# Risk map — motiondivision/motion

> Canonical page: https://codevetter.com/unpack/motion/risk-map

# Risk map — motiondivision/motion

Scanned commit f5838ce47b323ce2713cb2effc5afaa5b6120a44 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The observations below identify sensitive boundaries and change hotspots, not confirmed vulnerabilities. Release scripts have filesystem and network effects outside the animation runtime. Animation correctness depends on browser capability detection, shared rendering ownership, lifecycle ordering, and bundle/context identity. Two retention and CSP concerns are explicitly labeled hypotheses requiring targeted verification.
- Release commands have substantial side effects: new invokes Lerna publication and site mirroring, postpublish pushes tags, and Makefile clean removes node_modules and invokes git clean -fdX. — [package.json#L24-L27](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/package.json#L24-L27) [packages/motion/package.json#L89-L95](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/motion/package.json#L89-L95) [Makefile#L20-L24](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/Makefile#L20-L24)
- pushToSite copies a file outside this checkout into an environment-selected MOTION_API_PATH or ~/Sites/motion-api; it checks destination existence but the source does not constrain the destination to this repository. — [scripts/push-to-site.js#L23-L43](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/scripts/push-to-site.js#L23-L43)
- notifySlack loads dotenv, accepts an overridable SLACK_UPDATE_API_URL, and sends UPDATE_SECRET_TOKEN as a bearer header; production requires a token, while development permits a test token and local HTTP. — [scripts/notify-slack.js#L3-L4](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/scripts/notify-slack.js#L3-L4) [scripts/notify-slack.js#L80-L92](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/scripts/notify-slack.js#L80-L92) [scripts/notify-slack.js#L109-L115](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/scripts/notify-slack.js#L109-L115)
- The Claude workflow executes on @claude-bearing issue/comment/review content, requests id-token write permission, and delegates to a version-tagged third-party action using an OAuth-secret reference; authorization beyond the visible condition is outside this source inspection. — [.github/workflows/claude.yml#L15-L26](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/.github/workflows/claude.yml#L15-L26) [.github/workflows/claude.yml#L28-L41](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/.github/workflows/claude.yml#L28-L41)
- Hypothesis: the module-level timelineCache can retain detached containers and targets because it uses nested Maps with no eviction in get-timeline.ts; listener cleanup in attachToAnimation does not remove those cache entries. (inferred) — [packages/framer-motion/src/render/dom/scroll/utils/get-timeline.ts#L20-L50](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/framer-motion/src/render/dom/scroll/utils/get-timeline.ts#L20-L50) [packages/framer-motion/src/render/dom/scroll/attach-animation.ts#L112-L115](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/framer-motion/src/render/dom/scroll/attach-animation.ts#L112-L115)
- Hypothesis: strict CSP may block view-transition CSS because css.commit creates and appends a style element without assigning a nonce, despite MotionConfig exposing a nonce option. Browser verification is needed to establish impact. (inferred) — [packages/motion-dom/src/view/utils/css.ts#L10-L28](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/motion-dom/src/view/utils/css.ts#L10-L28) [packages/framer-motion/src/context/MotionConfigContext.tsx#L40-L47](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/framer-motion/src/context/MotionConfigContext.tsx#L40-L47)
- Bundling and public export shape are compatibility hotspots: shared CommonJS contexts are required for LazyMotion/m communication, and motion/react deliberately avoids a duplicate-source re-export pattern documented as causing Turbopack OOM. — [packages/framer-motion/rollup.config.mjs#L115-L134](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/framer-motion/rollup.config.mjs#L115-L134) [packages/motion/src/react.ts#L3-L16](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/motion/src/react.ts#L3-L16)
- Projection and keyframe measurement change live DOM state: projection cancels optimized transforms before snapshots, resets transforms before measuring nodes, and keyframe resolution temporarily renders styles and restores scroll position. Frame-order changes therefore cross multiple rendering responsibilities. — [packages/motion-dom/src/projection/node/create-projection-node.ts#L672-L689](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/motion-dom/src/projection/node/create-projection-node.ts#L672-L689) [packages/motion-dom/src/projection/node/create-projection-node.ts#L776-L792](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/motion-dom/src/projection/node/create-projection-node.ts#L776-L792) [packages/motion-dom/src/animation/keyframes/KeyframesResolver.ts#L45-L85](https://github.com/motiondivision/motion/blob/f5838ce47b323ce2713cb2effc5afaa5b6120a44/packages/motion-dom/src/animation/keyframes/KeyframesResolver.ts#L45-L85)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)