AWS default credential chain, SigV4-signed fetch, Bun.aws / Bun.gcp - #39210
Open
Jarred-Sumner wants to merge 16 commits into
Open
AWS default credential chain, SigV4-signed fetch, Bun.aws / Bun.gcp#39210Jarred-Sumner wants to merge 16 commits into
Jarred-Sumner wants to merge 16 commits into
Claude / Claude Code Review
completed
Aug 17, 2026 in 27m 31s
Code review found 1 important issue
Found 1 candidates, confirmed 7. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 6 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/js/internal/aws/eventstream.ts:238-250 |
eventstream.ts captures some primordials but not others |
Annotations
Check warning on line 250 in src/js/internal/aws/eventstream.ts
claude / Claude Code Review
eventstream.ts captures some primordials but not others
`eventstream.ts` captures some primordials at module load (`Uint8Array.prototype.subarray`/`.toHex` via `.$call`, `isAnyArrayBuffer`/`isUint8Array` from `node:util/types`) but reads others live on every call — `ArrayBuffer.isView` in `toBytes()` and here in `classify()`, plus `instanceof Response`/`Blob`, `Buffer.concat`, `JSON.parse`, `Object.create`, `Symbol.asyncIterator`. Not a security boundary and several `src/js/internal/` siblings do the same, so this is a nit; the cheapest way to make t
Loading