CodeVetter · Repo Unpack · Risk map
date-fns/date-fns
The strongest source observations concern documentation side effects, snapshot mode selection, date-state synchronization, and build-output paths. These observations are not confirmed security vulnerabilities, and no exploit or runtime failure was reproduced. Library correctness depends on preserving constructor context and handling native Date and Intl edge cases. Potential operational consequences are explicitly labeled as hypotheses where execution would be needed.
- Source-observed snapshot mismatch: test/locales passes --test, but the script compares only when process.argv[2] equals 'test'; the supplied --test therefore selects the writeFile branch.
- The docs CLI dynamically imports a process-argument path and initializes Firebase Admin before dispatch; package, TypeDoc, and Markdown paths are resolved from config without a repository-root containment check in these inspected paths.
- Hypothesis: documentation publication or rollback can leave partial remote state after an individual failure because package, version, and page operations run concurrently without one encompassing transaction. (inferred)
- TZDateMini is a correctness hotspot: separate instant/wall-clock objects require synchronization, historical second corrections, DST-gap detection, and a final small-drift correction bounded below 30 minutes.
- tzOffset caches formatter functions by zone and offsets by strings, catches Intl failures, and falls back to an unanchored numeric-offset regex; cache bounds and stricter fallback input validation are not present in this inspected implementation.
- Module-global defaults affect format and parse, while multi-date normalization uses the first object unless a context is supplied; the time-zone guide explicitly demonstrates order-dependent business-day results.
- Build tooling performs filesystem mutations and shell-outs: package.sh removes package-local dist, the dev builder accepts source/output paths and runs oxfmt, and CDN construction recursively removes an environment-selected output when building a separate CDN package.
- Source-observed subpath mismatch: tz workspace exports reference several paths without src and Date .ts files, while inspected implementations reside under src with Date .js files; utc Date subpaths likewise target .ts instead of the inspected .js implementations. Resolution impact was not tested.