Remove dead code from install, webcore, jsc, sha_hmac, and misc crates
Dead code sweep over areas not covered by the open dead-code PRs (#37062, #37012, #36237, #36115, #35880, #35775, #35437): install, runtime/node, runtime/webcore, jsc, sql_jsc, and the sha_hmac/wyhash/clap/md/errno/spawn/api/bundler_jsc leaf crates, plus scripts/build. Net -232 source lines, plus a source-lint test (rebased onto current main, which added a name parameter to the same manifest lookups and three more callers; those are updated here too). No overlap with the deletions in any open PR (the only shared file, headers-handwritten.h, is touched on different lines).
Every removal was verified by rg across src/, src/codegen/, src/js/, and build/debug/codegen/ (zero references outside the definition), then by compiling.
Removed
install: CacheBehavior enum and parameter. The LoadFromMemory variant is never constructed anywhere, so every one of the 12 call sites passes LoadFromMemoryFallbackToDisk and the enum carries no information. Removed the enum, the cache_behavior parameter from the four by_name* lookups, the dead memory-only branch in by_name_hash_allow_expired, the ManifestLoad re-exports, and the argument at all call sites (outdated, update-interactive, lockfile, enqueue, populate-manifest-cache, update-transitive, audit-fix). The memory-only path callers actually use is by_name_hash_in_memory, which stays. Also removed the unused pub use patch_install as patch; alias (all consumers use patch_install:: directly).
runtime/node: Bun__versions_uws / Bun__versions_usockets. These no_mangle statics (and their extern "C" declarations in headers-handwritten.h) have no readers: BunProcess.cpp reads BUN_VERSION_USOCKETS/BUN_VERSION_UWS from the generated bun_dependency_versions.h since #22561. Their values were wrong anyway (both held the bun git sha). Since all C++ references resolve at link time, the full bun bd link passing is the proof nothing consumes the symbols.
jsc: error-code sentinels and dangerously_set_ptr. Zig_ErrorCodeParserError is declared in headers-handwritten.h but no C++ reads it; Zig_ErrorCodeJSErrorObject is not even declared. Removed both statics, the declaration, and the PARSER_ERROR const whose only use they were (JS_ERROR_OBJECT stays, it is used widely). Separately, the js_class_module! macro emitted a dangerously_set_ptr wrapper plus its __dangerouslySetPtr extern import in every instantiation, and no instantiation calls it; the similarly named symbols in build codegen belong to generate-classes.ts's own separate Rust surface, which declares its own externs.
webcore: never-constructed variants. StartTag::{Empty, Err, ChunkSize, Ready, OwnedAndDone, Done} are never constructed (only the 8 sink tags are used as START_TAG consts and const-generic args), so the two fallback _ arms they fed were unreachable and are gone too; the remaining matches are exhaustive.
sha_hmac. The deprecated-OpenSSL3 sha::hashers module has exactly two consumers: SHA1 (websocket upgrade) and SHA256 (s3 signing). Removed the unused SHA512, SHA384, SHA512_256, RIPEMD160 hashers. CryptoHasher's hashers::SHA384 etc. resolve through its use bun_sha_hmac::sha as hashers; alias to the evp re-exports, which stay. Also removed evp::MD5_SHA1 and evp::Blake2 (zero references; Algorithm::Blake2b256 calls ffi::EVP_blake2b256() directly).
Smaller items.
- wyhash:
HashIntimpls foru16/u64; the singlehash_intcaller passesu32. - clap:
Error::WriteFailedis never constructed (no fallible-fmt path converts into it); removed the variant, itsFrom<fmt::Error>impl, and the unreachable diagnostic arm. - md:
LineType::Setextheadernever constructed or matched. - react_compiler: private
default_truehelper with zero references. - Unused re-export names (each verified unreferenced under the re-exported path): sql_jsc
SslConfigalias and theCoerceTo/ExternColumnIdentifierValue/ThrowFmtArgs/ZigStringJscfacade tokens; bun_apiNodeLinker/NpmRegistryMap/PnpmMatcher; bundler_jscFsPath/ErrorableString/JsError; errnoModealias (all three platform files); spawnBunSpawn/PosixSpawnaliases; runtime/ffiabi_typesurface (formatters narrowed topub(crate), matching the workspaceunreachable_pubconvention) and runtime/valkey_jsc surface trims. - scripts/build: the
"src/*.c"glob (its last match,src/asan-config.c, was deleted in #29655; the pattern silently matches nothing), the write-only#define BUN_DEP_*block in the generated versions header (BunProcess.cpp reads only theBUN_VERSION_*constants), and theConfig.kqueuefield (computed, stored, never read).
Verification
cargo check -p bun_bincleanbun bdfull build and link passes (link success is the decisive check for the removedno_manglestatics)bun run rust:check-all: 12 ok, 0 failed (no platform-gated false positives)bunx tsc -p scripts/build/tsconfig.json: same 18 pre-existing errors with and without this diff, none in touched files- Smoke tests in touched areas: bun-cryptohasher (400 pass), arraybuffersink (13), markdown-entrypoint (30), minimum-release-age (49, exercises the manifest-cache paths), update-interactive-formatting (5)
Verified dead but deliberately left in place
These have zero references today but carry explicit staging markers or ABI roles, so they are notes rather than deletions: the h2 Connection outbound-send API (module-level allow(dead_code), unit-tested), react_compiler's logger/diagnostic parity types (allow with upstream-parity reasons), bun_opaque::FfiLayout (documented sealed marker), bake's State::EvaluationFailure/BakeProdSourceMap (receiving ends of not-yet-wired dev-server and SSG paths; removing them strands live plumbing), BOM::Utf16Be/Utf32* (detection intentionally not ported yet), PercentEncodeError::OutOfMemory (staged for fallible-alloc), dev-server MessageId wire ids, and the RegularExpression::Flags / SSRKind::Regular ABI mirrors.
[review] gate passed · iteration 1 · 38 files touched
fails on main (without fix)
ASAN without fix: 3 FAILED
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-install-webcore-sha.test.ts
bun test v1.4.0 (f9fc3ccc6)
test/internal/source-lints/dead-symbols-install-webcore-sha.test.ts:
70 | ["src/md/types.rs", /Setextheader/],
71 |
72 | // react_compiler: zero references.
73 | ["src/react_compiler/hir/environment_config.rs", /fn default_true\b/],
74 | ];
75 | expect(resurrected(checks)).toEqual([]);
^
error: expect(received).toEqual(expected)
- []
+ [
+ "src/install/PackageManifestMap.rs: pub enum CacheBehavior\b",
+ "src/runtime/node/node_process.rs: static Bun__versions_uws:",
+ "src/runtime/node/node_process.rs: static Bun__versions_usockets:",
+ "src/jsc/ErrorCode.rs: static Zig_ErrorCodeParserError:",
+ "src/jsc/ErrorCode.rs: static Zig_ErrorCodeJSErrorObject:",
+ "src/jsc/ErrorCode.rs: const PARSER_ERROR: ErrorCodeInt",
+ "src/jsc/generated.rs: __dangerouslySetPtr",
+ "src/runtime/webcore/streams.rs: pub enum StartTag \{[^}]*OwnedAndDone",
+ "src/runtime/webcore/FileReader.rs: A
... (truncated)
release without fix: 3 FAILED
bun test v1.4.0-canary.1 (962d3f7ff)
test/internal/source-lints/dead-symbols-install-webcore-sha.test.ts:
70 | ["src/md/types.rs", /Setextheader/],
71 |
72 | // react_compiler: zero references.
73 | ["src/react_compiler/hir/environment_config.rs", /fn default_true\b/],
74 | ];
75 | expect(resurrected(checks)).toEqual([]);
^
error: expect(received).toEqual(expected)
- []
+ [
+ "src/install/PackageManifestMap.rs: pub enum CacheBehavior\b",
+ "src/runtime/node/node_process.rs: static Bun__versions_uws:",
+ "src/runtime/node/node_process.rs: static Bun__versions_usockets:",
+ "src/jsc/ErrorCode.rs: static Zig_ErrorCodeParserError:",
+ "src/jsc/ErrorCode.rs: static Zig_ErrorCodeJSErrorObject:",
+ "src/jsc/ErrorCode.rs: const PARSER_ERROR: ErrorCodeInt",
+ "src/jsc/generated.rs: __dangerouslySetPtr",
+ "src/runtime/webcore/streams.rs: pub enum StartTag \{[^}]*OwnedAndDone",
+ "src/runtime/webcore/FileReader.rs: AmountRead\(usize\)",
+ "src/sha_hmac/sha.rs: SHA512_Init,\s*\n\s*boringssl_sys::SHA512_Update",
+ "src/sha_hmac/sha.rs: RIPEMD160_Init",
+ "src/sha_hmac/sha.rs: new_evp!\(MD5_SHA1",
+
... (truncated)
passes on PR (with fix)
ASAN with fix: all passed
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" test/internal/source-lints/dead-symbols-install-webcore-sha.test.ts
bun test v1.4.0 (f9fc3ccc6)
test/internal/source-lints/dead-symbols-install-webcore-sha.test.ts:
(pass) dead Rust symbols (install, webcore, jsc, leaf crates) do not reappear [66.00ms]
(pass) dead C++ header declarations do not reappear [9.82ms]
(pass) unused re-export names do not reappear [39.29ms]
(pass) stale build-script entries do not reappear [10.69ms]
4 pass
0 fail
4 expect() calls
Ran 4 tests across 1 file. [3.38s]
__F:0:S:0
release with fix: all passed
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 928ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/130] esbuild bun-error
../../build/release/codegen/bun-error/index.js 42.9kb
../../build/release/codegen/bun-error/bun-error.css 12.8kb
⚡ Done in 17ms
[2/130] gen ErrorCode+*.h
[3/130] gen NodeModuleModule.lut.h
Generating /workspace/bun/build/release/codegen/NodeModuleModule.lut.h from /workspace/bun/src/jsc/modules/NodeModuleModule.cpp
[4/130] gen generated_host_exports.rs
generated_host_exports.rs: 92 exports (host=3, lazy=10, generic=79, rust=0); 239 extern-C blocks audited
[5/130] gen cpp.rs (cppbind)
[6/130] gen BunProcess.lut.h
Generating /workspace/bun/build/release/codegen/BunProcess.lut.h from /workspace/bun/src/jsc/bindings/BunProcess.cpp
[7/130] gen JS modules (bundle-modules)
Preprocess modules (15999ms)
Bundle modules (42ms)
Postprocesss modules (43ms)
Bundle Functions (926ms)
Generate Code (28ms)
[17.06s] Bundled "src/js" for production
2570 kb
193 internal modules
13 native modules
84 internal functions across 17 files
[7/129] cargo bun_bin → libbun_rust.a (--ta
... (truncated)
diff hotspot
scripts/build/config.ts | 4 -
scripts/build/depVersionsHeader.ts | 3 -
scripts/build/source.ts | 2 +-
scripts/glob-sources.ts | 1 -
src/api/lib.rs | 4 +-
src/bundler_jsc/PluginRunner.rs | 2 -
src/bundler_jsc/lib.rs | 2 +-
src/clap/error.rs | 9 --
src/clap/lib.rs | 5 -
src/errno/darwin_errno.rs | 1 -
src/errno/freebsd_errno.rs | 1 -
src/errno/linux_errno.rs | 1 -
.../PackageManager/PackageManagerEnqueue.rs | 4 +-
.../PackageManager/PopulateManifestCache.rs | 3 -
src/install/PackageManifestMap.rs | 45 +-------
src/install/lib.rs | 7 +-
src/install/lockfile.rs | 1 -
src/jsc/ErrorCode.rs | 12 +-
src/jsc/bindings/headers-handwritten.h | 7 --
src/jsc/generated.rs | 22 +---
src/md/types.rs | 1 -
src/react_compiler/hir/environment_config.rs | 4 -
src/runtime/api/bun/spawn.rs | 2 +-
src/runtime/cli/outdated_command.rs | 4 +-
src/runtime/cli/update_interactive_command.rs | 5 +-
src/runtime/ffi/abi_type.rs | 6 +-
src/runtime/ffi/mod.rs | 1 -
src/runtime/node/node_process.rs | 14 ---
src/runtime/valkey_jsc/mod.rs | 3 +-
src/runtime/webcore/FileReader.rs | 17 +--
src/runtime/webcore/Response.rs | 8 +-
src/runtime/webcore/streams.rs | 13 ---
src/sha_hmac/lib.rs
... (truncated)
gate history · 2 passed · 1 rejected · iteration 1
evidence per changed file
file reads edits tests
scripts/build/config.ts 1 1 0
scripts/build/depVersionsHeader.ts 1 1 0
scripts/build/source.ts 1 1 0
scripts/glob-sources.ts 1 1 0
src/api/lib.rs 1 1 0
src/bundler_jsc/PluginRunner.rs 1 1 0
src/bundler_jsc/lib.rs 1 1 0
src/clap/error.rs 1 1 0
src/clap/lib.rs 1 1 0
src/errno/darwin_errno.rs 0 0 0
src/errno/freebsd_errno.rs 0 0 0
src/errno/linux_errno.rs 0 0 0
src/install/PackageManager/PackageManagerEnqueue.rs 0 0 0
src/install/PackageManager/PopulateManifestCache.rs 0 0 0
src/install/PackageManifestMap.rs 3 4 0
src/install/lib.rs 1 1 0
(+ 22 more files)