@mh-alikhani/bunready 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -9,6 +9,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Nothing yet.
 
+## [0.3.2] - 2026-09-20
+
+### Changed
+
+- Source files are read with bounded concurrency instead of one at a time. A scan
+  of 800 files went from a 200.9ms median to 86.2ms on Windows (un run bench),
+  with identical output.
+
+### Notes
+
+- Measured and rejected: --bytecode cannot compile the entry point because it
+  uses top-level wait, --minify produces a byte-identical 82.2MB binary (the
+  size is the Bun runtime), and deferring the scanner behind dynamic imports moved
+  the cost into the scan path without a repeatable win.
+
+## [0.3.1] - 2026-09-19
+
+### Fixed
+
+- Three polynomial-time regular expressions, reported by CodeQL as
+  `js/polynomial-redos`. bunready parses files it does not control - a
+  `pnpm-workspace.yaml` from a repository being scanned, a semver range in its
+  `engines` - so a pathological string could have made a scan take quadratic
+  time. The pnpm list item and the semver operator split are now parsed
+  directly, and trailing-slash stripping is a linear loop instead of `/+$`.
+  Behaviour is unchanged; `tests/workspaces.test.ts` and `tests/semver.test.ts`
+  cover the affected paths.
+
 ## [0.3.0] - 2026-09-18
 
 ### Added
@@ -188,7 +216,9 @@ Nothing yet.
   and that claim needs a primary source. Until then the rule reports what the
   repository imports and cites the compatibility table.
 
-[Unreleased]: https://github.com/MHAlikhani/bunready/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/MHAlikhani/bunready/compare/v0.3.2...HEAD
+[0.3.2]: https://github.com/MHAlikhani/bunready/releases/tag/v0.3.2
+[0.3.1]: https://github.com/MHAlikhani/bunready/releases/tag/v0.3.1
 [0.3.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.3.0
 [0.2.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.2.0
 [0.1.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mh-alikhani/bunready",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Bun-readiness scanner: one command that shows what will break before you move a Node/TS repo to Bun.",
   "keywords": [
     "bun",
@@ -64,6 +64,7 @@
     "check": "bun run typecheck && bun run lint && bun run test",
     "og": "bun run scripts/generate-og-image.ts",
     "smoke": "bun run scripts/smoke-real.ts",
+    "bench": "bun run scripts/bench.ts",
     "prepare": "simple-git-hooks"
   },
   "devDependencies": {

package/src/scanner/semver.ts

@@ -92,12 +92,12 @@ function comparatorsForToken(token: string): Comparator[] | undefined {
     return [];
   }
 
-  const operatorMatch = /^(>=|<=|>|<|=|\^|~)?\s*(.*)$/.exec(trimmed);
-  if (operatorMatch === null) {
-    return undefined;
-  }
-  const operator = operatorMatch[1];
-  const rest = operatorMatch[2] ?? "";
+  // Anchored-prefix parse rather than a trailing \s*(.*)$, which backtracks
+  // quadratically on a long run of spaces - and the range comes from a
+  // repository bunready does not control.
+  const operatorMatch = /^(>=|<=|>|<|=|\^|~)?/.exec(trimmed);
+  const operator = operatorMatch?.[1];
+  const rest = trimmed.slice(operatorMatch?.[0].length ?? 0).trim();
   if (rest === "" || rest === "*" || rest === "x") {
     return [];
   }

package/src/scanner/sources.ts

@@ -301,8 +301,41 @@ export interface ScanSourcesOptions {
 }
 
 /**
- * Walk the target's own source, breadth first and sorted, so the result is
- * deterministic. Hitting the cap is reported, never hidden.
+ * Bounded-concurrency reads.
+ *
+ * Files are independent, so the ordered part (the walk) and the slow part (the
+ * reads) are separated: the walk decides the order, the pool does the waiting.
+ * Results keep their walk order because each file lands in its own slot.
+ */
+const MAX_READ_CONCURRENCY = 16;
+
+async function readSourceFiles(paths: readonly string[], fs: FileSystem): Promise<SourceFile[]> {
+  const slots = new Array<SourceFile | undefined>(paths.length);
+  let cursor = 0;
+
+  const worker = async (): Promise<void> => {
+    while (cursor < paths.length) {
+      const index = cursor;
+      cursor += 1;
+      const path = paths[index];
+      if (path === undefined) {
+        continue;
+      }
+      const outcome = await fs.readTextFile(path);
+      if (outcome.kind === "text") {
+        slots[index] = { path, imports: extractImports(outcome.text) };
+      }
+    }
+  };
+
+  await Promise.all(Array.from({ length: Math.min(MAX_READ_CONCURRENCY, paths.length) }, worker));
+  return slots.filter((file): file is SourceFile => file !== undefined);
+}
+
+/**
+ * Walk the target's own source, breadth first and sorted, then read it. Reading
+ * a repository of hundreds of files one at a time was the slowest thing a scan
+ * did, and the files have no dependency on each other.
  */
 export async function scanSources(
   dir: string,
@@ -313,7 +346,7 @@ export async function scanSources(
   const excludePaths = options.excludePaths ?? [];
   const ignored = new Set<string>(IGNORED_DIRECTORIES);
   const queue: string[] = [dir];
-  const files: SourceFile[] = [];
+  const candidates: string[] = [];
   let truncated = false;
 
   while (queue.length > 0) {
@@ -322,8 +355,7 @@ export async function scanSources(
       break;
     }
 
-    const entries = await fs.listDirectory(current);
-    for (const entry of entries) {
+    for (const entry of await fs.listDirectory(current)) {
       if (entry.isDirectory) {
         if (!ignored.has(entry.name)) {
           queue.push(join(current, entry.name));
@@ -333,7 +365,7 @@ export async function scanSources(
       if (!hasSourceExtension(entry.name)) {
         continue;
       }
-      if (files.length >= maxFiles) {
+      if (candidates.length >= maxFiles) {
         truncated = true;
         continue;
       }
@@ -341,11 +373,7 @@ export async function scanSources(
       if (excludePaths.some((fragment) => path.includes(fragment))) {
         continue;
       }
-      const outcome = await fs.readTextFile(path);
-      if (outcome.kind !== "text") {
-        continue;
-      }
-      files.push({ path: path.replace(/\\/g, "/"), imports: extractImports(outcome.text) });
+      candidates.push(path);
     }
 
     if (truncated) {
@@ -353,5 +381,6 @@ export async function scanSources(
     }
   }
 
+  const files = await readSourceFiles(candidates, fs);
   return { files, filesScanned: files.length, truncated };
 }

package/src/scanner/workspaces.ts

@@ -54,9 +54,22 @@ export function patternsFromPnpmWorkspace(text: string): string[] {
     if (!inPackages) {
       continue;
     }
-    const entry = /^-+\s*(.+?)\s*$/.exec(trimmed);
-    if (entry?.[1] !== undefined) {
-      patterns.push(entry[1].replace(/^['"]|['"]$/g, ""));
+    // Walked rather than matched: a pattern mixing a dash run, a space run and a
+    // catch-all is ambiguous, and CodeQL is right that it backtracks on a string
+    // of dashes and spaces. The value is trimmed here instead.
+    let cursor = 0;
+    while (cursor < trimmed.length && trimmed[cursor] === "-") {
+      cursor += 1;
+    }
+    const value =
+      cursor === 0
+        ? ""
+        : trimmed
+            .slice(cursor)
+            .trim()
+            .replace(/^['"]|['"]$/g, "");
+    if (value !== "") {
+      patterns.push(value);
     }
   }
 
@@ -123,6 +136,15 @@ async function expandGlob(root: string, segments: string[], fs: FileSystem): Pro
   return prefixes.filter((prefix) => prefix !== "" && prefix !== ".");
 }
 
+/** Linear replacement for `/+$`, which backtracks on a run of slashes. */
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+
 export async function findWorkspacePackages(
   root: string,
   patterns: readonly string[],
@@ -131,7 +153,7 @@ export async function findWorkspacePackages(
   const found = new Map<string, WorkspacePackage>();
 
   for (const pattern of patterns) {
-    const cleaned = pattern.replace(/\\/g, "/").replace(/\/+$/, "").replace(/^\.\//, "");
+    const cleaned = stripTrailingSlashes(pattern.replace(/\\/g, "/")).replace(/^\.\//, "");
     if (cleaned === "" || cleaned === ".") {
       continue;
     }
@@ -165,6 +187,6 @@ export async function readPnpmWorkspace(root: string, fs: FileSystem): Promise<s
 
 /** Keep only the packages matching a scope string, by relative path or name. */
 export function scopeMatches(relative: string, scope: string): boolean {
-  const needle = scope.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+  const needle = stripTrailingSlashes(scope.replace(/\\/g, "/")).replace(/^\.\//, "");
   return relative === needle || relative.includes(needle);
 }