# Risk map — dubzzz/fast-check

> Canonical page: https://codevetter.com/unpack/fast-check/risk-map

# Risk map — dubzzz/fast-check

Scanned commit ecf7193810d1057253808105444e147d948051a1 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These risks are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. The main runtime sensitivities are nonterminating generation, user-controlled execution, cleanup ordering, and compatibility assumptions. Filesystem deletion and release automation require separate operational caution. Partial inspection does not establish whole-repository absence of authentication, network activity, tests, or other safeguards.
- FilterArbitrary.generate retries synchronously without a retry bound; timeout decorates predicate execution, cannot stop a running predicate, and has no effect on synchronous execution. An always-rejecting generator can therefore stall before predicate timeout handling. — [packages/fast-check/src/check/arbitrary/definition/Arbitrary.ts#L319-L325](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/arbitrary/definition/Arbitrary.ts#L319-L325) [packages/fast-check/src/check/plugin/TimeoutPlugin.ts#L23-L46](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/plugin/TimeoutPlugin.ts#L23-L46)
- Worker execution loads a supplied file URL through new Worker without sandbox restrictions in that constructor; main-thread inputs must cross messaging serialization, worker-generated inputs disable shrinking, and package documentation requires its own assert to avoid lingering workers. — [packages/worker/src/internals/worker-pool/BasicPool.ts#L31-L43](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/worker/src/internals/worker-pool/BasicPool.ts#L31-L43) [packages/worker/src/main.ts#L77-L87](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/worker/src/main.ts#L77-L87) [packages/worker/src/main.ts#L129-L140](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/worker/src/main.ts#L129-L140)
- Hypothesis: terminateIfStillRunning searches for w.worker !== worker before splicing, which appears capable of removing another pooled worker or the last entry when no unequal worker exists. Reproduction is needed before calling this a confirmed cleanup defect. (inferred) — [packages/worker/src/internals/worker-pool/BasicPool.ts#L135-L141](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/worker/src/internals/worker-pool/BasicPool.ts#L135-L141)
- Completion hooks are attached with runDetailsPromise.then rather than a rejection handler/finally; all hooks are attempted after a resolved RunDetails, but that implementation does not provide the same cleanup path when the run promise rejects before producing details. — [packages/fast-check/src/check/runner/Runner.ts#L34-L76](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/Runner.ts#L34-L76) [packages/fast-check/src/check/runner/Runner.ts#L136-L139](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/Runner.ts#L136-L139)
- removeNonPublishedFiles accepts a caller-supplied packageRoot, normalizes it, and recursively removes excluded children; dryRun defaults to false and normalized relative child paths are compared against the caller-supplied keep strings, making an incorrect root operationally consequential. — [packages/packaged/src/packaged.ts#L63-L79](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/packaged/src/packaged.ts#L63-L79) [packages/packaged/src/packaged.ts#L90-L109](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/packaged/src/packaged.ts#L90-L109)
- Global parameters are held and returned by reference, while installed global plugins append to a module-level array returned directly to the runner; resetConfigureGlobal clears parameters but does not clear that separate plugin registry. — [packages/fast-check/src/check/runner/configuration/GlobalParameters.ts#L58-L77](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/configuration/GlobalParameters.ts#L58-L77) [packages/fast-check/src/check/runner/configuration/GlobalPlugins.ts#L3-L3](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/configuration/GlobalPlugins.ts#L3-L3) [packages/fast-check/src/check/runner/configuration/GlobalPlugins.ts#L26-L31](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/configuration/GlobalPlugins.ts#L26-L31)
- Hypothesis: Sampler.toProperty still identifies properties by an own runBeforeEach field, while PropertyImplem exposes generate/shrink/run without that field. Direct property sampling merits a regression check; worker property classes also retain legacy hook forwarding. (inferred) — [packages/fast-check/src/check/runner/Sampler.ts#L11-L15](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/Sampler.ts#L11-L15) [packages/fast-check/src/check/property/_internals/PropertyImplem.ts#L30-L61](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/property/_internals/PropertyImplem.ts#L30-L61) [packages/worker/src/internals/worker-property/WorkerPropertyFromWorker.ts#L82-L103](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/worker/src/internals/worker-property/WorkerPropertyFromWorker.ts#L82-L103)
- Documentation/configuration drift is visible: custom-reports says verbosity defaults to 1 but readVerbose defaults to None, CONTRIBUTING names Prettier while package.json runs oxfmt, and the core advertises Node >=12.17 while source uses iterator helpers and CI legacy bundles target Node 22.12. — [website/docs/configuration/custom-reports.md#L28-L32](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/website/docs/configuration/custom-reports.md#L28-L32) [packages/fast-check/src/check/runner/configuration/QualifiedParameters.ts#L118-L123](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/configuration/QualifiedParameters.ts#L118-L123) [CONTRIBUTING.md#L59-L64](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/CONTRIBUTING.md#L59-L64) [packages/fast-check/package.json#L14-L35](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/package.json#L14-L35) [packages/fast-check/src/check/runner/Sampler.ts#L29-L33](https://github.com/dubzzz/fast-check/blob/ecf7193810d1057253808105444e147d948051a1/packages/fast-check/src/check/runner/Sampler.ts#L29-L33)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)