Skip to content

[@mantine/hooks] use-list-state: Guard missing reorder and swap indices - #9399

Open
lfhwnqe wants to merge 1 commit into
mantinedev:masterfrom
lfhwnqe:fix/list-state-ignore-missing-indices
Open

lfhwnqe wants to merge 1 commit into
mantinedev:masterfrom
lfhwnqe:fix/list-state-ignore-missing-indices

Conversation

@lfhwnqe

@lfhwnqe lfhwnqe commented Nov 10, 2026

Copy link
Copy Markdown

What is the problem?

A reorder event with an out-of-range source index can insert an undefined item and change the list length. A swap with a missing index can overwrite a valid item. This can occur when a handler receives indices from an earlier list state.

What does this change?

Ignore reorders whose source is missing and swaps with either index missing. Valid reorders retain the existing splice behavior for the destination.

Validation

Both regressions fail on master. All 18 hook tests and targeted formatting and lint passed. The repository build passed during verification. Full typecheck reached an implicit-any error in the docs sponsor component.

AI disclosure: OpenAI Codex assisted with implementation, verification, and review.

@agammann agammann left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add a fractional-index regression case, such as reorder({ from: 0.5, to: 0 }) or swap({ from: 0, to: 0.5 })? Number.isInteger is a distinct new part of isListIndex, and the old code coerces fractional indices in splice or writes a non-index array property, so a fractional input can corrupt the list just as a missing index can. The current tests exercise the bounds checks but would still pass if the integer check were removed. I reviewed the diff; I did not run tests locally.

@rtivital rtivital added the ? label Nov 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants