CodeVetter · Repo Unpack · Risk map
gcanti/fp-ts
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities or reproduced failures. Sensitive boundaries in the inspected files include foreign callbacks, Promise rejection, filesystem operations, and npm publication. Searches across the examined public source and tooling were bounded; they do not establish whole-repository absence of authentication, secrets handling, networking, or other security behavior. Compatibility and test reliability deserve attention alongside runtime failure handling.
- bracket's cleanup guarantee explicitly concerns Left results; bracketW uses Promise sequencing without finally/catch around use, so an arbitrary rejected use Promise does not follow the release continuation shown here.
- taskify resolves callback errors to Left but calls the foreign function inside a Promise executor without a catch-to-Left adapter; it also applies the function with a null receiver, making thrown errors and receiver-dependent APIs distinct integration cases.
- Default TaskEither traversal launches all input effects through Promise.all before examining Either outcomes; returning Left therefore does not cancel or prevent other effects, as the side-effect log test demonstrates.
- The build FileSystem adapter accepts arbitrary path strings and delegates directly to Node fs operations without root validation; inspected build call sites use package-relative inputs and dist outputs, so containment depends on their path construction and working directory.
- npm run release has a prerelease build hook and ultimately invokes child_process.exec('npm publish',{cwd:'dist'}); root prepublishOnly rejects publication, but the release path deliberately bypasses that root location.
- Both examined chunksOf property predicates compute isDeepStrictEqual(as,bs) without returning or asserting it; their explicit example assertion remains, but generated unequal results are not surfaced by that comparison statement.
- Packaging/compatibility hypothesis: HKT.js and HKT.d.ts are moved during build, with both output formats targeting one shared declaration; changes here could disrupt URI module augmentation, and README warns that multiple installed fp-ts versions can cause compilation hangs. (inferred)
- Version-sensitive observations: package.json reports 2.16.11 while the lockfile root reports 2.16.7, and Json.parse's invalid-input test compares against a specific SyntaxError message; neither mismatch was executed or shown to fail.