# Risk map — iamkun/dayjs

> Canonical page: https://codevetter.com/unpack/dayjs/risk-map

# Risk map — iamkun/dayjs

Scanned commit 436bde0bcded312781cbe45dc2b0ef079a36d8e3 (2026-09-15). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly identified hypotheses, not confirmed vulnerabilities. The inspected runtime paths principally expose parsing and shared extension state; filesystem mutation and release credentials appear in tooling boundaries. Calendar correctness depends on native Date, Intl data, offset bookkeeping, and plugin composition. Existing regression tests constrain some of these behaviors but were not run.
- Input validation differs by mode: core isValid only checks native invalid-Date state, native component construction can normalize overflow, and customParseFormat rejects round-trip mismatches only when strict mode is requested. — [src/index.js#L63-L82](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/index.js#L63-L82) [src/index.js#L115-L117](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/index.js#L115-L117) [src/plugin/customParseFormat/index.js#L232-L250](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/customParseFormat/index.js#L232-L250) [test/plugin/customParseFormat.test.js#L301-L315](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/test/plugin/customParseFormat.test.js#L301-L315)
- Plugins execute directly with the shared class and factory and can replace methods globally; badMutable intentionally removes clone-before-set behavior, while advancedFormat and duration call APIs supplied by companion plugins. — [src/index.js#L448-L453](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/index.js#L448-L453) [src/plugin/badMutable/index.js#L3-L30](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/badMutable/index.js#L3-L30) [src/plugin/advancedFormat/index.js#L21-L43](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/advancedFormat/index.js#L21-L43) [src/plugin/duration/index.js#L232-L237](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/duration/index.js#L232-L237)
- Locale data is shared mutable state: instances resolve $L through Ls at call time, and updateLocale changes registry objects. Hypothesis: runtime locale updates can change output from already-created instances and require application-level coordination. (inferred) — [src/index.js#L14-L36](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/index.js#L14-L36) [src/index.js#L395-L404](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/index.js#L395-L404) [src/plugin/updateLocale/index.js#L2-L18](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/updateLocale/index.js#L2-L18)
- DST overlap resolution starts with the target zone's offset at the current time, and fixOffset documents that the guess selects ambiguous offsets; broader timezone calendar arithmetic is explicitly deferred in the test source. — [src/plugin/timezone/index.js#L69-L90](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/timezone/index.js#L69-L90) [src/plugin/timezone/index.js#L135-L149](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/timezone/index.js#L135-L149) [test/plugin/timezone.test.js#L480-L481](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/test/plugin/timezone.test.js#L480-L481)
- Timezone formatting constructs Intl.DateTimeFormat with caller-supplied zone names and caches by zone/name style without a local eviction or exception handler; invalid-date guards do not validate the zone identifier. — [src/plugin/timezone/index.js#L14-L33](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/timezone/index.js#L14-L33) [src/plugin/timezone/index.js#L95-L100](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/timezone/index.js#L95-L100) [src/plugin/timezone/index.js#L135-L147](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/timezone/index.js#L135-L147)
- Duration total-unit conversion assumes 365 days per year and one twelfth of that per month, whereas applying a duration to a date performs calendar-unit additions; consumers must distinguish fixed totals from calendar arithmetic. — [src/plugin/duration/index.js#L9-L23](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/duration/index.js#L9-L23) [src/plugin/duration/index.js#L104-L107](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/duration/index.js#L104-L107) [src/plugin/duration/index.js#L188-L190](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/duration/index.js#L188-L190) [src/plugin/duration/index.js#L261-L268](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/src/plugin/duration/index.js#L261-L268)
- Build tooling writes package artifacts and unlinks relocated declarations; ESM paths partly depend on process.env.PWD. Core build and locale.json writes are not awaited, ESM uses async forEach callbacks, and outer catches log errors without explicitly setting a failing exit code. — [build/index.js#L24-L34](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/build/index.js#L24-L34) [build/index.js#L60-L70](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/build/index.js#L60-L70) [build/esm.js#L9-L20](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/build/esm.js#L9-L20) [build/esm.js#L29-L42](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/build/esm.js#L29-L42)
- The release job inherits secrets, grants repository write and OIDC permissions, exposes GITHUB_TOKEN to release tooling, and installs additional release packages without saving them; it is a privileged boundary triggered by master pushes. — [.github/workflows/release.yml#L1-L18](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/.github/workflows/release.yml#L1-L18) [.github/workflows/release.yml#L36-L42](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/.github/workflows/release.yml#L36-L42) [.releaserc#L2-L14](https://github.com/iamkun/dayjs/blob/436bde0bcded312781cbe45dc2b0ef079a36d8e3/.releaserc#L2-L14)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)