CodeVetter · Repo Unpack · Risk map
TanStack/query
These risks are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The most consequential boundaries are request-local cache ownership, serialized data, incoming broadcast snapshots, and callback execution. Shared core behavior also has broad adapter impact and several compatibility branches. Release tooling performs privileged external actions and was inspected only as public source.
- SSR documentation explicitly warns that a module-level QueryClient shares cache across requests and can expose sensitive data; request-local client construction is an application integration requirement.
- Hypothesis: persisting sensitive successful query data could expose it through the chosen storage because the default adapter uses JSON serialization and a shared default key; dehydration filters and custom serializers are the available controls. (inferred)
- Restoration checks timestamp age and buster, but hydrate consumes supplied arrays and states without structural schema validation in the inspected implementation; malformed deserialized state can throw and trigger cache removal.
- Broadcast's incoming updated branch directly sets supplied state without comparing update timestamps; this differs from hydrate's newer-data checks and creates a freshness-review hotspot.
- Cancellation depends on signal consumption: removing the last observer cancels and reverts when the signal was consumed or an initial load is paused; otherwise it cancels retries while allowing the current result to cache.
- Mutation success/settled callback exceptions enter the mutation error path even after mutationFn resolves; exceptions from error callbacks are emitted as separate rejected promises, so transport success and reported mutation success can diverge.
- Compatibility is active rather than dead code: deprecated imperative query methods remain, root ESLint restricts new calls, and createSyncStoragePersister is deprecated in favor of the async adapter.
- Release automation has write and OIDC permissions; create-github-release shells out to tag/push and gh release, writes notes outside the repository via tmpdir, and may delete newly created tags on failure.