CodeVetter · Repo Unpack · Risk map
immerjs/immer
These are source observations and maintenance risks, not confirmed vulnerabilities. Sensitive boundaries include executable recipes and accessors, externally supplied patch paths, documentation scripts, and release permissions. Core correctness depends on coupled scope, callback, and array-reference bookkeeping; the inspection is bounded and does not establish whole-repository security or test completeness.
- Patch application rejects reserved intermediate traversal keys for objects/arrays and function prototypes, but final-key writes use a separate dispatch; security edits must preserve and assess both boundaries rather than generalizing the traversal guard.
- Recipes execute caller code directly, strict copying reads own accessors, and proxy access can invoke prototype getters/setters; these APIs are executable object interactions rather than a sanitization boundary.
- Array interception passes base values into predicates and native copy operations; mutation inside intercepted callbacks or through concat/flat elements bypasses ordinary nested-draft tracking.
- Reordered arrays depend on allIndicesReassigned_ and baseRefs_ to draft relocated base objects; inserted objects containing drafts depend on string-keyed assignment records and cross-reference callbacks to avoid revoked proxies in results.
- Strict-iteration comments say the default is enabled, but Immer initializes useStrictIteration_=false; the constructor also accepts only boolean strict-copy config values although StrictMode includes 'class_only'.
- Manual drafts can miss application updates made while awaiting asynchronous work, and externally inserted objects are not automatically drafted; both usage traps are explicitly documented.
- The profiling analyzer reads a caller-selected filesystem path without a repo-root containment check and loads ../dist sourcemaps; these file reads belong to development tooling, while tsup separately writes distribution files.
- The documentation site loads external button/ad scripts and two analytics plugins; release CI grants contents, id-token, and pull-request write permissions and publishes only for immerjs/immer after tests/build.