# Risk map — typescript-eslint/typescript-eslint

> Canonical page: https://codevetter.com/unpack/typescript-eslint/risk-map

# Risk map — typescript-eslint/typescript-eslint

Scanned commit effa652828afba0aa730f106cb326c54a97ccfb5 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities or reproduced failures. Sensitive boundaries include filesystem-backed compiler services, third-party browser code, shell-based integration tooling, and privileged workflow artifacts. Several playground call sites expose concrete inconsistencies suitable for targeted verification. Compiler internals and process-wide caches also require compatibility-focused review.
- ProjectService inherits tsserver.sys filesystem access and stubs watchers rather than confining reads to the repository; TypeScript plugin loading is blocked by default but can be enabled, and a custom host is supported. — [packages/project-service/src/createProjectService.ts#L82-92](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/project-service/src/createProjectService.ts#L82-L92) [packages/project-service/src/createProjectService.ts#L124-145](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/project-service/src/createProjectService.ts#L124-L145)
- throttleOpenedFileCleanup replaces undocumented cleanup methods and openClientFileWithNormalizedPath; compatibility depends on TypeScript internal method names and signatures, while inspected tests use a fake service. — [packages/project-service/src/throttleOpenedFileCleanup.ts#L5-30](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/project-service/src/throttleOpenedFileCleanup.ts#L5-L30) [packages/project-service/src/throttleOpenedFileCleanup.ts#L35-52](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/project-service/src/throttleOpenedFileCleanup.ts#L35-L52) [packages/project-service/tests/throttleOpenedFileCleanup.test.ts#L13-32](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/project-service/tests/throttleOpenedFileCleanup.test.ts#L13-L32)
- The playground executes an external loader script and loads Monaco/sandbox code from TypeScript-hosted domains; loadSandbox handles HEAD/module failures but its inspected implementation installs no script onerror handler. — [packages/website/src/components/editor/loadSandbox.ts#L18-60](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/website/src/components/editor/loadSandbox.ts#L18-L60)
- Potential fix-action failure: LoadedEditor passes editor.getValue() to triggerFix, but triggerFix treats that argument as a filename and reads it from the virtual filesystem; ordinary source text therefore appears unable to select the input file. (inferred) — [packages/website/src/components/editor/LoadedEditor.tsx#L230-246](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/website/src/components/editor/LoadedEditor.tsx#L230-L246) [packages/website/src/components/linter/createLinter.ts#L138-150](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/website/src/components/linter/createLinter.ts#L138-L150)
- applyEslintConfig pushes resolved presets into a persistent eslintExtendedConfig array without clearing it on configuration changes; the watcher repeatedly calls this function before relinting. — [packages/website/src/components/linter/createLinter.ts#L80-84](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/website/src/components/linter/createLinter.ts#L80-L84) [packages/website/src/components/linter/createLinter.ts#L159-182](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/website/src/components/linter/createLinter.ts#L159-L182) [packages/website/src/components/linter/createLinter.ts#L238-249](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/website/src/components/linter/createLinter.ts#L238-L249)
- Local-state restoration checks fileType against the literal 'true' although the writer stores newState.fileType; sourceType is written but not restored by the inspected reader, and localStorage.setItem is outside a try/catch. — [packages/website/src/components/hooks/useHashState.ts#L142-190](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/website/src/components/hooks/useHashState.ts#L142-L190)
- Apply Review Labels runs with pull-requests:write, downloads review-intent from a completed workflow, appends its contents directly to GITHUB_OUTPUT, and uses the resulting pr_number/intent outputs for label actions; the artifact boundary deserves validation review. — [.github/workflows/sync-review-labels.yml#L15-40](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/.github/workflows/sync-review-labels.yml#L15-L40) [.github/workflows/sync-review-labels.yml#L42-64](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/.github/workflows/sync-review-labels.yml#L42-L64) [.github/workflows/on-review-status-change.yml#L28-43](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/.github/workflows/on-review-status-change.yml#L28-L43)
- Integration execution writes beneath os.tmpdir() or the home-directory fallback, packs packages and installs dependencies with shell-enabled child processes; it is materially broader than a read-only source check. — [packages/integration-tests/tools/pack-packages.ts#L12-43](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/integration-tests/tools/pack-packages.ts#L12-L43) [packages/integration-tests/tools/pack-packages.ts#L90-94](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/integration-tests/tools/pack-packages.ts#L90-L94) [packages/integration-tests/tools/pack-packages.ts#L126-163](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/integration-tests/tools/pack-packages.ts#L126-L163) [packages/integration-tests/tools/integration-test-base.ts#L34-49](https://github.com/typescript-eslint/typescript-eslint/blob/effa652828afba0aa730f106cb326c54a97ccfb5/packages/integration-tests/tools/integration-test-base.ts#L34-L49)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)