CodeVetter · Repo Unpack · Risk map
parcel-bundler/parcel
The observed trust boundaries include development HTTP/WebSocket interfaces, executable project configuration and plugins, package-manager subprocesses, and output/cache filesystem writes. Several correctness-sensitive paths depend on graph invalidation, update ordering, and worker cache visibility. Findings below are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities or reproduced defects. The inspection was bounded and does not establish the absence of protections or tests elsewhere.
- The CLI documents listening on all interfaces by default, Server.start() defaults CORS to wildcard headers, and the source endpoint serves inputFS beneath projectRoot; this combination makes development-network exposure a review boundary.
- HMRServer.handle() accepts an editor endpoint file query, preserves absolute paths, joins relative paths to projectRoot, and calls launchEditor(); its shown WebSocket initialization uses new WebSocket.Server({server}) without an origin-verification option.
- Plugins are required through the project package manager, and executable proxy configurations are required and invoked with the Connect app; plugin version and symbol validation are compatibility checks around executable code.
- CLI autoinstall defaults to enabled except disabled flags or production-build CI detection; the npm installer can create package.json and spawns npm install with save flags, making an ordinary build capable of dependency and lockfile mutations.
- WriteBundlesRequest explicitly refreshes LMDB after worker packaging because a stale main-thread read transaction can miss committed values; removing or reordering this refresh would disturb a documented concurrency safeguard.
- BundleGraph documents that direct mutation of its exposed _graph can bypass bundle-hash invalidation, with runtime application relying on BundlerRunner to invalidate hashes; graph edits therefore have cross-stage cache consequences.
- buildSuccess is reported before validation, and built-in-server HMR updates may broadcast at the bundled phase before packaging; Node updates use additional readiness coordination, so consumers must distinguish graph readiness, written output, and final validation.
- Hypothesis: runEntryRequest() computes didEntriesChange using prevEntries.every(entryId === currentEntries[index]), which appears to disable incremental bundling for identical lists and may miss equal-length substitutions; this warrants targeted investigation rather than a confirmed defect claim. (inferred)