7 ms·

This announcement made me check in on the arbitrary code execution bug I reported that the Bun Claude bot created a PR for about 3 weeks ago: https://github.co

by krig 10mo ago

This announcement made me check in on the arbitrary code execution bug I reported that the Bun Claude bot created a PR for about 3 weeks ago: https://github.com/oven-sh/bun/pull/24578 https://github.com/oven-sh/bun/pull/24578 So far, someone from the bun team has left a bunch of comments like > Poor quality code ...and all the tests still seem to be failing. I looked through the code that the bot had generated and to me (who to be fair is not familiar with the bun codebase) it looks like total dogshit. But hey, maybe it'll get there eventually. I don't envy "taylordotfish" and the other bot-herders working at Oven though, and I hope they get a nice payout as part of this sale.

bopbopbop7 10mo ago
So you pushed a PR that breaks a bunch of tests, added a 5 layer nested if branch block that mixes concerns all over the place, then ignored the reviewer for three weeks, and you’re surprised they didn’t approve it?
- throwaway290 10mo ago
  > So you pushed a PR that breaks a bunch of tests, added a 5 layer nested if branch block that mixes concerns all over the place, then ignored the reviewer for three weeks, and you’re surprised they didn’t approve it? ...Did you miss the part where Bun used Claude to generate that PR?:)
  - simonw 10mo ago
    I misinterpreted that first comment too. To clarify: 1. User krig reports an issue against the Bun repo: https://github.com/oven-sh/bun/issues/24548 https://github.com/oven-sh/bun/issues/24548 2. Bun's own automated "bunbot" filed a PR with a potential fix: https://github.com/oven-sh/bun/pull/24578 https://github.com/oven-sh/bun/pull/24578 3. taylordotfish (not an employee of Bun as far as I can tell, but quite an active contributor to their repo) left a code review pointing out many flaws: https://github.com/oven-sh/bun/pull/24578#pullrequestreview-3462495696 https://github.com/oven-sh/bun/pull/24578#pullrequestreview-...
    - krig 10mo ago
      Right, this is accurate. Except I thought taylordotfish worked for bun, so I guess no one at bun has looked at it at all then.
  - bopbopbop7 10mo ago
    I did.
- deleted 10mo ago
  [deleted]
- Master_Odin 10mo ago
  The OP directly says: > that the Bun Claude bot created a PR for about 3 weeks ago The PR with bad code that's also been ignored was made by the bot that Bun made, and brags about in their acquisition post.
- krig 10mo ago
  I just reported the bug, it was the bot that was proudly mentioned in the announcement which created the PR and the code...

by krig 10mo ago

bopbopbop7 10mo ago

So you pushed a PR that breaks a bunch of tests, added a 5 layer nested if branch block that mixes concerns all over the place, then ignored the reviewer for three weeks, and you’re surprised they didn’t approve it?

throwaway290 10mo ago
> So you pushed a PR that breaks a bunch of tests, added a 5 layer nested if branch block that mixes concerns all over the place, then ignored the reviewer for three weeks, and you’re surprised they didn’t approve it? ...Did you miss the part where Bun used Claude to generate that PR?:)
- simonw 10mo ago
  I misinterpreted that first comment too. To clarify: 1. User krig reports an issue against the Bun repo: https://github.com/oven-sh/bun/issues/24548 https://github.com/oven-sh/bun/issues/24548 2. Bun's own automated "bunbot" filed a PR with a potential fix: https://github.com/oven-sh/bun/pull/24578 https://github.com/oven-sh/bun/pull/24578 3. taylordotfish (not an employee of Bun as far as I can tell, but quite an active contributor to their repo) left a code review pointing out many flaws: https://github.com/oven-sh/bun/pull/24578#pullrequestreview-3462495696 https://github.com/oven-sh/bun/pull/24578#pullrequestreview-...
  - krig 10mo ago
    Right, this is accurate. Except I thought taylordotfish worked for bun, so I guess no one at bun has looked at it at all then.
- bopbopbop7 10mo ago
  I did.
deleted 10mo ago
[deleted]
Master_Odin 10mo ago
The OP directly says: > that the Bun Claude bot created a PR for about 3 weeks ago The PR with bad code that's also been ignored was made by the bot that Bun made, and brags about in their acquisition post.
krig 10mo ago
I just reported the bug, it was the bot that was proudly mentioned in the announcement which created the PR and the code...