CodeVetter
← All unpacks
CodeVetter · Repo Unpack evidence

testing-library/dom-testing-library

Scanned commit 6049cc0bc7 dated 2026-09-13 — last upstream commit. Generated by codevetter 1.15.0 on 2026-10-02.

github.com/testing-library/dom-testing-library ↗ · 108 files · 481 KB

DOM Testing Library Simple and complete DOM testing utilities that encourage good testing practices.

Deep analysis by cli:codex via the codex CLI on 2026-10-02 (335s) — every claim below links to its cited source files. Source inspection; upstream code and tests were not executed.

Overview

DOM Testing Library is an npm library for developers testing browser or simulated DOM interfaces through queries that resemble how users identify controls and content. It combines accessible-role and label queries, synchronous and asynchronous query variants, event construction, scoped query binding, and detailed DOM diagnostics. At commit 6049cc0bc7cf2201625c476c95fa6299d0e2fa8b, its implementation mixes JavaScript and TypeScript with separately maintained public declarations and Jest suites for jsdom and Node environments.

System map

The runtime is an importable DOM utility library with a named-export entrypoint and eight query families. Browser objects belong to the consumer; the implementation binds queries to containers and obtains windows from supplied nodes. Configuration and retry bookkeeping live in memory, while diagnostics provide a limited Node filesystem integration. Distribution and CI are defined by npm metadata, inherited kcd-scripts configuration, and GitHub Actions.

Feature catalog

Users locate elements by accessible semantics, visible text, form values, and identifying attributes. Each query family exposes variants for nullable lookup, required lookup, collections, and asynchronous lookup. Additional APIs scope queries, dispatch events, wait for disappearance, recommend queries, and print diagnostics. These are library APIs used from test code rather than application routes or screens.

Data flow

Query inputs consist of a container, matcher, and options; family-specific candidate selection feeds shared matching and cardinality wrappers. Elements remain owned by the consumer DOM, and results are references or promises for references. Event creation can mutate those elements before dispatch, while asynchronous utilities own transient observation and retry state. Error and debugging boundaries convert DOM/source content into strings, console output, or encoded URLs.

Behavior traces

The following traces were reconstructed by reading callers and implementations, without executing them. They cover import-time initialization, synchronous lookup, asynchronous appearance and disappearance, event dispatch, configuration updates, and debugging. Branches such as absent global DOM, fake timers, pending promises, and query errors materially alter execution. The configuration trace describes in-memory state changes rather than a persistence service.

Testing signals

Tests and CI were inspected, not executed; test existence is not a passing result. Jest configuration separates jsdom and Node projects, with separately typechecked public API examples. Inspected suites exercise query semantics, visibility, asynchronous scheduling, removal, events, and diagnostic behavior. This is a bounded source inventory: browser fidelity, actual coverage percentages, inherited thresholds, and release success remain unverified.

Risk map

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries center on diagnostics exposing DOM/source content, stack-derived file reads, and privileged release automation. Correctness hotspots include global configuration, generated query/type coupling, accessibility semantics, and timer transitions. The inspected library paths operate on consumer DOM objects; this bounded review does not establish whole-repository absence of authentication, IPC, shell, or network behavior.

Extension points

The library exposes factories and wrappers as extension mechanisms for consumers and framework adapters. Query families plug into export tables, and custom query maps can be bound without modifying the default registry. Event shortcuts derive from a declarative map, while configuration injects scheduling, dispatch, and diagnostic behavior. Public declarations form a parallel extension contract that must remain aligned with runtime behavior.

Contributor handoff

Start with the public export surface, shared query factories, and the smallest family-specific implementation involved in the task. Preserve runtime and declaration parity, query cardinality, node ownership, and timer cleanup when making changes. Tests and CI were inspected, not executed, and this brief is bounded rather than an exhaustive coverage or security assessment. The commands below identify existing validation entrypoints for a separately authorized implementation task; the present investigation remained read-only.

Languages

LanguageFilesShare of source
JavaScript4759%
TypeScript3341%
Markdown12docs/config
JSON4docs/config
YAML2docs/config

Start reading here

Probable source entrypoint: src/index.js — inferred from the directory tree and manifest, not the upstream docs.

Source roots

src/ (61 files)

Source layout — src/

PathFiles
src/__node_tests__/3
src/__tests__/30
src/queries/10
src/DOMElementFilter.ts1
src/config.ts1
src/event-map.js1
src/events.js1
src/get-node-text.ts1
src/get-queries-for-element.js1
src/get-user-code-frame.js1
src/helpers.ts1
src/index.js1
src/label-helpers.ts1
src/matches.ts1

Repository structure

Top-level pathFiles
src/61
types/17
.github/7
other/3
tests/3
.codesandbox/1

Docs found: CONTRIBUTING.mdREADME.md

Package

package.json — @testing-library/dom v0.0.0-semantically-released, 17 declared dependencies.

@babel/code-frame@babel/runtime@testing-library/jest-dom@types/aria-queryaria-querybrowserslistcaniuse-litedom-accessibility-apijest-in-casejest-snapshot-serializer-ansijest-watch-select-projectsjsdom

CI & config entrypoints

Structural health signals

Average score 8.8/10 across 77 analyzed source files; 2 hotspots surfaced.

These are deterministic review leads — size, churn, and structural signals — not proof of a bug in this project.

Recent history