CodeVetter · Repo Unpack · Risk map
dubzzz/fast-check
These risks are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. The main runtime sensitivities are nonterminating generation, user-controlled execution, cleanup ordering, and compatibility assumptions. Filesystem deletion and release automation require separate operational caution. Partial inspection does not establish whole-repository absence of authentication, network activity, tests, or other safeguards.
- FilterArbitrary.generate retries synchronously without a retry bound; timeout decorates predicate execution, cannot stop a running predicate, and has no effect on synchronous execution. An always-rejecting generator can therefore stall before predicate timeout handling.
- Worker execution loads a supplied file URL through new Worker without sandbox restrictions in that constructor; main-thread inputs must cross messaging serialization, worker-generated inputs disable shrinking, and package documentation requires its own assert to avoid lingering workers.
- Hypothesis: terminateIfStillRunning searches for w.worker !== worker before splicing, which appears capable of removing another pooled worker or the last entry when no unequal worker exists. Reproduction is needed before calling this a confirmed cleanup defect. (inferred)
- Completion hooks are attached with runDetailsPromise.then rather than a rejection handler/finally; all hooks are attempted after a resolved RunDetails, but that implementation does not provide the same cleanup path when the run promise rejects before producing details.
- removeNonPublishedFiles accepts a caller-supplied packageRoot, normalizes it, and recursively removes excluded children; dryRun defaults to false and normalized relative child paths are compared against the caller-supplied keep strings, making an incorrect root operationally consequential.
- Global parameters are held and returned by reference, while installed global plugins append to a module-level array returned directly to the runner; resetConfigureGlobal clears parameters but does not clear that separate plugin registry.
- Hypothesis: Sampler.toProperty still identifies properties by an own runBeforeEach field, while PropertyImplem exposes generate/shrink/run without that field. Direct property sampling merits a regression check; worker property classes also retain legacy hook forwarding. (inferred)
- Documentation/configuration drift is visible: custom-reports says verbosity defaults to 1 but readVerbose defaults to None, CONTRIBUTING names Prettier while package.json runs oxfmt, and the core advertises Node >=12.17 while source uses iterator helpers and CI legacy bundles target Node 22.12.