CodeVetter · Repo Unpack · Risk map
oxc-project/oxc
These are source-observed trust boundaries and correctness hazards, not confirmed vulnerabilities. The most consequential inspected paths execute JavaScript configuration, select an external executable, transfer raw memory, or rewrite user files. Compiler-stage ordering and streaming configuration introduce additional coupling. Testing and documentation limits should be accounted for before making broader safety or correctness claims.
- JavaScript/TypeScript configuration is executable input: importJsConfig dynamically imports a cache-busted file URL before validating its default export; Oxfmt invokes it through the Node config callback.
- Type-aware linting trusts executable selection from OXLINT_TSGOLINT_PATH, ancestor node_modules/.bin locations, then PATH; spawn_tsgolint executes that path with headless and piped input.
- Raw parser transfer exposes unsafe functions with caller requirements for source offset, length, and valid UTF-8; get_buffer_offset explicitly does not verify bounds, and the representation relies on large aligned buffers and platform gating.
- Formatter writes can partially complete before a lazy nested-config failure: WalkRunner explicitly warns that unaffected scopes may already have been written.
- Selected formatting paths are rewritten with fs::write, and cwd is used to shorten displayed paths with an outside-cwd fallback; this write site itself does not enforce repository-root containment.
- Transformations can leave scoping out of sync with the AST; CompilerInterface::compile tracks scoping_dirty and rebuilds before inject/define consumers, making stage order a correctness-sensitive edit boundary.
- Formatter fixture snapshots can contain accepted idempotency mismatches, so a matching snapshot alone does not establish formatter idempotence.
- Architecture documentation contains version drift: ARCHITECTURE.md states MSRV 1.86.0+, whereas Cargo.toml declares 1.97.0 and rust-toolchain.toml selects 1.99.0.