CodeVetter · Repo Unpack · Risk map
pmndrs/valtio
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The inspected core primarily manages in-process state; external trust boundaries appear in DevTools messages, browser camera/storage adapters, and documentation compilation. Identity, snapshot descriptors, global internal customization, and dependency-version drift are major correctness boundaries. Missing execution evidence leaves configured tests and deployment compatibility unresolved.
- DevTools is a state-write and state-export boundary: it sends snapshots to an extension and Object.assigns parsed ACTION/jump/import data into live proxies. ACTION parsing is caught, but jump-state parsing is outside that catch; enabled:true can override production-default disablement.
- The docs pipeline assumes trusted repository content: bundleMDX compiles source/imports, oEmbed processing accepts returned HTML, and getMDXComponent constructs executable components. Slugs are statically enumerated with fallback:false, so the inspected route is not an arbitrary public file-read endpoint.
- Photo-booth persistence writes are not awaited or caught in the store subscription, restored images are assigned without schema validation, and camera failure is only logged. Its startMediaStream implementation assigns srcObject without a stream-stop cleanup.
- Hypothesis: cyclic input can overflow deepClone's un-memoized recursion; self-referential Map/Set input can similarly recurse in unstable_deepProxy because collection branches run before memo lookup/registration. Inspected deepClone tests cover ordinary containers, and deepProxy cycle cases cover ordinary objects rather than cyclic collections. (inferred)
- Internal customization has runtime-wide blast radius: unstable_replaceInternalFunction replaces shared factories/comparators, unstable_enableOp changes shared operation generation, and ref(existingProxy) marks that proxy identity globally rather than just one parent property.
- Snapshot immutability has deliberate limits: properties are non-writable but configurable and containers remain extensible; ref values remain shared references. Separately, useSnapshot on a captured child continues observing that identity after its parent replaces the child.
- Documentation and application versions drift: subscribe-ops documents resolve/reject operations although the source Op type only contains set/delete; architecture notes describe promise unwrapping despite the v2 migration guide removing it. The website requests valtio ^1.5.2, and the Map todo uses legacy react-dom render with React 18 dependencies.
- Production-specific behavior has a configured validation gap: the artifact matrix includes development only and marks production cases skipped; the inspected main workflow runs root tests/build, whose type and lint boundaries exclude website/example source.