# Risk map — reduxjs/redux-toolkit

> Canonical page: https://codevetter.com/unpack/redux-toolkit/risk-map

# Risk map — reduxjs/redux-toolkit

Scanned commit e7a8b318df28aaf50ced1e65cd4636b7508263b2 (2026-09-29). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These findings describe source-visible trust boundaries and maintenance hazards, not confirmed vulnerabilities. Network destinations, executable configuration, and generated-file writes deserve explicit ownership in consuming applications. Cache behavior also depends on middleware installation, request completion, and rehydration timing. Test limitations and package-resolution coupling constrain what source inspection alone can establish.
- fetchBaseQuery prepares headers before joining URLs, and joinUrls accepts absolute endpoint URLs unchanged. Applications that attach bearer headers indiscriminately must review endpoint destination control; this is a source-visible trust boundary, not a demonstrated leak. — [packages/toolkit/src/query/fetchBaseQuery.ts#L245-L255](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/fetchBaseQuery.ts#L245-L255) [packages/toolkit/src/query/fetchBaseQuery.ts#L295-L303](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/fetchBaseQuery.ts#L295-L303) [packages/toolkit/src/query/utils/joinUrls.ts#L6-L19](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/utils/joinUrls.ts#L6-L19) [examples/query/react/authentication/src/app/services/auth.ts#L22-L29](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/examples/query/react/authentication/src/app/services/auth.ts#L22-L29)
- The authentication fixture stores user/token in Redux and its mock login returns a token without checking submitted credentials; PrivateOutlet checks user presence. It demonstrates request authentication wiring rather than production credential validation. — [examples/query/react/authentication/src/features/auth/authSlice.tsx#L6-L23](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/examples/query/react/authentication/src/features/auth/authSlice.tsx#L6-L23) [examples/query/react/authentication/src/mocks/handlers.ts#L24-L34](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/examples/query/react/authentication/src/mocks/handlers.ts#L24-L34) [examples/query/react/authentication/src/utils/PrivateOutlet.tsx#L4-L12](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/examples/query/react/authentication/src/utils/PrivateOutlet.tsx#L4-L12)
- OpenAPI CLI configuration is executable input: optional TypeScript loaders are registered, cwd changes to the config directory, and require(configFile) executes it. Schema bundling accepts HTTP resolution and outputFile is resolved without a repository-root restriction. — [packages/rtk-query-codegen-openapi/src/bin/cli.ts#L25-L48](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/rtk-query-codegen-openapi/src/bin/cli.ts#L25-L48) [packages/rtk-query-codegen-openapi/src/bin/cli.ts#L67-L75](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/rtk-query-codegen-openapi/src/bin/cli.ts#L67-L75) [packages/rtk-query-codegen-openapi/src/utils/getV3Doc.ts#L6-L14](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/rtk-query-codegen-openapi/src/utils/getV3Doc.ts#L6-L14) [packages/rtk-query-codegen-openapi/src/index.ts#L19-L34](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/rtk-query-codegen-openapi/src/index.ts#L19-L34)
- The codemod CLI derives the transform path from argv[2], expands user-supplied globs, and invokes jscodeshift through execaSync with inherited stdio; the inspected invocation supplies no dry-run option. — [packages/rtk-codemods/bin/cli.mjs#L13-L38](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/rtk-codemods/bin/cli.mjs#L13-L38)
- API middleware installation is a functional requirement: React hooks probe it and throw a development error when missing, while handler execution requires state at reducerPath and registration tracks API identity conflicts. — [packages/toolkit/src/query/react/buildHooks.ts#L1716-L1736](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/react/buildHooks.ts#L1716-L1736) [packages/toolkit/src/query/core/buildMiddleware/index.ts#L100-L135](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/core/buildMiddleware/index.ts#L100-L135) [packages/toolkit/src/query/core/buildSlice.ts#L684-L689](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/core/buildSlice.ts#L684-L689)
- Delayed invalidation is the default and waits while the middleware's pending-request counter is positive. Schema failures without catchSchemaFailure bypass normal tag handling, making request completion and error classification consequential cache-consistency boundaries. — [packages/toolkit/src/query/createApi.ts#L357-L364](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/createApi.ts#L357-L364) [packages/toolkit/src/query/core/buildMiddleware/invalidationByTags.ts#L48-L60](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/core/buildMiddleware/invalidationByTags.ts#L48-L60) [packages/toolkit/src/query/core/buildMiddleware/invalidationByTags.ts#L101-L108](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/core/buildMiddleware/invalidationByTags.ts#L101-L108) [packages/toolkit/src/query/endpointDefinitions.ts#L435-L438](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/endpointDefinitions.ts#L435-L438)
- Persistence documentation warns about stale API data; cache collection explicitly notes that rehydration before endpoint injection uses global retention instead of endpoint-specific keepUnusedDataFor. — [docs/rtk-query/usage/persistence-and-rehydration.mdx#L20-L28](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/docs/rtk-query/usage/persistence-and-rehydration.mdx#L20-L28) [packages/toolkit/src/query/core/buildMiddleware/cacheCollection.ts#L126-L135](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/core/buildMiddleware/cacheCollection.ts#L126-L135) [packages/toolkit/src/query/core/buildMiddleware/cacheCollection.ts#L159-L168](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/toolkit/src/query/core/buildMiddleware/cacheCollection.ts#L159-L168)
- Artifact validation is sensitive to aliases and workspace linking: CI removes source aliases, changes the package name, and detaches portability installs to target the tarball. Separately, codemod second-pass idempotence and real GraphQL transport remain unproven by the inspected specific tests. — [.github/workflows/tests.yml#L144-L163](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/.github/workflows/tests.yml#L144-L163) [.github/workflows/tests.yml#L528-L565](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/.github/workflows/tests.yml#L528-L565) [packages/rtk-codemods/transformTestUtils.ts#L53-L63](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/rtk-codemods/transformTestUtils.ts#L53-L63) [packages/rtk-query-graphql-request-base-query/src/index.test.ts#L384-L398](https://github.com/reduxjs/redux-toolkit/blob/e7a8b318df28aaf50ced1e65cd4636b7508263b2/packages/rtk-query-graphql-request-base-query/src/index.test.ts#L384-L398)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)