# Risk map — solidjs/solid

> Canonical page: https://codevetter.com/unpack/solid/risk-map

# Risk map — solidjs/solid

Scanned commit b25c557754f2ced0d86490e6dbfded9b1745b663 (2026-09-04). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The strongest source-observed boundaries are configured code execution and output paths in static generation, external execution in optional integration tests, and shared runtime state. Package-condition mistakes and duplicated client/server behavior can affect broad portions of the public API. These are source observations or labeled hypotheses, not confirmed vulnerabilities or runtime failures.
- Static generation executes a caller-selected entry module and writes a caller-selected output path without repository-root confinement in the inspected runner; execFile uses a fixed Node executable and an argument array rather than shell interpolation. — [packages/solid-ssr/static/index.js#L10-17](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid-ssr/static/index.js#L10-L17) [packages/solid-ssr/static/writeToDisk.js#L4-9](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid-ssr/static/writeToDisk.js#L4-L9)
- writeToDisk discards mkdir/writeFile callback errors and exits with status zero from the write callback; filesystem failures are not explicitly propagated by this source. — [packages/solid-ssr/static/writeToDisk.js#L4-11](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid-ssr/static/writeToDisk.js#L4-L11)
- The optional downloaded-test suite crosses network and shell boundaries, executes a downloaded project's tests, creates tarballs, and contains recursive cleanup operations; it is unsuitable for this read-only investigation. — [packages/test-integration/tests/downloaded.spec.ts#L24-58](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/test-integration/tests/downloaded.spec.ts#L24-L58) [packages/test-integration/tests/downloaded.spec.ts#L65-99](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/test-integration/tests/downloaded.spec.ts#L65-L99)
- Conditional exports are behavior-sensitive: Node core signals do not build the client dependency graph, and browser renderToString/renderToStream mocks only log unsupported-use errors. — [packages/solid/package.json#L45-80](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/package.json#L45-L80) [packages/solid/src/server/reactive.ts#L76-119](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/server/reactive.ts#L76-L119) [packages/solid/web/src/server-mock.ts#L2-39](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/web/src/server-mock.ts#L2-L39)
- Computations and cleanups created without an Owner receive development warnings that they will not be disposed/run; root ownership and disposal are explicit lifecycle responsibilities. — [packages/solid/src/reactive/signal.ts#L150-172](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/reactive/signal.ts#L150-L172) [packages/solid/src/reactive/signal.ts#L1016-1021](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/reactive/signal.ts#L1016-L1021) [packages/solid/src/reactive/signal.ts#L1467-1478](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/reactive/signal.ts#L1467-L1478)
- Client tests share runtime state because isolate:false is enabled; the transition regression explicitly resets scheduling after another suite's enableScheduling call, documenting cross-test scheduler coupling. — [packages/solid/vite.config.mjs#L23-28](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/vite.config.mjs#L23-L28) [packages/solid/web/test/transition.spec.tsx#L17-23](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/web/test/transition.spec.tsx#L17-L23)
- Unsafe-key handling must remain consistent across client store updates, server store updates, and reconcile: each has guards, and tests deliberately preserve constructor/prototype as final keys. — [packages/solid/store/src/store.ts#L263-305](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/store/src/store.ts#L263-L305) [packages/solid/store/src/server.ts#L40-79](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/store/src/server.ts#L40-L79) [packages/solid/store/src/modifiers.ts#L6-22](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/store/src/modifiers.ts#L6-L22) [packages/solid/store/test/store.spec.ts#L926-943](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/store/test/store.spec.ts#L926-L943)
- Server rendering duplicates escape and resolveSSRNode logic, with an explicit source comment calling out duplication from solid-js/web; the external server implementation was not available as tracked source here. — [packages/solid/src/server/rendering.ts#L33-47](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/server/rendering.ts#L33-L47) [packages/solid/src/server/rendering.ts#L88-104](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/server/rendering.ts#L88-L104) [packages/solid/web/server/server.ts#L1-1](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/web/server/server.ts#L1-L1)
- Server SuspenseList contains a TODO for revealOrder/tail and simply returns children after context handling, whereas the client implements reveal-order and tail policies. — [packages/solid/src/server/rendering.ts#L659-672](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/server/rendering.ts#L659-L672) [packages/solid/src/render/Suspense.ts#L49-87](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/src/render/Suspense.ts#L49-L87)
- SSR example documentation has drift: it advertises localhost:8080 and Lerna commands, while inspected Express examples use port 3000 and manifests supply direct Rollup/Node scripts. — [packages/solid-ssr/README.md#L52-56](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid-ssr/README.md#L52-L56) [packages/solid-ssr/examples/ssr/index.js#L7-23](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid-ssr/examples/ssr/index.js#L7-L23) [packages/solid-ssr/package.json#L21-29](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid-ssr/package.json#L21-L29)
- Hypothesis: an application exposing store range setters to unchecked input could hang on a zero or backward by value, because the inspected client/server loops increment i by by without validating progress. (inferred) — [packages/solid/store/src/store.ts#L319-325](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/store/src/store.ts#L319-L325) [packages/solid/store/src/server.ts#L93-99](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/store/src/server.ts#L93-L99)
- Hypothesis: renderer/compiler dependency changes can have a broad blast radius because DOM, SSR, tagged-template, hyperscript, and universal implementation adapters delegate to external expression packages; local adapters alone cannot establish their security properties. (inferred) — [package.json#L37-43](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/package.json#L37-L43) [packages/solid/web/src/client.ts#L1-1](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/web/src/client.ts#L1-L1) [packages/solid/web/server/server.ts#L1-1](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/solid/web/server/server.ts#L1-L1) [packages/babel-preset-solid/index.js#L1-7](https://github.com/solidjs/solid/blob/b25c557754f2ced0d86490e6dbfded9b1745b663/packages/babel-preset-solid/index.js#L1-L7)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)