fix(bundler): default NODE_ENV to production for --compile builds

When using `bun build --compile`, default `process.env.NODE_ENV` to
`"production"` to enable dead code elimination for conditional requires
like React's:

```javascript
if (process.env.NODE_ENV === 'production') {
  module.exports = require('./cjs/react.production.js');
} else {
  module.exports = require('./cjs/react.development.js');
}
```

Without this fix, the bundler cannot evaluate the condition as a constant
and tries to resolve both branches, causing failures when development
files don't exist (e.g., in Next.js standalone output).

This also sets `jsx.development = false` for --compile builds, matching
the behavior of --production.

Users can still override this with:
- CLI: `--define 'process.env.NODE_ENV="development"'`
- API: `define: { 'process.env.NODE_ENV': '"development"' }`

Fixes #26244

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitignore

@@ -1,4 +1,5 @@
 .claude/settings.local.json
+.direnv
 .DS_Store
 .env
 .envrc

cmake/targets/BuildBoringSSL.cmake

@@ -4,7 +4,7 @@ register_repository(
   REPOSITORY
     oven-sh/boringssl
   COMMIT
-    f1ffd9e83d4f5c28a9c70d73f9a4e6fcf310062f
+    4f4f5ef8ebc6e23cbf393428f0ab1b526773f7ac
 )
 
 register_cmake_command(

flake.nix

@@ -131,6 +131,7 @@
           stdenv = pkgs.clangStdenv;
         }) {
           inherit packages;
+          hardeningDisable = [ "fortify" ];
 
           shellHook = ''
             # Set up build environment

src/bun.js/bindings/ncrypto.cpp

@@ -1901,7 +1901,7 @@ DataPointer DHPointer::stateless(const EVPKeyPointer& ourKey,
 // ============================================================================
 // KDF
 
-const EVP_MD* getDigestByName(const WTF::StringView name, bool ignoreSHA512_224)
+const EVP_MD* getDigestByName(const WTF::StringView name)
 {
     // Historically, "dss1" and "DSS1" were DSA aliases for SHA-1
     // exposed through the public API.
@@ -1955,9 +1955,6 @@ const EVP_MD* getDigestByName(const WTF::StringView name, bool ignoreSHA512_224)
                     return EVP_sha512();
                 }
                 if (WTF::equalIgnoringASCIICase(moreBits, "/224"_s)) {
-                    if (ignoreSHA512_224) {
-                        return nullptr;
-                    }
                     return EVP_sha512_224();
                 }
                 if (WTF::equalIgnoringASCIICase(moreBits, "/256"_s)) {
@@ -1979,10 +1976,6 @@ const EVP_MD* getDigestByName(const WTF::StringView name, bool ignoreSHA512_224)
         }
     }
 
-    if (ignoreSHA512_224 && WTF::equalIgnoringASCIICase(name, "sha512-224"_s)) {
-        return nullptr;
-    }
-
     // if (name == "ripemd160WithRSA"_s || name == "RSA-RIPEMD160"_s) {
     //     return EVP_ripemd160();
     // }

src/bun.js/bindings/ncrypto.h

@@ -1575,7 +1575,7 @@ Buffer<char> ExportChallenge(const char* input, size_t length);
 // ============================================================================
 // KDF
 
-const EVP_MD* getDigestByName(const WTF::StringView name, bool ignoreSHA512_224 = false);
+const EVP_MD* getDigestByName(const WTF::StringView name);
 const EVP_CIPHER* getCipherByName(const WTF::StringView name);
 
 // Verify that the specified HKDF output length is valid for the given digest.

src/bun.js/bindings/node/crypto/JSHash.cpp

@@ -251,15 +251,7 @@ JSC_DEFINE_HOST_FUNCTION(jsHashProtoFuncDigest, (JSC::JSGlobalObject * lexicalGl
 
     // Only compute the digest if it hasn't been cached yet
     if (!hash->m_digest && len > 0) {
-
-        const EVP_MD* md = hash->m_ctx.getDigest();
-        uint32_t bufLen = len;
-        if (md == EVP_sha512_224()) {
-            // SHA-512/224 expects buffer length of length % 8. can be truncated afterwards
-            bufLen = SHA512_224_DIGEST_BUFFER_LENGTH;
-        }
-
-        auto data = hash->m_ctx.digestFinal(bufLen);
+        auto data = hash->m_ctx.digestFinal(len);
         if (!data) {
             throwCryptoError(lexicalGlobalObject, scope, ERR_get_error(), "Failed to finalize digest"_s);
             return {};
@@ -325,7 +317,7 @@ JSC_DEFINE_HOST_FUNCTION(constructHash, (JSC::JSGlobalObject * globalObject, JSC
         WTF::String algorithm = algorithmOrHashInstanceValue.toWTFString(globalObject);
         RETURN_IF_EXCEPTION(scope, {});
 
-        md = ncrypto::getDigestByName(algorithm, true);
+        md = ncrypto::getDigestByName(algorithm);
         if (!md) {
             zigHasher = ExternZigHash::getByName(zigGlobalObject, algorithm);
         }

src/bun.js/bindings/wrapAnsi.cpp

@@ -518,25 +518,32 @@ static void processLine(const Char* lineStart, const Char* lineEnd, size_t colum
             return;
     }
 
-    // Calculate word lengths
+    // Calculate word lengths using WTF::find for space detection
     Vector<size_t> wordLengths;
-    const Char* wordStart = lineStart;
-    for (const Char* it = lineStart; it <= lineEnd; ++it) {
-        if (it == lineEnd || *it == ' ') {
-            if (wordStart < it) {
-                wordLengths.append(stringWidth(wordStart, it, options.ambiguousIsNarrow));
-            } else {
-                wordLengths.append(0);
-            }
-            wordStart = it + 1;
+    auto lineSpan = std::span<const Char>(lineStart, lineEnd);
+    size_t wordStartIdx = 0;
+    while (wordStartIdx <= lineSpan.size()) {
+        size_t spacePos = WTF::find(lineSpan, static_cast<Char>(' '), wordStartIdx);
+        size_t wordEndIdx = (spacePos == WTF::notFound) ? lineSpan.size() : spacePos;
+
+        if (wordStartIdx < wordEndIdx) {
+            wordLengths.append(stringWidth(lineSpan.data() + wordStartIdx,
+                lineSpan.data() + wordEndIdx,
+                options.ambiguousIsNarrow));
+        } else {
+            wordLengths.append(0);
         }
+
+        if (spacePos == WTF::notFound)
+            break;
+        wordStartIdx = wordEndIdx + 1;
     }
 
     // Start with empty first row
     rows.append(Row<Char>());
 
     // Process each word
-    wordStart = lineStart;
+    const Char* wordStart = lineStart;
     size_t wordIndex = 0;
 
     for (const Char* it = lineStart; it <= lineEnd; ++it) {
@@ -625,17 +632,24 @@ static WTF::String wrapAnsiImpl(std::span<const Char> input, size_t columns, con
         return result.toString();
     }
 
-    // Normalize \r\n to \n
+    // Normalize \r\n to \n using WTF::findNextNewline
     Vector<Char> normalized;
     normalized.reserveCapacity(input.size());
 
-    for (size_t i = 0; i < input.size(); ++i) {
-        if (i + 1 < input.size() && input[i] == '\r' && input[i + 1] == '\n') {
-            normalized.append(static_cast<Char>('\n'));
-            i++; // Skip next char
-        } else {
-            normalized.append(input[i]);
+    size_t pos = 0;
+    while (pos < input.size()) {
+        auto newline = WTF::findNextNewline(input, pos);
+        if (newline.position == WTF::notFound) {
+            // Append remaining content
+            normalized.append(std::span { input.data() + pos, input.size() - pos });
+            break;
         }
+        // Append content before newline
+        if (newline.position > pos)
+            normalized.append(std::span { input.data() + pos, newline.position - pos });
+        // Always append \n regardless of original (\r, \n, or \r\n)
+        normalized.append(static_cast<Char>('\n'));
+        pos = newline.position + newline.length;
     }
 
     // Process each line separately

src/bundler/bundle_v2.zig

@@ -1988,6 +1988,10 @@ pub const BundleV2 = struct {
             if (transpiler.options.compile) {
                 // Emitting DCE annotations is nonsensical in --compile.
                 transpiler.options.emit_dce_annotations = false;
+                // Default to production mode for --compile builds to enable dead code elimination
+                // for conditional requires like React's process.env.NODE_ENV checks.
+                // Users can override this with define: { 'process.env.NODE_ENV': '"development"' }
+                try transpiler.env.map.put("NODE_ENV", "production");
             }
 
             transpiler.configureLinker();
@@ -1996,6 +2000,12 @@ pub const BundleV2 = struct {
             if (!transpiler.options.production) {
                 try transpiler.options.conditions.appendSlice(&.{"development"});
             }
+
+            // Allow tsconfig.json overriding, but always set it to false for --compile builds.
+            if (transpiler.options.compile) {
+                transpiler.options.jsx.development = false;
+            }
+
             transpiler.resolver.env_loader = transpiler.env;
             transpiler.resolver.opts = transpiler.options;
         }

src/cli/build_command.zig

@@ -196,7 +196,10 @@ pub const BuildCommand = struct {
         this_transpiler.options.env.behavior = ctx.bundler_options.env_behavior;
         this_transpiler.options.env.prefix = ctx.bundler_options.env_prefix;
 
-        if (ctx.bundler_options.production) {
+        // Default to production mode for --compile builds to enable dead code elimination
+        // for conditional requires like React's process.env.NODE_ENV checks.
+        // Users can override this with --define 'process.env.NODE_ENV="development"'
+        if (ctx.bundler_options.production or ctx.bundler_options.compile) {
             try this_transpiler.env.map.put("NODE_ENV", "production");
         }
 
@@ -210,8 +213,8 @@ pub const BuildCommand = struct {
         this_transpiler.resolver.opts = this_transpiler.options;
         this_transpiler.resolver.env_loader = this_transpiler.env;
 
-        // Allow tsconfig.json overriding, but always set it to false if --production is passed.
-        if (ctx.bundler_options.production) {
+        // Allow tsconfig.json overriding, but always set it to false if --production or --compile is passed.
+        if (ctx.bundler_options.production or ctx.bundler_options.compile) {
             this_transpiler.options.jsx.development = false;
             this_transpiler.resolver.opts.jsx.development = false;
         }

test/regression/issue/26244.test.ts

@@ -0,0 +1,164 @@
+import { describe, expect, test } from "bun:test";
+import { bunEnv, bunExe, isWindows, tempDir } from "harness";
+import { join } from "path";
+
+// https://github.com/oven-sh/bun/issues/26244
+// bun build --compile should default NODE_ENV to production for dead code elimination
+describe("Issue #26244", () => {
+  test("--compile defaults NODE_ENV to production (CLI)", async () => {
+    using dir = tempDir("compile-node-env-cli", {
+      // This simulates React's conditional require pattern
+      "index.js": `
+if (process.env.NODE_ENV === 'production') {
+  module.exports = require('./prod.js');
+} else {
+  module.exports = require('./dev.js');
+}
+`,
+      "prod.js": `module.exports = { mode: "production" };`,
+      // Note: dev.js intentionally not created to simulate Next.js standalone output
+      // where development files are stripped
+    });
+
+    const outfile = join(dir + "", isWindows ? "app.exe" : "app");
+
+    // This should succeed because NODE_ENV defaults to production,
+    // enabling dead code elimination of the dev.js branch
+    const buildProc = Bun.spawn({
+      cmd: [bunExe(), "build", "--compile", join(dir + "", "index.js"), "--outfile", outfile],
+      cwd: dir + "",
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const [buildStdout, buildStderr, buildExitCode] = await Promise.all([
+      new Response(buildProc.stdout).text(),
+      new Response(buildProc.stderr).text(),
+      buildProc.exited,
+    ]);
+
+    // Build should succeed - the dead branch with dev.js should be eliminated
+    expect(buildStderr).not.toContain("Could not resolve");
+    expect(buildExitCode).toBe(0);
+  });
+
+  test("--compile defaults NODE_ENV to production (API)", async () => {
+    using dir = tempDir("compile-node-env-api", {
+      // This simulates React's conditional require pattern
+      "index.js": `
+if (process.env.NODE_ENV === 'production') {
+  module.exports = require('./prod.js');
+} else {
+  module.exports = require('./dev.js');
+}
+`,
+      "prod.js": `module.exports = { mode: "production" };`,
+      // Note: dev.js intentionally not created to simulate Next.js standalone output
+      // where development files are stripped
+    });
+
+    const outfile = join(dir + "", isWindows ? "app.exe" : "app");
+
+    // This should succeed because NODE_ENV defaults to production,
+    // enabling dead code elimination of the dev.js branch
+    const result = await Bun.build({
+      entrypoints: [join(dir + "", "index.js")],
+      compile: {
+        outfile,
+      },
+    });
+
+    // Build should succeed - the dead branch with dev.js should be eliminated
+    expect(result.success).toBe(true);
+    expect(result.outputs.length).toBe(1);
+  });
+
+  test("--compile with conditional require eliminates dead branch (CLI)", async () => {
+    using dir = tempDir("compile-dead-code-cli", {
+      "entry.js": `
+// This is the pattern used by React
+if (process.env.NODE_ENV === 'production') {
+  console.log("Using production build");
+} else {
+  // This branch references a non-existent file
+  // and should be eliminated by dead code elimination
+  require('./non-existent-dev-file.js');
+}
+`,
+    });
+
+    const outfile = join(dir + "", isWindows ? "app.exe" : "app");
+
+    // Should succeed - the require('./non-existent-dev-file.js') should be
+    // eliminated because NODE_ENV defaults to 'production'
+    const buildProc = Bun.spawn({
+      cmd: [bunExe(), "build", "--compile", join(dir + "", "entry.js"), "--outfile", outfile],
+      cwd: dir + "",
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const [buildStdout, buildStderr, buildExitCode] = await Promise.all([
+      new Response(buildProc.stdout).text(),
+      new Response(buildProc.stderr).text(),
+      buildProc.exited,
+    ]);
+
+    expect(buildStderr).not.toContain("Could not resolve");
+    expect(buildExitCode).toBe(0);
+  });
+
+  test("--compile can override NODE_ENV with --define", async () => {
+    using dir = tempDir("compile-define-override", {
+      "entry.js": `console.log(process.env.NODE_ENV);`,
+    });
+
+    const outfile = join(dir + "", isWindows ? "app.exe" : "app");
+
+    // Use CLI to test --define override
+    const buildProc = Bun.spawn({
+      cmd: [
+        bunExe(),
+        "build",
+        "--compile",
+        join(dir + "", "entry.js"),
+        "--outfile",
+        outfile,
+        "--define",
+        'process.env.NODE_ENV="development"',
+      ],
+      cwd: dir + "",
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const [buildStdout, buildStderr, buildExitCode] = await Promise.all([
+      new Response(buildProc.stdout).text(),
+      new Response(buildProc.stderr).text(),
+      buildProc.exited,
+    ]);
+
+    expect(buildExitCode).toBe(0);
+
+    // Run the compiled binary
+    const runProc = Bun.spawn({
+      cmd: [outfile],
+      cwd: dir + "",
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(runProc.stdout).text(),
+      new Response(runProc.stderr).text(),
+      runProc.exited,
+    ]);
+
+    expect(stdout.trim()).toBe("development");
+    expect(exitCode).toBe(0);
+  });
+});