarch64 test-bun: step failed outside runner - exit 255, marked pre-existing (same on main). Agent-level failure, not a test.
• 5 flaky tests (complex-workspace, bun-install-registry, test-quic-callback-error-onstream, in-process-cron, test-http-server-connections-checking-leak): all categorized as also-failing-on-main by the CI scraper. None touch files in this diff (install, quic, cron, node http).

bun bd + bun run rust:check-all (10/10 targets) + the new source-lint test all pass locally.

[Jarred-Sumner]

@robobun conflicts. rebase

[robobun]

Rebased onto 301696e. Conflicts were:

• Cargo.lock: regenerated (-393 lines)
• src/io/posix_event_loop.rs: kept main's #[cfg(all(test, not(windows)))] on the test module, kept this PR's removal of the dead Waker/Closer re-exports
• src/safety/Cargo.toml: main already cleaned it; resolved to identical

main had also independently removed the helpers.h dead statics and FSWatcher::event_loop(), so those hunks auto-merged to no-ops. Dropped the now-unused BlobSizeType import in Writable.rs (main removed the trait impl that consumed it).

Net after rebase: -851/+109 across 79 files. bun bd + bun run rust:check-all (10/10) pass.

[robobun]

CI on #87730 after rebase: diff is green; the single non-flaky red is unrelated.

• test/js/node/worker_threads/worker-transfer-terminate-stress.test.ts (1 shard of debian 13 x64-asan, 19/20 shards passed): JSC ExceptionScope::assertNoException() SIGABRT during worker-termination stress. This diff touches nothing in worker_threads, JSC exception handling, or any C++ on that path (only bake C++ and Cargo manifests). Reported to main-break triage.
• 8 other tests (deinitialization, filter-workspace, fastutf8stream-reopen, sourcetextmodule-leak, node-module-module, request-clone-leak, filesink, 07827): all categorized flaky/also-on-main.

binary-size no longer flagged (baseline caught up after main went green).

[claude]

LGTM — pure dead-code removal, compiler-verified across all 10 targets; both earlier nits (orphaned declare_scope!, vacuous post-rebase test entries) have been addressed.

What was reviewed:

• Cargo.toml deletions: correctness enforced by rust:check-all (10/10 targets); Cargo.lock is regenerated, no version changes.
• Re-verified zero callers for BakeRegisterProductionChunk, posix_event_loop::{Waker,Closer,KEventWaker}, and the removed Readable/Writable methods; bun_io::{Waker,Closer} remain exported from io/lib.rs independently.
• BakeProduction.h deletion: its two includes are inlined into the .cpp; no other includers.

Extended reasoning...

Overview

79 files: 70 Cargo.toml manifests dropping ~408 unused .workspace = true dependency lines (the Zig→Rust port scaffolding stamped the same 8-dep block everywhere), a regenerated Cargo.lock (-393 lines, pure edge removal), and eight small dead-symbol deletions in Rust/C++ (BakeRegisterProductionChunk, empty BakeProduction.h, unused Readable::on_close/on_ready/Writable::on_ready, duplicate Waker/Closer re-exports in posix_event_loop.rs, the ig_log!/IncrementalGraph scoped-log pair, and a commented-out Zig block in write_file.rs). A new source-lint test pins seven representative Cargo.toml cleanups and four removed symbols.

Security risks

None. No dependency versions change (only workspace dep-edge removals). No auth, crypto, parsing, or user-input handling touched. Removed extern "C" symbol has no callers so no ABI surface actually changes.

Level of scrutiny

Low. The bulk of the change is compiler-verified: an unused-dep removal that broke anything (including cfg-gated code) would fail bun run rust:check-all, which passes on all 10 target triples per the PR description and CI. For the dead-symbol removals I re-grepped the tree for each removed name and confirmed zero callers; bun_io::{Waker,Closer} are still exported from io/lib.rs:666-667 independent of the removed posix_event_loop re-exports, and the surviving IncrementalGraph references in DevServer.rs all resolve to the struct type, not the removed ScopedLogger static.

Other factors

This is my third pass on the PR. Both earlier findings were nit-severity and have been fixed (0417481 removed the orphaned declare_scope!; 702e601 dropped the four vacuous post-rebase test entries that duplicated dead-symbols-llhttp-helpers-install.test.ts). CI on #87730/#87742 is green modulo pre-existing flakes unrelated to this diff. Jarred requested a rebase, which was done; no outstanding human review comments. The PR follows REVIEW.md's "delete dead code in the same PR that makes it dead" and names what was intentionally excluded (open-PR-touched crates, in-progress h2 scaffolding).