CodeVetter · Repo Unpack · Risk map
testing-library/react-testing-library
The main source-observed risks concern shared state, lifecycle boundaries, compatibility, and validation strength. Security-sensitive authority appears in release automation; the inspected core runtime operates on the test DOM and callbacks rather than implementing authentication or transport. These observations and labeled hypotheses are not confirmed vulnerabilities or whole-repository absence claims.
- Even the pure implementation changes shared DOM Testing Library configuration at import time and writes IS_REACT_ACT_ENVIRONMENT during operations; selecting pure only avoids index.js lifecycle registration.
- RTL_SKIP_AUTO_CLEANUP is tested by truthiness rather than equality with 'true', and the same guard disables both cleanup registration and suite-level act-environment hooks.
- configure assigns reactStrictMode even when a delta omits it, replacing the previous value with undefined; the inspected config suite does not assert retention after a DOM-only delta.
- The Set and array must remain synchronized; result.unmount does not deregister its root, and a later render on that container selects the stored root. This is a lifecycle hotspot, not a demonstrated failure in this inspection.
- Async scheduling depends on Jest-specific timer markers and a zero-delay timer to drain microtasks; global flag restoration for asynchronous act is tied to consuming its returned thenable.
- debug sends formatted DOM to console.log, while asFragment reparses container.innerHTML without a sanitization step. Hypothesis: sensitive fixture content can enter logs or snapshots; these helpers are not a content-security boundary. (inferred)
- README authentication and localStorage code is an example application, while inspected async test loaders return synthetic promises. Treating those as shipped authentication, persistence, or real-network coverage would misstate the library boundary.
- Release automation grants OIDC and repository write permissions, consumes workflow secret references, and installs without a lockfile; non-latest React validation jobs allow failure. These are consequential release boundaries, with no credential values read or exploit established.