# Risk map — immerjs/immer

> Canonical page: https://codevetter.com/unpack/immer/risk-map

# Risk map — immerjs/immer

Scanned commit 061c2425e1c9dff89e4e4189d42af1b7839dfe0a (2026-08-19). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and maintenance risks, not confirmed vulnerabilities. Sensitive boundaries include executable recipes and accessors, externally supplied patch paths, documentation scripts, and release permissions. Core correctness depends on coupled scope, callback, and array-reference bookkeeping; the inspection is bounded and does not establish whole-repository security or test completeness.
- Patch application rejects reserved intermediate traversal keys for objects/arrays and function prototypes, but final-key writes use a separate dispatch; security edits must preserve and assess both boundaries rather than generalizing the traversal guard. — [src/plugins/patches.ts#L333-L381](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/plugins/patches.ts#L333-L381) [__tests__/patch.js#L1307-L1346](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/__tests__/patch.js#L1307-L1346)
- Recipes execute caller code directly, strict copying reads own accessors, and proxy access can invoke prototype getters/setters; these APIs are executable object interactions rather than a sanitization boundary. — [src/core/immerClass.ts#L109-L115](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/core/immerClass.ts#L109-L115) [src/utils/common.ts#L211-L234](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/utils/common.ts#L211-L234) [src/core/proxy.ts#L174-L179](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/core/proxy.ts#L174-L179) [src/core/proxy.ts#L314-L322](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/core/proxy.ts#L314-L322)
- Array interception passes base values into predicates and native copy operations; mutation inside intercepted callbacks or through concat/flat elements bypasses ordinary nested-draft tracking. — [src/plugins/arrayMethods.ts#L79-L80](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/plugins/arrayMethods.ts#L79-L80) [src/plugins/arrayMethods.ts#L448-L500](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/plugins/arrayMethods.ts#L448-L500) [website/docs/pitfalls.md#L91-L115](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/website/docs/pitfalls.md#L91-L115)
- Reordered arrays depend on allIndicesReassigned_ and baseRefs_ to draft relocated base objects; inserted objects containing drafts depend on string-keyed assignment records and cross-reference callbacks to avoid revoked proxies in results. — [src/core/proxy.ts#L295-L311](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/core/proxy.ts#L295-L311) [src/plugins/arrayMethods.ts#L194-L197](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/plugins/arrayMethods.ts#L194-L197) [src/plugins/arrayMethods.ts#L206-L232](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/plugins/arrayMethods.ts#L206-L232) [__tests__/base.js#L435-L463](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/__tests__/base.js#L435-L463)
- Strict-iteration comments say the default is enabled, but Immer initializes useStrictIteration_=false; the constructor also accepts only boolean strict-copy config values although StrictMode includes 'class_only'. — [src/immer.ts#L72-L79](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/immer.ts#L72-L79) [src/core/immerClass.ts#L45-L61](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/core/immerClass.ts#L45-L61) [src/core/immerClass.ts#L191-L202](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/core/immerClass.ts#L191-L202)
- Manual drafts can miss application updates made while awaiting asynchronous work, and externally inserted objects are not automatically drafted; both usage traps are explicitly documented. — [website/docs/async.mdx#L40-L59](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/website/docs/async.mdx#L40-L59) [website/docs/pitfalls.md#L38-L54](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/website/docs/pitfalls.md#L38-L54) [src/core/proxy.ts#L148-L161](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/src/core/proxy.ts#L148-L161)
- The profiling analyzer reads a caller-selected filesystem path without a repo-root containment check and loads ../dist sourcemaps; these file reads belong to development tooling, while tsup separately writes distribution files. — [perf-testing/read-cpuprofile.js#L4-L17](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/perf-testing/read-cpuprofile.js#L4-L17) [perf-testing/read-cpuprofile.js#L51-L58](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/perf-testing/read-cpuprofile.js#L51-L58) [tsup.config.ts#L73-L87](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/tsup.config.ts#L73-L87)
- The documentation site loads external button/ad scripts and two analytics plugins; release CI grants contents, id-token, and pull-request write permissions and publishes only for immerjs/immer after tests/build. — [website/docusaurus.config.js#L61-L64](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/website/docusaurus.config.js#L61-L64) [website/docusaurus.config.js#L82-L94](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/website/docusaurus.config.js#L82-L94) [.github/workflows/release.yml#L11-L14](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/.github/workflows/release.yml#L11-L14) [.github/workflows/release.yml#L25-L36](https://github.com/immerjs/immer/blob/061c2425e1c9dff89e4e4189d42af1b7839dfe0a/.github/workflows/release.yml#L25-L36)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)