# Risk map — oxc-project/oxc

> Canonical page: https://codevetter.com/unpack/oxc/risk-map

# Risk map — oxc-project/oxc

Scanned commit 7f65b757df7c3225320d8f7e051e64873f80f988 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source-observed trust boundaries and correctness hazards, not confirmed vulnerabilities. The most consequential inspected paths execute JavaScript configuration, select an external executable, transfer raw memory, or rewrite user files. Compiler-stage ordering and streaming configuration introduce additional coupling. Testing and documentation limits should be accounted for before making broader safety or correctness claims.
- JavaScript/TypeScript configuration is executable input: importJsConfig dynamically imports a cache-busted file URL before validating its default export; Oxfmt invokes it through the Node config callback. — [apps/shared/src-js/js_config/index.ts#L18-38](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/apps/shared/src-js/js_config/index.ts#L18-L38) [apps/oxfmt/src-js/cli/js_config.ts#L10-11](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/apps/oxfmt/src-js/cli/js_config.ts#L10-L11) [apps/oxfmt/src-js/cli.ts#L41-48](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/apps/oxfmt/src-js/cli.ts#L41-L48)
- Type-aware linting trusts executable selection from OXLINT_TSGOLINT_PATH, ancestor node_modules/.bin locations, then PATH; spawn_tsgolint executes that path with headless and piped input. — [crates/oxc_linter/src/tsgolint.rs#L1350-1368](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/crates/oxc_linter/src/tsgolint.rs#L1350-L1368) [crates/oxc_linter/src/tsgolint.rs#L1380-1407](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/crates/oxc_linter/src/tsgolint.rs#L1380-L1407) [crates/oxc_linter/src/tsgolint.rs#L360-365](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/crates/oxc_linter/src/tsgolint.rs#L360-L365)
- Raw parser transfer exposes unsafe functions with caller requirements for source offset, length, and valid UTF-8; get_buffer_offset explicitly does not verify bounds, and the representation relies on large aligned buffers and platform gating. — [napi/parser/src/raw_transfer.rs#L29-62](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/napi/parser/src/raw_transfer.rs#L29-L62) [napi/parser/src/raw_transfer.rs#L65-103](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/napi/parser/src/raw_transfer.rs#L65-L103) [napi/parser/src/lib.rs#L33-46](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/napi/parser/src/lib.rs#L33-L46)
- Formatter writes can partially complete before a lazy nested-config failure: WalkRunner explicitly warns that unaffected scopes may already have been written. — [apps/oxfmt/src/cli/walk_runner.rs#L175-188](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/apps/oxfmt/src/cli/walk_runner.rs#L175-L188) [apps/oxfmt/src/cli/service.rs#L80-98](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/apps/oxfmt/src/cli/service.rs#L80-L98)
- Selected formatting paths are rewritten with fs::write, and cwd is used to shorten displayed paths with an outside-cwd fallback; this write site itself does not enforce repository-root containment. — [apps/oxfmt/src/cli/service.rs#L80-109](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/apps/oxfmt/src/cli/service.rs#L80-L109)
- Transformations can leave scoping out of sync with the AST; CompilerInterface::compile tracks scoping_dirty and rebuilds before inject/define consumers, making stage order a correctness-sensitive edit boundary. — [crates/oxc/src/compiler.rs#L180-208](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/crates/oxc/src/compiler.rs#L180-L208)
- Formatter fixture snapshots can contain accepted idempotency mismatches, so a matching snapshot alone does not establish formatter idempotence. — [crates/oxc_formatter_tests/src/harness.rs#L3-11](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/crates/oxc_formatter_tests/src/harness.rs#L3-L11)
- Architecture documentation contains version drift: ARCHITECTURE.md states MSRV 1.86.0+, whereas Cargo.toml declares 1.97.0 and rust-toolchain.toml selects 1.99.0. — [ARCHITECTURE.md#L382-388](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/ARCHITECTURE.md#L382-L388) [Cargo.toml#L15-18](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/Cargo.toml#L15-L18) [rust-toolchain.toml#L1-3](https://github.com/oxc-project/oxc/blob/7f65b757df7c3225320d8f7e051e64873f80f988/rust-toolchain.toml#L1-L3)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)