CodeVetter
← All unpacks
CodeVetter · Repo Unpack evidence

TanStack/table

Scanned commit 23f21c194e dated 2026-10-01 — last upstream commit. Generated by codevetter 1.15.0 on 2026-10-02.

github.com/TanStack/table ↗ · 4000 files · 13.8 MB · scan capped

Become a Sponsor! TanStack Table [!NOTE] You may know TanStack Table by the adapter names: - Angular Table - Lit Table - Octane Table - Preact Table - React Table - Solid Table - Svelte Table - Vue Table - Alpine Table - Ember Table A headless table library fo

Deep analysis by cli:codex via the codex CLI on 2026-10-02 (444s) — every claim below links to its cited source files. Source inspection; upstream code and tests were not executed.

Overview

TanStack Table is a headless TypeScript datagrid library for developers who want to own their markup and styling while reusing table behavior across ten framework adapters. At commit 23f21c194e6eba2e7f0321e817104d6e118d6141, its v9 architecture combines explicitly registered features, replaceable row-model factories, and atom-based state ownership. The repository also contains framework examples, development inspection panels, and an experimental Web Worker pipeline; it is principally a collection of published libraries rather than one deployed application.

System map

The system centers on a framework-independent table engine, with adapters supplying rendering and reactivity integration. Table state resides in an atom graph, while row-model factories derive the data presented to renderers. Workers and devtools introduce separate execution and inspection boundaries without turning the core into a backend service. Distribution uses workspace packages with explicit ESM exports, and examples provide independently runnable application surfaces.

Feature catalog

Features are developer-facing APIs that applications turn into controls and rendered grids. The stock registry includes table transformations, column management, row interaction, and spreadsheet-style cell behavior. Examined examples add virtualization, asynchronous query ownership, and worker processing around those APIs. This catalog describes the inspected feature families and examples; the supplied inventory and this investigation are bounded.

Data flow

Applications supply row data, column definitions, feature configuration, and optional external state owners. Construction turns configuration into effective state atoms and feature APIs; row-model reads then derive renderer-facing rows. Updates pass through owner-specific callbacks rather than a durable storage layer in the inspected core. Additional boundaries include worker message transfer, example query caches, and example-owned browser persistence.

Behavior traces

The source walks cover startup, a sorting action, worker processing, asynchronous query pagination, and browser preference persistence. These traces name execution order and retain important bypass and fallback conditions. They describe code behavior without asserting that a browser session or test run reproduced it.

Testing signals

Tests and CI were inspected, not executed; no passing result or coverage percentage is asserted. Examined suites span core semantics, React integration, worker protocol bookkeeping, declaration generation, and browser examples. Coverage configuration is report-only, and the inspected browser configuration targets Desktop Chrome. Inspection was selective, so coverage omissions below describe limits of particular checks rather than whole-repository absence.

Risk map

The strongest observed risks concern worker lifecycle and correctness, state publication, and example/tooling execution boundaries. These are source observations, not confirmed vulnerabilities or reproduced failures. Inspected core flows operate on application-provided data and callbacks; this investigation does not establish repository-wide authentication or network-service properties. CI definitions reveal a material ordering distinction between package release and browser auditing.

Extension points

Customization is explicit and predominantly configured per table. The features object combines runtime modules, row-model factories, function registries, and type-only metadata while retaining their distinct roles. Framework adapters provide a reactivity contract, and React's hook factory binds application components and contexts. Worker processing and devtools expose additional public integration seams.

Contributor handoff

Begin with contribution rules, then follow the affected feature from example controls into core utilities and adapter publication. Core changes have cross-framework reach, so distinguish algorithm behavior from framework scheduling and rendering contracts. Tests and CI were inspected, not executed in this audit; future execution requires a separately authorized environment. The inventory and investigation are bounded, and source comments or configured checks must not be reported as runtime verification.

Languages

LanguageFilesShare of source
TypeScript312580%
Markdown1398docs/config
JSON1311docs/config
HTML447docs/config
CSS406docs/config
JavaScript3168%
Svelte2887%
Vue1855%

Start reading here

Probable source entrypoint: packages/ — inferred from the directory tree and manifest, not the upstream docs.

Source roots

packages/ (691 files)

Repository structure

Top-level pathFiles
examples/1991
docs/1262
packages/691
scripts/12
.github/10
_artifacts/3
tests/2
.changeset/1

Docs found: AGENTS.mdCONTRIBUTING.mdREADME.mddocs/agent-skills.mddocs/devtools.mddocs/framework/alpine/guide/aggregation.mddocs/framework/alpine/guide/cell-selection.mddocs/framework/alpine/guide/cell-spanning.mddocs/framework/alpine/guide/column-faceting.mddocs/framework/alpine/guide/column-filtering.md

Package

package.json — table, 29 declared dependencies.

@changesets/changelog-github@changesets/cli@faker-js/faker@playwright/test@size-limit/preset-small-lib@tanstack/eslint-config@tanstack/intent@tanstack/typedoc-config@testing-library/jest-dom@types/node@typescript-eslint/parser@vitest/coverage-v8

CI & config entrypoints

Structural health signals

Average score 6.4/10 across 96 analyzed source files; 58 hotspots surfaced.

These are deterministic review leads — size, churn, and structural signals — not proof of a bug in this project.

Recent history