pmndrs/zustand

The material boundaries inspected are persisted data, browser-extension messages, server store ownership, and synchronous update propagation. These are source observations and explicitly identified hypotheses, not confirmed vulnerabilities. Packaging and examples also expose verification limits; the bounded inspection does not establish whole-repository absence of other sensitive paths.

• The persistence default writes the whole state to localStorage through JSON serialization; applications must use partialize or an appropriate adapter when state contains data that should not be stored there.
  src/middleware/persist.ts#L187-L198src/middleware/persist.ts#L221-L226src/middleware/persist.ts#L56-L58
• Stored JSON is parsed and type-asserted without runtime schema validation; default hydration spreads persisted values over current state, so validation and domain-specific merge behavior belong at the adapter/migration/merge boundary.
  src/middleware/persist.ts#L43-L54src/middleware/persist.ts#L102-L110src/middleware/persist.ts#L193-L196src/middleware/persist.ts#L302-L307
• Persistence updates live state before setItem; a serialization or storage-write failure occurs after the in-memory update, with no rollback in these wrappers.
  src/middleware/persist.ts#L221-L239src/middleware/persist.ts#L56-L57
• Hydration generations prevent stale hydration application, but default merge still overwrites concurrent edits to stored keys; the test titled 'should not overwrite user state changes' actually expects count 100 to become 42.
  src/middleware/persist.ts#L193-L196src/middleware/persist.ts#L297-L307tests/persistAsync.test.tsx#L981-L1020
• DevTools receives full state snapshots and accepts incoming state-changing messages; production-default disabling and JSON parse error handling do not provide application-state schema validation.
  src/middleware/devtools.ts#L198-L209src/middleware/devtools.ts#L230-L243src/middleware/devtools.ts#L317-L345src/middleware/devtools.ts#L426-L436
• The Next.js guide requires per-request stores and warns against RSC access to shared stores; unstable_ssrSafe rejects SSR writes but does not itself create request isolation.
  docs/learn/guides/nextjs.md#L15-L35src/middleware/ssrSafe.ts#L13-L23
• Hypothesis: a throwing synchronous listener can interrupt later listener notifications after state has already changed, because setState calls listeners.forEach without per-listener exception isolation. (inferred)
  src/vanilla.ts#L73-L79
• Verification limits include a development-only built-package matrix and root checks that exclude examples; demo declares Zustand ^4.3.9 while the library is 5.0.15, so its behavior cannot establish current-source parity.
  .github/workflows/test-multiple-builds.yml#L17-L19eslint.config.mjs#L11-L12tsconfig.json#L23-L24examples/demo/package.json#L25-L28