review

.clang-tidy

@@ -3,7 +3,21 @@ FormatStyle: webkit
 Checks: >
   -*,
   clang-analyzer-*,
-  -clang-analyzer-optin.core.EnumCastOutOfRange
-  -clang-analyzer-webkit.UncountedLambdaCapturesChecker
-  -clang-analyzer-optin.core.EnumCastOutOfRange
-  -clang-analyzer-webkit.RefCntblBaseVirtualDtor
+  -clang-analyzer-optin.core.EnumCastOutOfRange,
+  -clang-analyzer-webkit.UncountedLambdaCapturesChecker,
+  -clang-analyzer-webkit.RefCntblBaseVirtualDtor,
+  -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,
+  -clang-analyzer-deadcode.DeadStores,
+  bugprone-*,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-narrowing-conversions,
+  -bugprone-switch-missing-default-case,
+  -bugprone-assignment-in-if-condition,
+  -bugprone-implicit-widening-of-multiplication-result,
+  performance-*,
+  -performance-no-int-to-ptr,
+  cppcoreguidelines-*,
+  -cppcoreguidelines-avoid-magic-numbers,
+  -cppcoreguidelines-narrowing-conversions,
+  -cppcoreguidelines-macro-to-enum,
+  -cppcoreguidelines-avoid-non-const-global-variables,

.github/workflows/comment-lint.yml

@@ -1,15 +1,15 @@
-name: C++ Linter comment
+name: clang-tidy:check
 
 permissions:
   actions: read
   pull-requests: write
 
 on:
-  workflow_run:
-    workflows:
-      - lint-cpp
-    types:
-      - completed
+  # pull_request:
+  workflow_dispatch:
+
+env:
+  LLVM_VERSION_MAJOR: "19"
 
 jobs:
   comment-lint:
@@ -17,50 +17,39 @@ jobs:
     name: Comment
     runs-on: ubuntu-latest
     steps:
-      - name: Download Comment
-        uses: actions/download-artifact@v4
-        with:
-          name: format.log
-          github-token: ${{ github.token }}
-          run-id: ${{ github.event.workflow_run.id }}
-      - name: PR Number
-        uses: actions/download-artifact@v4
-        with:
-          name: pr-number.txt
-          github-token: ${{ github.token }}
-          run-id: ${{ github.event.workflow_run.id }}
-      - name: Did Fail
-        uses: actions/download-artifact@v4
-        with:
-          name: did_fail.txt
-          github-token: ${{ github.token }}
-          run-id: ${{ github.event.workflow_run.id }}
-      - name: Setup Environment
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-bun
+
+      - name: Run clang-tidy
         id: env
         shell: bash
         run: |
+          sudo apt-get remove -qq clang-18
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc > /dev/null
+          echo "deb http://apt.llvm.org/$(lsb_release -cs)/ llvm-toolchain-$(lsb_release -cs)-${{ env.LLVM_VERSION_MAJOR }} main" | sudo tee /etc/apt/sources.list.d/llvm.list > /dev/null
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq --no-install-recommends --no-install-suggests -o=Dpkg::Use-Pty=0 clang-format-${{ env.LLVM_VERSION_MAJOR }}
+
           # Copy to outputs
-          echo "pr-number=$(cat pr-number.txt)" >> $GITHUB_OUTPUT
           {
             echo 'text_output<<EOF'
-            cat format.log
+            bun run clang-tidy:check
             echo EOF
           } >> "$GITHUB_OUTPUT"
-          echo "did_fail=$(cat did_fail.txt)" >> $GITHUB_OUTPUT
 
       - name: Find Comment
         id: comment
         uses: peter-evans/find-comment@v3
         with:
-          issue-number: ${{ steps.env.outputs.pr-number }}
+          issue-number: ${{ github.event.number }}
           comment-author: github-actions[bot]
           body-includes: <!-- generated-comment lint-cpp-workflow=${{ github.workflow }} -->
       - name: Update Comment
         uses: peter-evans/create-or-update-comment@v4
-        if: steps.env.outputs.did_fail != '0'
         with:
           comment-id: ${{ steps.comment.outputs.comment-id }}
-          issue-number: ${{ steps.env.outputs.pr-number }}
+          issue-number: ${{ github.event.number }}
+          edit-mode: replace
           body: |
             @${{ github.actor }}, `clang-tidy` had something to share with you about your code:
 
@@ -71,15 +60,3 @@ jobs:
             Commit: ${{ github.event.workflow_run.head_sha || github.sha }}
 
             <!-- generated-comment lint-cpp-workflow=${{ github.workflow }} -->
-          edit-mode: replace
-      - name: Update Previous Comment
-        uses: peter-evans/create-or-update-comment@v4
-        if: steps.env.outputs.did_fail == '0' && steps.comment.outputs.comment-id != ''
-        with:
-          comment-id: ${{ steps.comment.outputs.comment-id }}
-          issue-number: ${{ steps.env.outputs.pr-number }}
-          body: |
-            clang-tidy nits are fixed! Thank you.
-
-            <!-- generated-comment lint-cpp-workflow=${{ github.workflow }} -->
-          edit-mode: replace

.gitignore

@@ -189,4 +189,4 @@ scratch*.{js,ts,tsx,cjs,mjs}
 scripts/lldb-inline
 
 # We regenerate these in all the build scripts
-cmake/sources/*.txt
+cmake/sources/*.txt

cmake/Options.cmake

@@ -60,10 +60,10 @@ endif()
 # Windows Code Signing Option
 if(WIN32)
   optionx(ENABLE_WINDOWS_CODESIGNING BOOL "Enable Windows code signing with DigiCert KeyLocker" DEFAULT OFF)
-  
+
   if(ENABLE_WINDOWS_CODESIGNING)
     message(STATUS "Windows code signing: ENABLED")
-    
+
     # Check for required environment variables
     if(NOT DEFINED ENV{SM_API_KEY})
       message(WARNING "SM_API_KEY not set - code signing may fail")

cmake/analysis/RunClangTidy.cmake

@@ -1,9 +1,17 @@
 # https://clang.llvm.org/extra/clang-tidy/
 
 set(CLANG_TIDY_SOURCES ${BUN_C_SOURCES} ${BUN_CXX_SOURCES})
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/node/http/llhttp/llhttp.c)
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/node/http/llhttp/http.c)
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/node/http/llhttp/api.c)
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/decodeURIComponentSIMD.cpp)
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/NoOpForTesting.cpp)
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/ProcessBindingNatives.cpp)
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/stripANSI.cpp)
+list(REMOVE_ITEM CLANG_TIDY_SOURCES ${CWD}/src/bun.js/bindings/Uint8Array.cpp)
 
 set(CLANG_TIDY_COMMAND ${CLANG_TIDY_PROGRAM}
-  -p ${BUILD_PATH}  
+  -p ${BUILD_PATH}
   --config-file=${CWD}/.clang-tidy
 )
 

cmake/analysis/RunCppCheck.cmake

@@ -25,7 +25,7 @@ register_command(
     "Running cppcheck"
   COMMAND
     ${CMAKE_COMMAND} -E make_directory cppcheck
-    && ${CPPCHECK_COMMAND} 
+    && ${CPPCHECK_COMMAND}
   CWD
     ${BUILD_PATH}
   TARGETS

cmake/scripts/DownloadUrl.cmake

@@ -38,7 +38,7 @@ foreach(i RANGE 10)
   else()
     message(STATUS "Downloading ${DOWNLOAD_URL}... (retry ${i})")
   endif()
-  
+
   file(DOWNLOAD
     ${DOWNLOAD_URL}
     ${DOWNLOAD_TMP_FILE_${i}}

cmake/scripts/PathUtils.cmake

@@ -10,13 +10,13 @@ function(absolute_sources OUTPUT_VAR INPUT_FILE)
     else()
         set(BASE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
     endif()
-    
+
     # Read the file containing relative paths
     file(STRINGS "${INPUT_FILE}" RELATIVE_PATHS)
-    
+
     # Create a list to store absolute paths
     set(RESULT_LIST "")
-    
+
     # Convert each relative path to absolute
     foreach(REL_PATH ${RELATIVE_PATHS})
         # Skip empty lines
@@ -26,10 +26,10 @@ function(absolute_sources OUTPUT_VAR INPUT_FILE)
             list(APPEND RESULT_LIST ${ABS_PATH})
         endif()
     endforeach()
-    
+
     # Set the output variable in the parent scope
     set(${OUTPUT_VAR} ${RESULT_LIST} PARENT_SCOPE)
-    
+
     # Tell CMake that the configuration depends on this file
     set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${INPUT_FILE}")
-endfunction()
+endfunction()

cmake/targets/BuildBun.cmake

@@ -760,7 +760,7 @@ if (NOT WIN32)
   # Only enable in these scenarios:
   # 1. NOT in CI, OR
   # 2. In CI AND BUN_CPP_ONLY is enabled
-  if(NOT CI OR (CI AND BUN_CPP_ONLY))
+  if((NOT CI OR (CI AND BUN_CPP_ONLY)) AND NOT ENABLE_ANALYSIS)
     target_precompile_headers(${bun} PRIVATE
       "$<$<COMPILE_LANGUAGE:CXX>:${CWD}/src/bun.js/bindings/root.h>"
     )
@@ -1230,32 +1230,32 @@ if(NOT BUN_CPP_ONLY)
       OUTPUTS
         ${BUILD_PATH}/${bunStripExe}
     )
-    
+
     # Then sign both executables on Windows
     if(WIN32 AND ENABLE_WINDOWS_CODESIGNING)
       set(SIGN_SCRIPT "${CMAKE_SOURCE_DIR}/.buildkite/scripts/sign-windows.ps1")
-      
+
       # Verify signing script exists
       if(NOT EXISTS "${SIGN_SCRIPT}")
         message(FATAL_ERROR "Windows signing script not found: ${SIGN_SCRIPT}")
       endif()
-      
+
       # Use PowerShell for Windows code signing (native Windows, no path issues)
-      find_program(POWERSHELL_EXECUTABLE 
+      find_program(POWERSHELL_EXECUTABLE
         NAMES pwsh.exe powershell.exe
-        PATHS 
+        PATHS
           "C:/Program Files/PowerShell/7"
           "C:/Program Files (x86)/PowerShell/7"
           "C:/Windows/System32/WindowsPowerShell/v1.0"
         DOC "Path to PowerShell executable"
       )
-      
+
       if(NOT POWERSHELL_EXECUTABLE)
         set(POWERSHELL_EXECUTABLE "powershell.exe")
       endif()
-      
+
       message(STATUS "Using PowerShell executable: ${POWERSHELL_EXECUTABLE}")
-      
+
       # Sign both bun-profile.exe and bun.exe after stripping
       register_command(
         TARGET

cmake/targets/BuildHdrHistogram.cmake

@@ -21,4 +21,4 @@ register_cmake_command(
     -DHDR_HISTOGRAM_BUILD_STATIC=ON
     -DHDR_LOG_REQUIRED=DISABLED
     -DHDR_HISTOGRAM_BUILD_PROGRAMS=OFF
-)
+)

cmake/targets/BuildHighway.cmake

@@ -30,4 +30,4 @@ register_cmake_command(
   INCLUDES
     .
     hwy
-)
+)

cmake/targets/BuildMimalloc.cmake

@@ -14,7 +14,7 @@ set(MIMALLOC_CMAKE_ARGS
   -DMI_BUILD_TESTS=OFF
   -DMI_USE_CXX=ON
   -DMI_SKIP_COLLECT_ON_EXIT=ON
-  
+
   # ```
   # ❯ mimalloc_allow_large_os_pages=0 BUN_PORT=3004 mem bun http-hello.js
   # Started development server: http://localhost:3004
@@ -51,7 +51,7 @@ if(ENABLE_ASAN)
   list(APPEND MIMALLOC_CMAKE_ARGS -DMI_DEBUG_UBSAN=ON)
 elseif(APPLE OR LINUX)
   if(APPLE)
-    list(APPEND MIMALLOC_CMAKE_ARGS -DMI_OVERRIDE=OFF)  
+    list(APPEND MIMALLOC_CMAKE_ARGS -DMI_OVERRIDE=OFF)
     list(APPEND MIMALLOC_CMAKE_ARGS -DMI_OSX_ZONE=OFF)
     list(APPEND MIMALLOC_CMAKE_ARGS -DMI_OSX_INTERPOSE=OFF)
   else()

cmake/toolchains/darwin-x64.cmake

@@ -3,4 +3,4 @@ set(CMAKE_SYSTEM_PROCESSOR x64)
 set(CMAKE_OSX_ARCHITECTURES x86_64)
 
 set(CMAKE_C_COMPILER_WORKS ON)
-set(CMAKE_CXX_COMPILER_WORKS ON)
+set(CMAKE_CXX_COMPILER_WORKS ON)

cmake/toolchains/linux-aarch64-musl.cmake

@@ -3,4 +3,4 @@ set(CMAKE_SYSTEM_PROCESSOR aarch64)
 set(ABI musl)
 
 set(CMAKE_C_COMPILER_WORKS ON)
-set(CMAKE_CXX_COMPILER_WORKS ON)
+set(CMAKE_CXX_COMPILER_WORKS ON)

cmake/toolchains/linux-aarch64.cmake

@@ -3,4 +3,4 @@ set(CMAKE_SYSTEM_PROCESSOR aarch64)
 set(ABI gnu)
 
 set(CMAKE_C_COMPILER_WORKS ON)
-set(CMAKE_CXX_COMPILER_WORKS ON)
+set(CMAKE_CXX_COMPILER_WORKS ON)

cmake/toolchains/linux-x64-baseline.cmake

@@ -4,4 +4,4 @@ set(ENABLE_BASELINE ON)
 set(ABI gnu)
 
 set(CMAKE_C_COMPILER_WORKS ON)
-set(CMAKE_CXX_COMPILER_WORKS ON)
+set(CMAKE_CXX_COMPILER_WORKS ON)

cmake/toolchains/linux-x64-musl-baseline.cmake

@@ -4,4 +4,4 @@ set(ENABLE_BASELINE ON)
 set(ABI musl)
 
 set(CMAKE_C_COMPILER_WORKS ON)
-set(CMAKE_CXX_COMPILER_WORKS ON)
+set(CMAKE_CXX_COMPILER_WORKS ON)

cmake/toolchains/windows-x64-baseline.cmake

@@ -3,4 +3,4 @@ set(CMAKE_SYSTEM_PROCESSOR x64)
 set(ENABLE_BASELINE ON)
 
 set(CMAKE_C_COMPILER_WORKS ON)
-set(CMAKE_CXX_COMPILER_WORKS ON)
+set(CMAKE_CXX_COMPILER_WORKS ON)

cmake/toolchains/windows-x64.cmake

@@ -2,4 +2,4 @@ set(CMAKE_SYSTEM_NAME Windows)
 set(CMAKE_SYSTEM_PROCESSOR x64)
 
 set(CMAKE_C_COMPILER_WORKS ON)
-set(CMAKE_CXX_COMPILER_WORKS ON)
+set(CMAKE_CXX_COMPILER_WORKS ON)

cmake/tools/GenerateDependencyVersions.cmake

@@ -41,10 +41,10 @@ endfunction()
 function(generate_dependency_versions_header)
   set(DEPS_PATH "${CMAKE_SOURCE_DIR}/src/deps")
   set(VENDOR_PATH "${CMAKE_SOURCE_DIR}/vendor")
-  
+
   # Initialize version variables
   set(DEPENDENCY_VERSIONS "")
-  
+
   # WebKit version (from SetupWebKit.cmake or command line)
   if(WEBKIT_VERSION)
     set(WEBKIT_VERSION_STR "${WEBKIT_VERSION}")
@@ -52,7 +52,7 @@ function(generate_dependency_versions_header)
     set(WEBKIT_VERSION_STR "0ddf6f47af0a9782a354f61e06d7f83d097d9f84")
   endif()
   list(APPEND DEPENDENCY_VERSIONS "WEBKIT" "${WEBKIT_VERSION_STR}")
-  
+
   # Track input files so CMake reconfigures when they change
   set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS
     "${CMAKE_SOURCE_DIR}/package.json"
@@ -60,7 +60,7 @@ function(generate_dependency_versions_header)
     "${VENDOR_PATH}/zlib/zlib.h"
     "${DEPS_PATH}/zstd/lib/zstd.h"
   )
-  
+
   # Hardcoded dependency versions (previously from generated_versions_list.zig)
   # These are the commit hashes/tree objects for each dependency
   list(APPEND DEPENDENCY_VERSIONS "BORINGSSL" "29a2cd359458c9384694b75456026e4b57e3e567")
@@ -74,7 +74,7 @@ function(generate_dependency_versions_header)
   list(APPEND DEPENDENCY_VERSIONS "TINYCC" "ab631362d839333660a265d3084d8ff060b96753")
   list(APPEND DEPENDENCY_VERSIONS "ZLIB_HASH" "886098f3f339617b4243b286f5ed364b9989e245")
   list(APPEND DEPENDENCY_VERSIONS "ZSTD_HASH" "794ea1b0afca0f020f4e57b6732332231fb23c70")
-  
+
   # Extract semantic versions from header files where available
   extract_version_from_header(
     "${VENDOR_PATH}/libdeflate/libdeflate.h"
@@ -82,21 +82,21 @@ function(generate_dependency_versions_header)
     LIBDEFLATE_VERSION_STRING
   )
   list(APPEND DEPENDENCY_VERSIONS "LIBDEFLATE_VERSION" "${LIBDEFLATE_VERSION_STRING}")
-  
+
   extract_version_from_header(
     "${VENDOR_PATH}/zlib/zlib.h"
     "#define[ \t]+ZLIB_VERSION[ \t]+\"([^\"]+)\""
     ZLIB_VERSION_STRING
   )
   list(APPEND DEPENDENCY_VERSIONS "ZLIB_VERSION" "${ZLIB_VERSION_STRING}")
-  
+
   extract_version_from_header(
     "${DEPS_PATH}/zstd/lib/zstd.h"
     "#define[ \t]+ZSTD_VERSION_STRING[ \t]+\"([^\"]+)\""
     ZSTD_VERSION_STRING
   )
   list(APPEND DEPENDENCY_VERSIONS "ZSTD_VERSION" "${ZSTD_VERSION_STRING}")
-  
+
   # Bun version from package.json
   if(EXISTS "${CMAKE_SOURCE_DIR}/package.json")
     file(READ "${CMAKE_SOURCE_DIR}/package.json" PACKAGE_JSON)
@@ -110,11 +110,11 @@ function(generate_dependency_versions_header)
     set(BUN_VERSION_STRING "${VERSION}")
   endif()
   list(APPEND DEPENDENCY_VERSIONS "BUN_VERSION" "${BUN_VERSION_STRING}")
-  
+
   # Node.js compatibility version (hardcoded as in the current implementation)
   set(NODEJS_COMPAT_VERSION "22.12.0")
   list(APPEND DEPENDENCY_VERSIONS "NODEJS_COMPAT_VERSION" "${NODEJS_COMPAT_VERSION}")
-  
+
   # Get Bun's git SHA for uws/usockets versions (they use Bun's own SHA)
   execute_process(
     COMMAND git rev-parse HEAD
@@ -128,11 +128,11 @@ function(generate_dependency_versions_header)
   endif()
   list(APPEND DEPENDENCY_VERSIONS "UWS" "${BUN_GIT_SHA}")
   list(APPEND DEPENDENCY_VERSIONS "USOCKETS" "${BUN_GIT_SHA}")
-  
+
   # Zig version - hardcoded for now, can be updated as needed
   # This should match the version of Zig used to build Bun
   list(APPEND DEPENDENCY_VERSIONS "ZIG" "0.14.1")
-  
+
   # Generate the header file content
   set(HEADER_CONTENT "// This file is auto-generated by CMake. Do not edit manually.\n")
   string(APPEND HEADER_CONTENT "#ifndef BUN_DEPENDENCY_VERSIONS_H\n")
@@ -141,7 +141,7 @@ function(generate_dependency_versions_header)
   string(APPEND HEADER_CONTENT "extern \"C\" {\n")
   string(APPEND HEADER_CONTENT "#endif\n\n")
   string(APPEND HEADER_CONTENT "// Dependency versions\n")
-  
+
   # Process the version list
   list(LENGTH DEPENDENCY_VERSIONS num_versions)
   math(EXPR last_idx "${num_versions} - 1")
@@ -158,10 +158,10 @@ function(generate_dependency_versions_header)
     endif()
     math(EXPR i "${i} + 2")
   endwhile()
-  
+
   string(APPEND HEADER_CONTENT "\n")
   string(APPEND HEADER_CONTENT "// C string constants for easy access\n")
-  
+
   # Create C string constants
   set(i 0)
   while(i LESS num_versions)
@@ -176,18 +176,18 @@ function(generate_dependency_versions_header)
     endif()
     math(EXPR i "${i} + 2")
   endwhile()
-  
+
   string(APPEND HEADER_CONTENT "\n#ifdef __cplusplus\n")
   string(APPEND HEADER_CONTENT "}\n")
   string(APPEND HEADER_CONTENT "#endif\n\n")
   string(APPEND HEADER_CONTENT "#endif // BUN_DEPENDENCY_VERSIONS_H\n")
-  
+
   # Write the header file
   set(OUTPUT_FILE "${CMAKE_BINARY_DIR}/bun_dependency_versions.h")
   file(WRITE "${OUTPUT_FILE}" "${HEADER_CONTENT}")
-  
+
   message(STATUS "Generated dependency versions header: ${OUTPUT_FILE}")
-  
+
   # Also create a more detailed version for debugging
   set(DEBUG_OUTPUT_FILE "${CMAKE_BINARY_DIR}/bun_dependency_versions_debug.txt")
   set(DEBUG_CONTENT "Bun Dependency Versions\n")
@@ -206,4 +206,4 @@ function(generate_dependency_versions_header)
 endfunction()
 
 # Call the function to generate the header
-generate_dependency_versions_header()
+generate_dependency_versions_header()

cmake/tools/SetupBuildkite.cmake

@@ -101,7 +101,7 @@ foreach(i RANGE ${BUILDKITE_JOBS_MAX_INDEX})
     list(APPEND BUILDKITE_JOBS_NOT_FOUND ${BUILDKITE_JOB_NAME})
     continue()
   endif()
-  
+
   file(READ ${BUILDKITE_ARTIFACTS_PATH} BUILDKITE_ARTIFACTS)
   string(JSON BUILDKITE_ARTIFACTS_LENGTH LENGTH ${BUILDKITE_ARTIFACTS})
   if(NOT BUILDKITE_ARTIFACTS_LENGTH GREATER 0)

cmake/tools/SetupLLVM.cmake

@@ -17,6 +17,7 @@ set(DEFAULT_LLVM_VERSION "19.1.7")
 optionx(LLVM_VERSION STRING "The version of LLVM to use" DEFAULT ${DEFAULT_LLVM_VERSION})
 
 string(REGEX MATCH "([0-9]+)\\.([0-9]+)\\.([0-9]+)" USE_LLVM_VERSION ${LLVM_VERSION})
+
 if(USE_LLVM_VERSION)
   set(LLVM_VERSION_MAJOR ${CMAKE_MATCH_1})
   set(LLVM_VERSION_MINOR ${CMAKE_MATCH_2})

cmake/tools/SetupMacSDK.cmake

@@ -53,7 +53,7 @@ endif()
 
 optionx(CMAKE_OSX_SYSROOT STRING "The macOS SDK path to target" DEFAULT ${DEFAULT_CMAKE_OSX_SYSROOT})
 
-list(APPEND CMAKE_ARGS 
+list(APPEND CMAKE_ARGS
   -DCMAKE_OSX_DEPLOYMENT_TARGET=${CMAKE_OSX_DEPLOYMENT_TARGET}
   -DCMAKE_OSX_SYSROOT=${CMAKE_OSX_SYSROOT}
 )

packages/bun-usockets/src/bsd.c

@@ -17,6 +17,7 @@
 
 /* Todo: this file should lie in networking/bsd.c */
 
+// NOLINTNEXTLINE(bugprone-reserved-identifier)
 #define __APPLE_USE_RFC_3542
 
 #include "libusockets.h"
@@ -592,6 +593,7 @@ LIBUS_SOCKET_DESCRIPTOR bsd_create_socket(int domain, int type, int protocol, in
         *err = 0;
     }
 
+    // NOLINTNEXTLINE(cppcoreguidelines-init-variables)
     LIBUS_SOCKET_DESCRIPTOR created_fd;
 #if defined(SOCK_CLOEXEC) && defined(SOCK_NONBLOCK)
     const int flags = SOCK_CLOEXEC | SOCK_NONBLOCK;
@@ -695,6 +697,7 @@ int bsd_addr_get_port(struct bsd_addr_t *addr) {
 
 // called by dispatch_ready_poll
 LIBUS_SOCKET_DESCRIPTOR bsd_accept_socket(LIBUS_SOCKET_DESCRIPTOR fd, struct bsd_addr_t *addr) {
+    // NOLINTNEXTLINE(cppcoreguidelines-init-variables)
     LIBUS_SOCKET_DESCRIPTOR accepted_fd;
 
     while (1) {
@@ -854,7 +857,7 @@ int bsd_would_block() {
 }
 
 static int us_internal_bind_and_listen(LIBUS_SOCKET_DESCRIPTOR listenFd, struct sockaddr *listenAddr, socklen_t listenAddrLength, int backlog, int* error) {
-    int result;
+    int result = 0;
     do
         result = bind(listenFd, listenAddr, listenAddrLength);
     while (IS_EINTR(result));
@@ -972,7 +975,7 @@ inline __attribute__((always_inline)) LIBUS_SOCKET_DESCRIPTOR bsd_bind_listen_fd
 // return LIBUS_SOCKET_ERROR or the fd that represents listen socket
 // listen both on ipv6 and ipv4
 LIBUS_SOCKET_DESCRIPTOR bsd_create_listen_socket(const char *host, int port, int options, int* error) {
-    struct addrinfo hints, *result;
+    struct addrinfo hints, *result = NULL;
     memset(&hints, 0, sizeof(struct addrinfo));
 
     hints.ai_flags = AI_PASSIVE;
@@ -987,7 +990,7 @@ LIBUS_SOCKET_DESCRIPTOR bsd_create_listen_socket(const char *host, int port, int
     }
 
     LIBUS_SOCKET_DESCRIPTOR listenFd = LIBUS_SOCKET_ERROR;
-    struct addrinfo *listenAddr;
+    struct addrinfo* listenAddr = NULL;
     for (struct addrinfo *a = result; a != NULL; a = a->ai_next) {
         if (a->ai_family == AF_INET6) {
             listenFd = bsd_create_socket(a->ai_family, a->ai_socktype, a->ai_protocol, NULL);
@@ -1173,7 +1176,7 @@ LIBUS_SOCKET_DESCRIPTOR bsd_create_udp_socket(const char *host, int port, int op
         *err = 0;
     }
 
-    struct addrinfo hints, *result;
+    struct addrinfo hints, *result = NULL;
     memset(&hints, 0, sizeof(struct addrinfo));
 
     hints.ai_flags = AI_PASSIVE;
@@ -1283,7 +1286,7 @@ LIBUS_SOCKET_DESCRIPTOR bsd_create_udp_socket(const char *host, int port, int op
 }
 
 int bsd_connect_udp_socket(LIBUS_SOCKET_DESCRIPTOR fd, const char *host, int port) {
-    struct addrinfo hints, *result;
+    struct addrinfo hints, *result = NULL;
     memset(&hints, 0, sizeof(struct addrinfo));
 
     hints.ai_family = AF_UNSPEC;
@@ -1393,8 +1396,8 @@ static int bsd_do_connect_raw(LIBUS_SOCKET_DESCRIPTOR fd, struct sockaddr *addr,
 
 
 #else
-    int r;
-     do {
+    int r = 0;
+    do {
         errno = 0;
         r = connect(fd, (struct sockaddr *)addr, namelen);
     } while (IS_EINTR(r));

packages/bun-usockets/src/context.c

@@ -517,7 +517,7 @@ void *us_socket_context_connect(int ssl, struct us_socket_context_t *context, co
         return us_socket_context_connect_resolved_dns(context, &addr, options, socket_ext_size);
     }
 
-    struct addrinfo_request* ai_req;
+    struct addrinfo_request* ai_req = NULL;
     if (Bun__addrinfo_get(loop, host, (uint16_t)port, &ai_req) == 0) {
         // fast path for cached results
         struct addrinfo_result *result = Bun__addrinfo_getRequestResult(ai_req);

packages/bun-usockets/src/crypto/openssl.c

@@ -113,7 +113,7 @@ int passphrase_cb(char *buf, int size, int rwflag, void *u) {
   const char *passphrase = (const char *)u;
   size_t passphrase_length = strlen(passphrase);
   memcpy(buf, passphrase, passphrase_length);
-  // put null at end? no?
+  buf[passphrase_length] = 0;
   return (int)passphrase_length;
 }
 
@@ -807,7 +807,7 @@ create_ssl_context_from_options(struct us_socket_context_options_t options) {
   }
 
   if (options.ca_file_name) {
-    STACK_OF(X509_NAME) * ca_list;
+    STACK_OF(X509_NAME) * ca_list = NULL;
     ca_list = SSL_load_client_CA_file(options.ca_file_name);
     if (ca_list == NULL) {
       free_ssl_context(ssl_context);
@@ -825,7 +825,7 @@ create_ssl_context_from_options(struct us_socket_context_options_t options) {
   if (options.dh_params_file_name) {
     /* Set up ephemeral DH parameters. */
     DH *dh_2048 = NULL;
-    FILE *paramfile;
+    FILE *paramfile = NULL;
     paramfile = fopen(options.dh_params_file_name, "r");
 
     if (paramfile) {
@@ -857,7 +857,7 @@ create_ssl_context_from_options(struct us_socket_context_options_t options) {
 
   if (options.ssl_ciphers) {
     if (!SSL_CTX_set_cipher_list(ssl_context, options.ssl_ciphers)) {
-      unsigned long ssl_err = ERR_get_error(); 
+      unsigned long ssl_err = ERR_get_error();
       if (!(strlen(options.ssl_ciphers) == 0 && ERR_GET_REASON(ssl_err) == SSL_R_NO_CIPHER_MATCH)) {
         // TLS1.2 ciphers were deliberately cleared, so don't consider
         // SSL_R_NO_CIPHER_MATCH to be an error (this is how _set_cipher_suites()
@@ -881,8 +881,8 @@ create_ssl_context_from_options(struct us_socket_context_options_t options) {
 
 int us_ssl_ctx_use_privatekey_content(SSL_CTX *ctx, const char *content,
                                       int type) {
-  int reason_code, ret = 0;
-  BIO *in;
+  int reason_code = 0, ret = 0;
+  BIO *in = NULL;
   EVP_PKEY *pkey = NULL;
   in = BIO_new_mem_buf(content, strlen(content));
   if (in == NULL) {
@@ -947,7 +947,7 @@ end:
 }
 
 int us_ssl_ctx_use_certificate_chain(SSL_CTX *ctx, const char *content) {
-  BIO *in;
+  BIO *in = NULL;
   int ret = 0;
   X509 *x = NULL;
 
@@ -975,9 +975,9 @@ int us_ssl_ctx_use_certificate_chain(SSL_CTX *ctx, const char *content) {
   if (ret) {
     // If we could set up our certificate, now proceed to the CA
     // certificates.
-    X509 *ca;
-    int r;
-    uint32_t err;
+    X509 *ca = NULL;
+    int r = 0;
+    uint32_t err = 0;
 
     SSL_CTX_clear_chain_certs(ctx);
 
@@ -1202,7 +1202,7 @@ SSL_CTX *create_ssl_context_from_bun_options(
   if (options.ca_file_name) {
     SSL_CTX_set_cert_store(ssl_context, us_get_default_ca_store());
 
-    STACK_OF(X509_NAME) * ca_list;
+    STACK_OF(X509_NAME) * ca_list = NULL;
     ca_list = SSL_load_client_CA_file(options.ca_file_name);
     if (ca_list == NULL) {
       *err = CREATE_BUN_SOCKET_ERROR_LOAD_CA_FILE;
@@ -1268,7 +1268,7 @@ SSL_CTX *create_ssl_context_from_bun_options(
   if (options.dh_params_file_name) {
     /* Set up ephemeral DH parameters. */
     DH *dh_2048 = NULL;
-    FILE *paramfile;
+    FILE *paramfile = NULL;
     paramfile = fopen(options.dh_params_file_name, "r");
 
     if (paramfile) {
@@ -1300,7 +1300,7 @@ SSL_CTX *create_ssl_context_from_bun_options(
 
   if (options.ssl_ciphers) {
     if (!SSL_CTX_set_cipher_list(ssl_context, options.ssl_ciphers)) {
-      unsigned long ssl_err = ERR_get_error(); 
+      unsigned long ssl_err = ERR_get_error();
       if (!(strlen(options.ssl_ciphers) == 0 && ERR_GET_REASON(ssl_err) == SSL_R_NO_CIPHER_MATCH)) {
         char error_msg[256];
         ERR_error_string_n(ERR_peek_last_error(), error_msg, sizeof(error_msg));
@@ -1308,7 +1308,7 @@ SSL_CTX *create_ssl_context_from_bun_options(
         // SSL_R_NO_CIPHER_MATCH to be an error (this is how _set_cipher_suites()
         // works). If the user actually sets a value (like "no-such-cipher"), then
         // that's actually an error.
-        *err = CREATE_BUN_SOCKET_ERROR_INVALID_CIPHERS;  
+        *err = CREATE_BUN_SOCKET_ERROR_INVALID_CIPHERS;
         free_ssl_context(ssl_context);
         return NULL;
       }

packages/bun-usockets/src/eventing/epoll_kqueue.c

@@ -44,7 +44,7 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
 #define GET_READY_POLL(loop, index) (struct us_poll_t *) loop->ready_polls[index].data.ptr
 #define SET_READY_POLL(loop, index, poll) loop->ready_polls[index].data.ptr = (void*)poll
 #else
-#define GET_READY_POLL(loop, index) (struct us_poll_t *) loop->ready_polls[index].udata
+#define GET_READY_POLL(loop, index) (struct us_poll_t *) (loop)->ready_polls[index].udata
 #define SET_READY_POLL(loop, index, poll) loop->ready_polls[index].udata = (uint64_t)poll
 #endif
 
@@ -264,7 +264,7 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout
     us_internal_loop_pre(loop);
 
 
-    if (loop->data.jsc_vm) 
+    if (loop->data.jsc_vm)
         Bun__JSC_onBeforeWait(loop->data.jsc_vm);
 
     /* Fetch ready polls */
@@ -336,7 +336,7 @@ void us_internal_loop_update_pending_ready_polls(struct us_loop_t *loop, struct
 
             // if new events does not contain the ready events of this poll then remove (no we filter that out later on)
             SET_READY_POLL(loop, i, new_poll);
-            
+
             num_entries_possibly_remaining--;
         }
     }
@@ -366,7 +366,7 @@ int kqueue_change(int kqfd, int fd, int old_events, int new_events, void *user_d
         /* Do they differ in writable? */
         EV_SET64(&change_list[change_length++], fd, EVFILT_WRITE, (new_events & LIBUS_SOCKET_WRITABLE) ? EV_ADD : EV_DELETE, 0, 0, (uint64_t)(void*)user_data, 0, 0);
     }
-    int ret;
+    int ret = 0;
     do {
         ret = kevent64(kqfd, change_list, change_length, change_list, change_length, KEVENT_FLAG_ERROR_EVENTS, NULL);
     } while (IS_EINTR(ret));
@@ -379,7 +379,7 @@ int kqueue_change(int kqfd, int fd, int old_events, int new_events, void *user_d
 
 struct us_poll_t *us_poll_resize(struct us_poll_t *p, struct us_loop_t *loop, unsigned int ext_size) {
     int events = us_poll_events(p);
-    
+
 
     struct us_poll_t *new_p = us_realloc(p, sizeof(struct us_poll_t) + ext_size);
     if (p != new_p) {
@@ -391,6 +391,7 @@ struct us_poll_t *us_poll_resize(struct us_poll_t *p, struct us_loop_t *loop, un
         /* Forcefully update poll by resetting them with new_p as user data */
         kqueue_change(loop->fd, new_p->state.fd, 0, LIBUS_SOCKET_WRITABLE | LIBUS_SOCKET_READABLE, new_p);
 #endif      /* This is needed for epoll also (us_change_poll doesn't update the old poll) */
+        // NOLINTNEXTLINE(clang-analyzer-unix.Malloc)
         us_internal_loop_update_pending_ready_polls(loop, p, new_p, events, events);
     }
 
@@ -562,8 +563,8 @@ void us_timer_close(struct us_timer_t *timer, int fallthrough) {
     struct us_internal_callback_t *internal_cb = (struct us_internal_callback_t *) timer;
 
     struct kevent64_s event;
-    EV_SET64(&event, (uint64_t) (void*) internal_cb, EVFILT_TIMER, EV_DELETE, 0, 0, (uint64_t)internal_cb, 0, 0);
-    int ret;
+    EV_SET64(&event, (uint64_t) internal_cb, EVFILT_TIMER, EV_DELETE, 0, 0, (uint64_t)internal_cb, 0, 0);
+    int ret = 0;
     do {
         ret = kevent64(internal_cb->loop->fd, &event, 1, &event, 1, KEVENT_FLAG_ERROR_EVENTS, NULL);
     } while (IS_EINTR(ret));
@@ -584,10 +585,10 @@ void us_timer_set(struct us_timer_t *t, void (*cb)(struct us_timer_t *t), int ms
 
     /* Bug: repeat_ms must be the same as ms, or 0 */
     struct kevent64_s event;
-    uint64_t ptr = (uint64_t)(void*)internal_cb;
+    uint64_t ptr = (uint64_t)internal_cb;
     EV_SET64(&event, ptr, EVFILT_TIMER, EV_ADD | (repeat_ms ? 0 : EV_ONESHOT), 0, ms, (uint64_t)internal_cb, 0, 0);
 
-    int ret;
+    int ret = 0;
     do {
         ret = kevent64(internal_cb->loop->fd, &event, 1, &event, 1, KEVENT_FLAG_ERROR_EVENTS, NULL);
     } while (IS_EINTR(ret));
@@ -683,10 +684,10 @@ void us_internal_async_close(struct us_internal_async *a) {
     struct us_internal_callback_t *internal_cb = (struct us_internal_callback_t *) a;
 
     struct kevent64_s event;
-    uint64_t ptr = (uint64_t)(void*)internal_cb;
-    EV_SET64(&event, ptr, EVFILT_MACHPORT, EV_DELETE, 0, 0, (uint64_t)(void*)internal_cb, 0,0);
+    uint64_t ptr = (uint64_t)internal_cb;
+    EV_SET64(&event, ptr, EVFILT_MACHPORT, EV_DELETE, 0, 0, (uint64_t)internal_cb, 0,0);
 
-    int ret;
+    int ret = 0;
     do {
         ret = kevent64(internal_cb->loop->fd, &event, 1, &event, 1, KEVENT_FLAG_ERROR_EVENTS, NULL);
     } while (IS_EINTR(ret));
@@ -713,11 +714,11 @@ void us_internal_async_set(struct us_internal_async *a, void (*cb)(struct us_int
     event.filter = EVFILT_MACHPORT;
     event.flags = EV_ADD | EV_ENABLE;
     event.fflags = MACH_RCV_MSG | MACH_RCV_OVERWRITE;
-    event.ext[0] = (uint64_t)(void*)internal_cb->machport_buf;
+    event.ext[0] = (uint64_t)internal_cb->machport_buf;
     event.ext[1] = MACHPORT_BUF_LEN;
-    event.udata = (uint64_t)(void*)internal_cb;
+    event.udata = (uint64_t)internal_cb;
 
-    int ret;
+    int ret = 0;
     do {
         ret = kevent64(internal_cb->loop->fd, &event, 1, &event, 1, KEVENT_FLAG_ERROR_EVENTS, NULL);
     } while (IS_EINTR(ret));
@@ -749,20 +750,14 @@ void us_internal_async_wakeup(struct us_internal_async *a) {
     );
 
     switch (kr) {
-        case KERN_SUCCESS: {
-            break;
-        }
+        case KERN_SUCCESS:
 
         // This means that the send would've blocked because the
         // queue is full. We assume success because the port is full.
-        case MACH_SEND_TIMED_OUT: {
-            break;
-        }
+        case MACH_SEND_TIMED_OUT:
 
         // No space means it will wake up.
-        case MACH_SEND_NO_BUFFER: {
-            break;
-        }
+        case MACH_SEND_NO_BUFFER:
 
         default: {
             break;

packages/bun-usockets/src/loop.c

@@ -181,7 +181,7 @@ static const int MAX_LOW_PRIO_SOCKETS_PER_LOOP_ITERATION = 5;
 
 void us_internal_handle_low_priority_sockets(struct us_loop_t *loop) {
     struct us_internal_loop_data_t *loop_data = &loop->data;
-    struct us_socket_t *s;
+    struct us_socket_t *s = NULL;
 
     loop_data->low_prio_budget = MAX_LOW_PRIO_SOCKETS_PER_LOOP_ITERATION;
 
@@ -425,7 +425,7 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                       const int recv_flags = MSG_DONTWAIT | MSG_NOSIGNAL;
                     #endif
 
-                    int length;
+                    int length = 0;
                     #if !defined(_WIN32)
                     if(s->flags.is_ipc) {
                         struct msghdr msg = {0};

scripts/run-clang-format.sh

@@ -88,13 +88,13 @@ if [ "$MODE" = "check" ]; then
             fi
             dir=$(dirname "$dir")
         done
-        
+
         if ! $CLANG_FORMAT --dry-run --Werror "$file" 2>/dev/null; then
             echo "Format check failed: $file"
             FAILED=1
         fi
     done
-    
+
     if [ $FAILED -eq 1 ]; then
         echo "Some files need formatting. Run 'bun run clang-format' to fix."
         exit 1
@@ -123,4 +123,4 @@ else
     echo "  fix    - Same as format" >&2
     echo "  diff   - Show formatting differences" >&2
     exit 1
-fi
+fi

src/asan-config.c

@@ -1,6 +1,7 @@
 #include "wtf/Compiler.h"
 
 #if ASAN_ENABLED
+// NOLINTNEXTLINE(bugprone-reserved-identifier)
 const char* __asan_default_options(void)
 {
     // detect_stack_use_after_return causes some stack allocations to be made on the heap instead,

src/bun.js/bindings/uv-posix-polyfills.c

@@ -34,6 +34,7 @@ uint64_t uv__hrtime(uv_clocktype_t type);
 // #elif defined(__sun)
 // #include "uv/sunos.h"
 #elif defined(__APPLE__)
+// NOLINTNEXTLINE(bugprone-suspicious-include)
 #include "uv-posix-polyfills-darwin.c"
 // #elif defined(__DragonFly__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__)
 // #include "uv/bsd.h"
@@ -73,7 +74,7 @@ UV_EXTERN void uv_mutex_destroy(uv_mutex_t* mutex)
 UV_EXTERN int uv_mutex_init(uv_mutex_t* mutex)
 {
     pthread_mutexattr_t attr;
-    int err;
+    int err = 0;
 
     if (pthread_mutexattr_init(&attr))
         abort();
@@ -93,7 +94,7 @@ UV_EXTERN int uv_mutex_init(uv_mutex_t* mutex)
 UV_EXTERN int uv_mutex_init_recursive(uv_mutex_t* mutex)
 {
     pthread_mutexattr_t attr;
-    int err;
+    int err = 0;
 
     if (pthread_mutexattr_init(&attr))
         abort();
@@ -119,7 +120,7 @@ UV_EXTERN void uv_mutex_lock(uv_mutex_t* mutex)
 // Copy-pasted from libuv
 UV_EXTERN int uv_mutex_trylock(uv_mutex_t* mutex)
 {
-    int err;
+    int err = 0;
 
     err = pthread_mutex_trylock(mutex);
     if (err) {