Skip to content

Fix dynamic import() resolving before TLA module finishes evaluating #29224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
robobun wants to merge 11 commits into
base: main
Choose a base branch
from
+204 −0

[autofix.ci] apply automated fixes

b032048
Select commit
Loading
Failed to load commit list.
Open

Fix dynamic import() resolving before TLA module finishes evaluating #29224

[autofix.ci] apply automated fixes
b032048
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Apr 12, 2026 in 21m 14s

Code review found 1 potential issue

Found 5 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 1
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit src/bun.js/bindings/ZigGlobalObject.cpp:2726 requestImportModule override missing DontDelete|ReadOnly attributes

Annotations

Check warning on line 2726 in src/bun.js/bindings/ZigGlobalObject.cpp

See this annotation in the file changed.

@claude claude / Claude Code Review

requestImportModule override missing DontDelete|ReadOnly attributes 

The `requestImportModule` override is installed with only `PropertyAttribute::Builtin | PropertyAttribute::DontEnum` (line 2726), while the defensive pattern used elsewhere for security-critical builtins includes `PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly`. Without these flags, internal Bun builtins (which access the module loader via the `@Loader` private name) could accidentally overwrite or delete this property, silently reverting to the stock WebKit implementation and re-in
View more details on Claude