CodeVetter · Repo Unpack · Risk map
reduxjs/redux
These are source observations and explicitly marked hypotheses, not confirmed vulnerabilities. The inspected core executes caller-provided reducers and middleware in process and validates only a limited action shape. Operational boundaries appear in documentation acquisition, mutable build output, browser embeds, and publishing automation. Compatibility and validation gaps require attention because the library has several distributed formats and the site consumes independently changing repositories.
- Base dispatch validates action shape and type but performs no payload authorization, sanitization, or deep serializability validation in the inspected implementation; payload and reducer trust remain application responsibilities.
- getState returns the stored reference, and combination detects changes using slice references rather than deep comparisons; a mutating reducer can violate the documented pure-reducer contract without this mechanism detecting the mutation. (inferred)
- Subscriber callbacks run after currentState is assigned and have no individual exception handling; a throwing callback stops ordinary Map.forEach iteration and does not roll back the already assigned state.
- The main CI path filter lists src, test, .github, tsdown.config.mts, and pnpm-lock.yaml, but omits package.json, scripts, tsconfig files, and vitest.config.mts; an isolated change to an omitted file does not satisfy the build job's src condition.
- External docs default to master refs, honor caller-provided repository/ref/local-source settings, and copy or symlink files from outside the checkout; --force and local refresh remove existing generated targets before reacquisition.
- Netlify sets DOCS_TYPECHECK=warn, and the code-block plugin then emits warnings rather than failing on diagnostics; this configuration permits publication with reported snippet type errors.
- Build is a mutating operation: clean removes dist and coverage, the Babel plugin may rewrite tracked errors.json, and transform failures are logged before returning null rather than explicitly rethrown by the tsdown hook.
- The vanilla example loads an unpinned redux@latest browser module from unpkg, while legacy examples declare Redux 4 and React 17; these examples therefore do not uniformly exercise the pinned Redux 5 source.