CodeVetter · Repo Unpack · Risk map
TanStack/table
The strongest observed risks concern worker lifecycle and correctness, state publication, and example/tooling execution boundaries. These are source observations, not confirmed vulnerabilities or reproduced failures. Inspected core flows operate on application-provided data and callbacks; this investigation does not establish repository-wide authentication or network-service properties. CI definitions reveal a material ordering distinction between package release and browser auditing.
- The worker handle documents that automatic termination is not wired and that StrictMode double mounts/HMR can leak development workers. terminate resets tracked bridges explicitly, but the inspected React useTable implementation does not call it.
- Worker processing requires matching thread-portable configuration and an offloaded upstream prefix. A missing upstream worker result can bypass main-thread processing; mismatch warnings are restricted to development.
- Worker errors mark the bridge failed, terminate its Worker, clear pending state, and stop subsequent synchronization while retaining last results. This creates an explicit stale-output mode requiring application attention rather than an automatic synchronous recomputation.
- State publication and reference equality are high-impact coupling points: controlled expansion plus fresh data arrays previously sustained a render loop according to the regression harness. setStateSlice's owner-side guard and React's captured commit snapshot are deliberate protections to preserve.
- User-provided row/column IDs reach caches and lookup dictionaries, including names such as __proto__. makeObjectMap and cloneState use defensive construction, and dedicated tests assert prototype-key behavior; these protections are a review boundary, not proof of universal input safety.
- Example theme persistence directly accesses localStorage/window without exception handling in ThemeProvider. The initializer validates stored strings, but browser storage availability and access failures are not handled in this inspected path.
- Inspected example Vite configs allow all hosts, while E2E infrastructure reads example manifests/configs and may spawn pnpm exec vite with inherited environment and process-group cleanup. These are development execution boundaries; the programmatic test server explicitly binds loopback.
- Release grants contents/id-token/pull-request write permissions and invokes Changesets before the dependent E2E audit. Browser failures can therefore be discovered after publication; the inspected PR test command has no explicit E2E step.