# Risk map — testing-library/react-testing-library

> Canonical page: https://codevetter.com/unpack/react-testing-library/risk-map

# Risk map — testing-library/react-testing-library

Scanned commit 20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800 (2026-08-27). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The main source-observed risks concern shared state, lifecycle boundaries, compatibility, and validation strength. Security-sensitive authority appears in release automation; the inspected core runtime operates on the test DOM and callbacks rather than implementing authentication or transport. These observations and labeled hypotheses are not confirmed vulnerabilities or whole-repository absence claims.
- Even the pure implementation changes shared DOM Testing Library configuration at import time and writes IS_REACT_ACT_ENVIRONMENT during operations; selecting pure only avoids index.js lifecycle registration. — [src/pure.js#L32-L77](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L32-L77) [src/act-compat.js#L28-L39](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/act-compat.js#L28-L39) [src/index.js#L9-L38](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/index.js#L9-L38)
- RTL_SKIP_AUTO_CLEANUP is tested by truthiness rather than equality with 'true', and the same guard disables both cleanup registration and suite-level act-environment hooks. — [src/index.js#L9-L38](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/index.js#L9-L38) [src/__tests__/auto-cleanup-skip.js#L3-L18](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/__tests__/auto-cleanup-skip.js#L3-L18)
- configure assigns reactStrictMode even when a delta omits it, replacing the previous value with undefined; the inspected config suite does not assert retention after a DOM-only delta. — [src/config.js#L24-L31](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/config.js#L24-L31) [src/__tests__/config.js#L19-L66](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/__tests__/config.js#L19-L66)
- The Set and array must remain synchronized; result.unmount does not deregister its root, and a later render on that container selects the stored root. This is a lifecycle hotspot, not a demonstrated failure in this inspection. — [src/pure.js#L79-L88](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L79-L88) [src/pure.js#L206-L210](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L206-L210) [src/pure.js#L279-L303](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L279-L303)
- Async scheduling depends on Jest-specific timer markers and a zero-delay timer to drain microtasks; global flag restoration for asynchronous act is tied to consuming its returned thenable. — [src/pure.js#L16-L27](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L16-L27) [src/pure.js#L39-L60](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L39-L60) [src/act-compat.js#L54-L69](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/act-compat.js#L54-L69)
- debug sends formatted DOM to console.log, while asFragment reparses container.innerHTML without a sanitization step. Hypothesis: sensitive fixture content can enter logs or snapshots; these helpers are not a content-security boundary. (inferred) — [src/pure.js#L200-L205](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L200-L205) [src/pure.js#L222-L232](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L222-L232) [src/__tests__/render.js#L78-L90](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/__tests__/render.js#L78-L90)
- README authentication and localStorage code is an example application, while inspected async test loaders return synthetic promises. Treating those as shipped authentication, persistence, or real-network coverage would misstate the library boundary. — [README.md#L224-L259](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/README.md#L224-L259) [src/__tests__/end-to-end.js#L19-L27](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/__tests__/end-to-end.js#L19-L27) [src/__tests__/end-to-end.js#L93-L97](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/__tests__/end-to-end.js#L93-L97) [src/pure.js#L369-L371](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/src/pure.js#L369-L371)
- Release automation grants OIDC and repository write permissions, consumes workflow secret references, and installs without a lockfile; non-latest React validation jobs allow failure. These are consequential release boundaries, with no credential values read or exploit established. — [.github/workflows/release.yml#L25-L32](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/.github/workflows/release.yml#L25-L32) [.github/workflows/release.yml#L73-L85](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/.github/workflows/release.yml#L73-L85) [.github/workflows/release.yml#L95-L117](https://github.com/testing-library/react-testing-library/blob/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800/.github/workflows/release.yml#L95-L117)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)