Remove 125 `unsafe` blocks from IPC, N-API, `bun:ffi`, `node:zlib`, c-ares, BoringSSL, `node:quic` and the parser by dylan-conway · Pull Request #47944 · oven-sh/bun

ipc: `CHANNEL` holds `&'static IPCInstance`, boxed once the transport is up

claude

committed

4bd2b13

napi: `Bun__napi_check_gc` and `NapiHandleScope__escape` are `safe fn`

claude

committed

28923d3

napi: entry points take the env and scope handles as `Option<&T>` or `&T`

claude

committed

1503c34

napi: `Finalizer::run` and `schedule` borrow their env, and three more borrows

claude

committed

d918e45

tcc: `Config::options` is `Option<&'a ZStr>`

claude

committed

982ae73

ffi: no reference is made from an address only to turn it back into one

claude

committed

0a13a91

ipc: the JSON decoder's free callback takes `&Cell<bool>`

claude

committed

8cee289

sql: the `ssl_config_from_js` and `timer_heap` hooks are safe `fn`s

claude

committed

bf3018a

webview: both `spawn` functions take `&VirtualMachine`

claude

committed

b6fb57f

crash_handler: `uv_posix` calls `unsupported_uv_function` as a Rust function

claude

committed

d81ab15

node:zlib: the write's completion owns its ref as a `RefPtr<T>`

claude

committed

a48f408

node:zlib: `borrow_input_copy` borrows the copy through `JsCell::get`

claude

committed

dc300d9

node:zlib: `NativeBrotli` passes `&raw mut self.next_in` and keeps `last_result` as a `c_int`

claude

committed

f40f02f

c-ares: `AresReply` names its parser as an associated const

claude

committed

8a935b7

c-ares: `get_sockaddr` and `get_name_info` take `sockaddr_storage`

claude

committed

4e4673a

boringssl: `BunX509checkHost` types its certificate and its out-parameter

claude

committed

f649629

boringssl_sys: `X509_get_subject_name` is a `safe fn`, and a stack free without fn-pointer transmutes

claude

committed

0cbbb05

boringssl_sys: the digest getters return `&'static EVP_MD`, and `EVP_DigestInit` is a `safe fn`

claude

committed

4770bc0

net: `BlockList__onStructuredCloneDestroy` takes the `RefPtr<BlockList>` it releases

claude

committed

aa44082

node:quic: `on_new_conn` uses the `Conn` it already has

claude

committed

01a3b56

node:quic: the loop-driver callbacks take `&QuicEndpoint`; `lookup_cert` stays typed

claude

committed

9ecda05

node:quic: `QuicEndpoint::constructor` reads its options before it creates the cell

claude

committed

015ec95

node:quic: `QuicSession::create` and `QuicStream::create` return the reference they make

claude

committed

eef690f

node:quic: a session holds `Option<Conn>` and a stream holds `Option<Stream>`

claude

committed

2be3bbc

ast: `Binding::to_expr` takes `&mut C` and the method that wraps an identifier

claude

committed

8fd4e9e

js_parser: `P::init` returns the `&mut P` it wrote, and `init_p!` binds it

claude

committed

e258f24

js_printer: the three `write_reserved` callers use `print_slice`

claude

committed

88dd5f9

image, aot, mimalloc: imports that only write their out-parameters are `safe fn`

claude

committed

4df6cd0

js_parser_jsc: `MacroContext::call` borrows `self.macros` and `self.bump`

claude

committed

c6c2464

ast, sql_jsc: remove three `unsafe impl Send`/`Sync` that nothing needs

claude

committed

bae27cb

css: two needless `unsafe` in values/ident.rs

claude

committed

e11e3df

valkey, image, sql_jsc, ast: `&Self` guards, `&Blob`, `&Symbol`, a `const` array

claude

committed

efda97b

aot, md: three byte views go through `bun_core::slice_as_bytes`

claude

committed

2b92535

ast: `Rope<'a>` links its segments with `Option<&'a mut Rope<'a>>`

claude

committed

0dd260c

c-ares: `ResolveHandler` names its callback as an associated const

claude

committed

37adb5b

Navigation Menu

Repository navigation

Remove 125 `unsafe` blocks from IPC, N-API, `bun:ffi`, `node:zlib`, c-ares, BoringSSL, `node:quic` and the parser - #47944

Remove 125 `unsafe` blocks from IPC, N-API, `bun:ffi`, `node:zlib`, c-ares, BoringSSL, `node:quic` and the parser#47944
dylan-conway merged 35 commits into
mainfrom
claude/remove-unsafe-batch-12

Commits on Nov 4, 2026

ipc: `CHANNEL` holds `&'static IPCInstance`, boxed once the transport is up

napi: `Bun__napi_check_gc` and `NapiHandleScope__escape` are `safe fn`

napi: entry points take the env and scope handles as `Option<&T>` or `&T`

napi: `Finalizer::run` and `schedule` borrow their env, and three more borrows

tcc: `Config::options` is `Option<&'a ZStr>`

ffi: no reference is made from an address only to turn it back into one

ipc: the JSON decoder's free callback takes `&Cell<bool>`

sql: the `ssl_config_from_js` and `timer_heap` hooks are safe `fn`s

webview: both `spawn` functions take `&VirtualMachine`

crash_handler: `uv_posix` calls `unsupported_uv_function` as a Rust function

node:zlib: the write's completion owns its ref as a `RefPtr<T>`

node:zlib: `borrow_input_copy` borrows the copy through `JsCell::get`

node:zlib: `NativeBrotli` passes `&raw mut self.next_in` and keeps `last_result` as a `c_int`

c-ares: `AresReply` names its parser as an associated const

c-ares: `get_sockaddr` and `get_name_info` take `sockaddr_storage`

boringssl: `BunX509checkHost` types its certificate and its out-parameter

boringssl_sys: `X509_get_subject_name` is a `safe fn`, and a stack free without fn-pointer transmutes

boringssl_sys: the digest getters return `&'static EVP_MD`, and `EVP_DigestInit` is a `safe fn`

net: `BlockList__onStructuredCloneDestroy` takes the `RefPtr<BlockList>` it releases

node:quic: `on_new_conn` uses the `Conn` it already has

node:quic: the loop-driver callbacks take `&QuicEndpoint`; `lookup_cert` stays typed

node:quic: `QuicEndpoint::constructor` reads its options before it creates the cell

node:quic: `QuicSession::create` and `QuicStream::create` return the reference they make

node:quic: a session holds `Option<Conn>` and a stream holds `Option<Stream>`

ast: `Binding::to_expr` takes `&mut C` and the method that wraps an identifier

js_parser: `P::init` returns the `&mut P` it wrote, and `init_p!` binds it

js_printer: the three `write_reserved` callers use `print_slice`

image, aot, mimalloc: imports that only write their out-parameters are `safe fn`

js_parser_jsc: `MacroContext::call` borrows `self.macros` and `self.bump`

ast, sql_jsc: remove three `unsafe impl Send`/`Sync` that nothing needs

css: two needless `unsafe` in values/ident.rs

valkey, image, sql_jsc, ast: `&Self` guards, `&Blob`, `&Symbol`, a `const` array

aot, md: three byte views go through `bun_core::slice_as_bytes`

ast: `Rope<'a>` links its segments with `Option<&'a mut Rope<'a>>`

c-ares: `ResolveHandler` names its callback as an associated const