[robobun]

Problem

• mordant-baseline.toml accepts more findings than main has for five (lint, file) keys. The mordant job tolerates an over-count, so a new finding of the same lint in one of these files passes unseen until the count is used up.
• Four of these files changed after their count was recorded, and main now has fewer findings in them. The fifth, WebSocketUpgradeClient.rs, has not changed since WebSocket: real closing handshake, one failure path, ws rewritten on native transports (consolidates the open WebSocket PRs) #45223 set its count to 2, and mordant reports one finding there. Nothing regenerated the baseline.

Fix

• Lower each count to the number of findings that main has:
  • "generic_body_not_generic:src/http_jsc/websocket_client/WebSocketUpgradeClient.rs": 2 to 1
  • "generic_body_not_generic:src/sql_jsc/mysql/JSMySQLConnection.rs" = 1: removed
  • "generic_body_not_generic:src/sql_jsc/mysql/MySQLConnection.rs": 4 to 1
  • "generic_body_not_generic:src/sql_jsc/mysql/protocol/DecodeBinaryValue.rs" = 1: removed
  • "options_as_enum:src/lint/driver/lint.rs" = 1: removed, with the [bun_lint_driver] header of its now empty section
• The baseline goes from 198 lines and 495 accepted findings to 195 lines and 488. No code changes.
• Verified: bun run rust:mordant exits 0 with the new file (three targets, pinned MORDANT_REV).

Background

• mordant-baseline.toml is a ratchet. Each line is "<lint>:<file>" = <count>. The mordant job hides that many findings of the lint in the file and fails only when the file has more.
• A count is the largest number that any one of the three targets reports. unused_pub is the exception: one run over all three targets counts it (scripts/rust-mordant.ts).
• No other line is stale: runs with an empty baseline matched every other count, unused_pub included.

Notes

Findings per target for the five keys:

key	old count	Linux	Windows	macOS
generic_body_not_generic:src/http_jsc/websocket_client/WebSocketUpgradeClient.rs	2	1	1	1
generic_body_not_generic:src/sql_jsc/mysql/JSMySQLConnection.rs	1	0	0	0
generic_body_not_generic:src/sql_jsc/mysql/MySQLConnection.rs	4	1	1	1
generic_body_not_generic:src/sql_jsc/mysql/protocol/DecodeBinaryValue.rs	1	0	0	0
options_as_enum:src/lint/driver/lint.rs	1	0	0	0

How the counts were taken: cargo +nightly-2026-09-01 mordant --workspace --target <triple> --keep-going for each of x86_64-unknown-linux-gnu, x86_64-pc-windows-msvc and aarch64-apple-darwin, with MORDANT_TOML set to the text of mordant.toml with its baseline key pointed at an empty file, so that every finding prints. Then one run with all three --target flags for unused_pub (160 findings in 22 files, the same as the baseline).

The finding that remains in MySQLConnection.rs is MySQLConnection::process_split_packet (generic over C). The finding that remains in WebSocketUpgradeClient.rs is HTTPClient::<SSL>::connect.

When each count was recorded:

• MySQLConnection.rs, JSMySQLConnection.rs and DecodeBinaryValue.rs: in ci: bump mordant to cbeefdb #43669. sql: consolidate the open Bun.sql, bun:sqlite and node:sqlite pull requests #45304 changed all three files after that.
• lint/driver/lint.rs: in ci: bump mordant to 564c8da #45478. bun check: 1.4x to 7.8x faster on large projects. Fixes for bun check, bun lint and bun fmt #45800 and bun check: fix errors lost since #45800, and 9 to 37% faster #46001 changed the file after that.
• WebSocketUpgradeClient.rs: in WebSocket: real closing handshake, one failure path, ws rewritten on native transports (consolidates the open WebSocket PRs) #45223, which is also the last change to that file. WebSocket client: follow-up fixes to #45223 #45720 later changed two other files of the same crate (websocket_client.rs and WebSocketProxyTunnel.rs).

[robobun]

Status: ready for review.

• Reproduced: cargo mordant at the pinned MORDANT_REV, one run for each of the three targets with an empty baseline, reports fewer findings than mordant-baseline.toml accepts for the five keys in the description. Every other key matches.
• Checked: bun run rust:mordant exits 0 with the new file.
• PR: mordant: remove baseline counts for findings that are gone #46244

[robobun]

^{Updated 7:22 PM PT - Oct 20th, 2026}

✅ @robobun, your commit 88232c5602628c06dbbd218af71851bbfc6b5bf4 passed in Build #129672! 🎉

---

🧪   To try this PR locally:

bunx bun-pr 46244

That installs a local version of the PR into your bun-46244 executable, so you can run:

bun-46244 --bun

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: oven-sh/bun/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: cd43f416-130f-47a7-99fc-59d51e78c1b5

📥 Commits

Reviewing files that changed from the base of the PR and between 9b4284f and 88232c5.

📒 Files selected for processing: 1

• mordant-baseline.toml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

Walkthrough

The Mordant analyzer baselines were updated for the WebSocket and MySQL entries. The bun_lint_driver baseline entry was removed.

Changes

Analyzer baseline updates

Layer / File(s)	Summary
Update analyzer baseline entries mordant-baseline.toml	The WebSocket entry moves to line 1. The bun_lint_driver entry is removed. Three MySQL entries are replaced by one entry for MySQLConnection.rs at line 1.

Suggested reviewers: alii, jarred-sumner

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 88232

The baseline-only update is mergeable with normal checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: removing stale Mordant baseline counts for findings that no longer exist.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description clearly explains the problem, the baseline changes, the scope, and the verification method. It does not use the template headings exactly, but it provides the required information and …

Full details: Description check

Explanation

The description clearly explains the problem, the baseline changes, the scope, and the verification method. It does not use the template headings exactly, but it provides the required information and is complete.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

LGTM — a baseline-only tightening where every hunk lowers or removes a count, so the ratchet can only get stricter.

What was reviewed:

• Checked each of the five entries against history: MySQLConnection.rs, JSMySQLConnection.rs, DecodeBinaryValue.rs and lint/driver/lint.rs were all rewritten substantially after the baseline was last regenerated (f0c6cbc), which accounts for the dropped findings.
• WebSocketUpgradeClient.rs has not changed since f0c6cbc, so its 2 -> 1 drop rests on the PR's own mordant runs rather than a traceable source edit; the mordant job runs all three targets with --keep-going on this PR, so a too-low count would show as a red check here rather than merging unseen.
• Confirmed the file still matches the generator's format (sorted sections and keys, no empty section left behind after [bun_lint_driver] was removed).

Extended reasoning...

The change edits only mordant-baseline.toml, the per-(lint, file) ratchet for the Rust lint pack, lowering four counts and deleting one now-empty section with no Rust source changes. It touches no security-sensitive surface. Every hunk reduces an accepted-finding count, so the only failure mode is a count that is too low, and scripts/rust-mordant.ts shows the CI job runs the same three targets and would fail this PR directly in that case. Four of the five drops are corroborated by large rewrites of the named files since the last regeneration; the fifth is unverifiable from history in this shallow clone but is covered by the PR's own check. Small, mechanical, and self-verifying by CI, so it meets the bar for approval.

[robobun]

The note about WebSocketUpgradeClient.rs is correct, and the description now says it. #45223 set that count to 2 and is also the last change to the file. The pinned mordant reports one finding there on each of the three targets (HTTPClient::<SSL>::connect). I did not find which change removed the second finding. #45720 changed websocket_client.rs and WebSocketProxyTunnel.rs in the same crate after #45223.

The mordant job passed on this head with the lower counts.