# Risk map — TanStack/table

> Canonical page: https://codevetter.com/unpack/table/risk-map

# Risk map — TanStack/table

Scanned commit 23f21c194e6eba2e7f0321e817104d6e118d6141 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The strongest observed risks concern worker lifecycle and correctness, state publication, and example/tooling execution boundaries. These are source observations, not confirmed vulnerabilities or reproduced failures. Inspected core flows operate on application-provided data and callbacks; this investigation does not establish repository-wide authentication or network-service properties. CI definitions reveal a material ordering distinction between package release and browser auditing.
- The worker handle documents that automatic termination is not wired and that StrictMode double mounts/HMR can leak development workers. terminate resets tracked bridges explicitly, but the inspected React useTable implementation does not call it. — [packages/table-core/src/worker/createTableWorker.ts#L87-L99](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/createTableWorker.ts#L87-L99) [packages/table-core/src/worker/createTableWorker.ts#L119-L138](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/createTableWorker.ts#L119-L138) [packages/react-table/src/useTable.ts#L209-L227](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/react-table/src/useTable.ts#L209-L227)
- Worker processing requires matching thread-portable configuration and an offloaded upstream prefix. A missing upstream worker result can bypass main-thread processing; mismatch warnings are restricted to development. — [packages/table-core/src/worker/initTableWorker.ts#L32-L44](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/initTableWorker.ts#L32-L44) [packages/table-core/src/worker/createWorkerRowModel.ts#L62-L66](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/createWorkerRowModel.ts#L62-L66) [packages/table-core/src/worker/createWorkerRowModel.ts#L92-L109](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/createWorkerRowModel.ts#L92-L109)
- Worker errors mark the bridge failed, terminate its Worker, clear pending state, and stop subsequent synchronization while retaining last results. This creates an explicit stale-output mode requiring application attention rather than an automatic synchronous recomputation. — [packages/table-core/src/worker/createTableWorker.ts#L281-L297](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/createTableWorker.ts#L281-L297) [packages/table-core/src/worker/createTableWorker.ts#L321-L328](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/createTableWorker.ts#L321-L328) [packages/table-core/src/worker/createWorkerRowModel.ts#L79-L112](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/worker/createWorkerRowModel.ts#L79-L112)
- State publication and reference equality are high-impact coupling points: controlled expansion plus fresh data arrays previously sustained a render loop according to the regression harness. setStateSlice's owner-side guard and React's captured commit snapshot are deliberate protections to preserve. — [packages/react-table/tests/expandedAutoResetLoop.test.tsx#L15-L23](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/react-table/tests/expandedAutoResetLoop.test.tsx#L15-L23) [packages/table-core/src/utils.ts#L202-L247](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/utils.ts#L202-L247) [packages/react-table/src/useTable.ts#L191-L215](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/react-table/src/useTable.ts#L191-L215)
- User-provided row/column IDs reach caches and lookup dictionaries, including names such as __proto__. makeObjectMap and cloneState use defensive construction, and dedicated tests assert prototype-key behavior; these protections are a review boundary, not proof of universal input safety. — [packages/table-core/src/utils.ts#L34-L44](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/utils.ts#L34-L44) [packages/table-core/src/utils.ts#L75-L89](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/src/utils.ts#L75-L89) [packages/table-core/tests/implementation/prototypeSafeDictionaries.test.ts#L37-L44](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/tests/implementation/prototypeSafeDictionaries.test.ts#L37-L44) [packages/table-core/tests/implementation/prototypeSafeDictionaries.test.ts#L101-L122](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/packages/table-core/tests/implementation/prototypeSafeDictionaries.test.ts#L101-L122)
- Example theme persistence directly accesses localStorage/window without exception handling in ThemeProvider. The initializer validates stored strings, but browser storage availability and access failures are not handled in this inspected path. — [examples/react/kitchen-sink-shadcn-base/src/components/theme-provider.tsx#L23-L60](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/examples/react/kitchen-sink-shadcn-base/src/components/theme-provider.tsx#L23-L60)
- Inspected example Vite configs allow all hosts, while E2E infrastructure reads example manifests/configs and may spawn pnpm exec vite with inherited environment and process-group cleanup. These are development execution boundaries; the programmatic test server explicitly binds loopback. — [examples/alpine/realtime-trading/vite.config.ts#L1-L2](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/examples/alpine/realtime-trading/vite.config.ts#L1-L2) [examples/octane/basic-external-state/vite.config.ts#L4-L9](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/examples/octane/basic-external-state/vite.config.ts#L4-L9) [tests/e2e/helpers/startExampleServer.ts#L39-L90](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/tests/e2e/helpers/startExampleServer.ts#L39-L90) [tests/e2e/helpers/startExampleServer.ts#L135-L160](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/tests/e2e/helpers/startExampleServer.ts#L135-L160)
- Release grants contents/id-token/pull-request write permissions and invokes Changesets before the dependent E2E audit. Browser failures can therefore be discovered after publication; the inspected PR test command has no explicit E2E step. — [.github/workflows/release.yml#L18-L46](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/.github/workflows/release.yml#L18-L46) [.github/workflows/release.yml#L56-L75](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/.github/workflows/release.yml#L56-L75) [.github/workflows/pr.yml#L40-L44](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/.github/workflows/pr.yml#L40-L44) [package.json#L46-L46](https://github.com/TanStack/table/blob/23f21c194e6eba2e7f0321e817104d6e118d6141/package.json#L46-L46)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)