Open-source headless commerce platform built with TypeScript, NestJS, React, and GraphQL
This report summarizes scanner evidence for vendurehq/vendure, a TypeScript project with 8,552 GitHub stars. SynthScan examined 618,263 lines of code across 4292 source files, recording 764 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 1.6 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 593 finding(s).
Are imports declared and package/API names verified? 117 finding(s).
Are wrappers, guards, and repeated structures necessary? 529 finding(s).
Which changes need focused human review? 764 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 764 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/docs/generate-graphql-docs.ts | 76 | function collectFieldReferencedTypes(field: GraphQLField<any, any>): Set<string> { | CODE |
| LOW | scripts/docs/generate-graphql-docs.ts | 96 | function collectTypeReferencedTypes(type: GraphQLObjectType | GraphQLInputObjectType): Set<string> { | CODE |
| LOW | scripts/docs/generate-graphql-docs.ts | 109 | function collectUnionReferencedTypes(type: GraphQLUnionType): Set<string> { | CODE |
| LOW | scripts/docs/generate-graphql-docs.ts | 319 | function renderQueryMutationFieldSDL(field: GraphQLField<any, any>, parentTypeName: 'Query' | 'Mutation'): string { | CODE |
| LOW | scripts/docs/generate-graphql-docs.ts | 338 | function renderGraphQLDocComponent(options: { | CODE |
| LOW | scripts/codegen/download-introspection-schema.ts | 56 | export async function downloadIntrospectionSchema(apiType: 'shop' | 'admin'): Promise<boolean> { | CODE |
| LOW | scripts/codegen/plugins/graphql-errors-plugin.ts | 193 | function getOperationsThatReturnErrorUnions(schema: GraphQLSchema, fields: GraphQLFieldMap<any, any>) { | CODE |
| LOW | scripts/changelogs/generate-changelog.ts | 57 | function generateChangelogForPackage() { | CODE |
| LOW | packages/telemetry-plugin/src/instrumentation.ts | 36 | export function getDefaultInstrumentations(): NonNullable<NodeSDKConfiguration['instrumentations']> { | CODE |
| LOW | …-plugins/multivendor-plugin/config/mv-order-process.ts | 118 | async function findOrderWithFulfillments(ctx: RequestContext, id: ID): Promise<Order> { | CODE |
| LOW | packages/dev-server/load-testing/load-test-config.ts | 16 | export function getMysqlConnectionOptions(databaseName: string) { | CODE |
| LOW | packages/dev-server/load-testing/load-test-config.ts | 29 | export function getPostgresConnectionOptions(databaseName: string) { | CODE |
| LOW | packages/dev-server/load-testing/init-load-test.ts | 299 | function generateProductDescription(): string { | CODE |
| LOW | …dev-server/load-testing/scripts/search-and-checkout.js | 61 | function setShippingAddressAndCustomer() { | CODE |
| LOW | packages/core/e2e/entity-hydrator.e2e-spec.ts | 468 | async function createOrderWithShippingLine() { | CODE |
| LOW | packages/core/e2e/shop-order.e2e-spec.ts | 2152 | function createCountryCodeShippingMethodInput(countryCode: string): CreateShippingMethodInput { | CODE |
| LOW | packages/core/e2e/product.e2e-spec.ts | 1811 | function getProductWithVariantsInLanguage( | CODE |
| LOW | packages/core/e2e/administrator.e2e-spec.ts | 520 | function getPasswordResetTokenPromise(): Promise<string> { | CODE |
| LOW | packages/core/e2e/order-modification.e2e-spec.ts | 955 | async function assertModifiedOrderIsPersisted(order: OrderWithModificationsFragment) { | CODE |
| LOW | packages/core/e2e/order-modification.e2e-spec.ts | 3149 | async function adminTransitionOrderToState(id: string, state: string) { | CODE |
| LOW | packages/core/e2e/order-modification.e2e-spec.ts | 3196 | async function createOrderAndTransitionToModifyingState( | CODE |
| LOW | packages/core/e2e/order-modification.e2e-spec.ts | 3204 | function getOrderPaymentsTotalWithRefunds(_order: OrderWithModificationsFragment) { | CODE |
| LOW | packages/core/e2e/order-promotion.e2e-spec.ts | 795 | async function assignPromotionToTaxIncludedChannel(promotionId: string | string[]) { | CODE |
| LOW | packages/core/e2e/order-promotion.e2e-spec.ts | 1656 | function logInAsRegisteredCustomer() { | CODE |
| LOW | packages/core/e2e/order-promotion.e2e-spec.ts | 1844 | function logInAsRegisteredCustomer() { | CODE |
| LOW | packages/core/e2e/order-promotion.e2e-spec.ts | 2184 | function logInAsRegisteredCustomer() { | CODE |
| LOW | packages/core/e2e/order-promotion.e2e-spec.ts | 2620 | async function createChannelAndAssignProducts(code: string, token: string) { | CODE |
| LOW | packages/core/e2e/session-api-type-binding.e2e-spec.ts | 630 | function expectForbiddenWithNullData(result: { data?: any; errors?: any[] }, field: string) { | CODE |
| LOW | …es/core/e2e/assign-to-channel-source-scope.e2e-spec.ts | 491 | async function loginAsVictimChannelAdmin() { | CODE |
| LOW | …ckages/core/e2e/migrate-asset-translations.e2e-spec.ts | 66 | async function simulatePreMigrationState() { | CODE |
| LOW | packages/core/e2e/custom-field-relations.e2e-spec.ts | 224 | function assertTranslatableCustomFieldValues(product: { customFields: any }) { | CODE |
| LOW | packages/core/e2e/custom-field-relations.e2e-spec.ts | 1983 | async function getProductsSortedBySingle(sortField: 'single' | 'singleId') { | CODE |
| LOW | packages/core/e2e/custom-field-relations.e2e-spec.ts | 2078 | async function createCollectionWithProducts(slug: string, productIds: string[], parentId?: string) { | CODE |
| LOW⚡ | packages/core/e2e/stock-control.e2e-spec.ts | 155 | async function getProductWithStockMovement(productId: string) { | CODE |
| LOW⚡ | packages/core/e2e/stock-control.e2e-spec.ts | 162 | async function getProductWithStockMovementByType(productId: string, type: StockMovementType) { | CODE |
| LOW⚡ | packages/core/e2e/stock-control.e2e-spec.ts | 167 | async function setFirstEligibleShippingMethod() { | CODE |
| LOW | packages/core/e2e/auth.e2e-spec.ts | 368 | async function createAdministratorWithPermissions( | CODE |
| LOW | …ages/core/e2e/stock-control-multi-location.e2e-spec.ts | 54 | async function getProductWithStockMovement(productId: string) { | CODE |
| LOW | …ages/core/e2e/stock-control-multi-location.e2e-spec.ts | 59 | async function setFirstEligibleShippingMethod() { | CODE |
| LOW | packages/core/e2e/custom-field-permissions.e2e-spec.ts | 290 | async function createAdminWithPermissions(input: { | CODE |
| LOW | …ges/core/e2e/settings-store-rw-permissions.e2e-spec.ts | 382 | async function createAdminWithPermissions(input: { | CODE |
| LOW | packages/core/e2e/order.e2e-spec.ts | 1111 | async function assertNoStockMovementsCreated(productId: string) { | CODE |
| LOW | packages/core/e2e/order.e2e-spec.ts | 2787 | async function getUnfulfilledOrderLineInput( | CODE |
| LOW | packages/core/e2e/collection.e2e-spec.ts | 1247 | async function createVariantNameFilteredCollection( | CODE |
| LOW | packages/core/e2e/customer.e2e-spec.ts | 762 | async function getVerifiedHistoryEntryCount(customerId: string): Promise<number> { | CODE |
| LOW | packages/core/e2e/list-query-builder.e2e-spec.ts | 1342 | function getTestEntityTranslations(testEntities: { items: any[] }) { | CODE |
| LOW⚡ | packages/core/e2e/shop-auth.e2e-spec.ts | 1128 | function getVerificationTokenPromise(): Promise<string> { | CODE |
| LOW⚡ | packages/core/e2e/shop-auth.e2e-spec.ts | 1136 | function getPasswordResetTokenPromise(): Promise<string> { | CODE |
| LOW⚡ | packages/core/e2e/shop-auth.e2e-spec.ts | 1144 | function getEmailUpdateTokenPromise(): Promise<{ | CODE |
| LOW | packages/core/e2e/authentication-strategy.e2e-spec.ts | 745 | async function authenticateInSecondChannel( | CODE |
| LOW | packages/core/e2e/draft-order.e2e-spec.ts | 483 | async function appliedDiscountDescriptions(): Promise<string[]> { | CODE |
| LOW | packages/core/e2e/sso-account-takeover.e2e-spec.ts | 592 | async function seedUnverifiedNativeCredentialOnSsoAccount() { | CODE |
| LOW | packages/core/e2e/order-cancel-shipping.e2e-spec.ts | 74 | async function createPaymentAuthorizedOrder() { | CODE |
| LOW | …ges/core/e2e/migrate-product-option-groups.e2e-spec.ts | 123 | async function simulatePreMigrationState() { | CODE |
| LOW | packages/core/e2e/default-search-plugin.e2e-spec.ts | 179 | async function testRelevanceSortingWithEmptySortObject(testProducts: TestProducts) { | CODE |
| LOW | packages/core/e2e/default-search-plugin.e2e-spec.ts | 208 | async function testMatchPartialSearchTerm(testProducts: TestProducts) { | CODE |
| LOW | packages/core/e2e/default-search-plugin.e2e-spec.ts | 261 | async function testMatchFacetValueFiltersAnd(testProducts: TestProducts) { | CODE |
| LOW | packages/core/e2e/default-search-plugin.e2e-spec.ts | 277 | async function testMatchFacetValueFiltersOr(testProducts: TestProducts) { | CODE |
| LOW | packages/core/e2e/default-search-plugin.e2e-spec.ts | 300 | async function testMatchFacetValueFiltersOrWithAnd(testProducts: TestProducts) { | CODE |
| LOW | packages/core/e2e/default-search-plugin.e2e-spec.ts | 320 | async function testMatchFacetValueFiltersWithFacetIdsOr(testProducts: TestProducts) { | CODE |
| 415 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ds/codemod/dashboard-ui/dashboard-ui-migration.spec.ts | 41 | // ─── asChild → render ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ds/codemod/dashboard-ui/dashboard-ui-migration.spec.ts | 234 | // ─── FormField → FormFieldWrapper ──────────────────────────────────── | COMMENT |
| MEDIUM | …ds/codemod/dashboard-ui/dashboard-ui-migration.spec.ts | 489 | // ─── Import consolidation ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …ds/codemod/dashboard-ui/dashboard-ui-migration.spec.ts | 778 | // ─── Accordion props ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ds/codemod/dashboard-ui/dashboard-ui-migration.spec.ts | 876 | // ─── Select items prop ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 20 | // ─── Typed hook helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 59 | // ─── Shared test factories ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 99 | // ─── themeVariablesPlugin ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 333 | // ─── transformIndexHtmlPlugin ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 416 | // ─── viteConfigPlugin ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 539 | // ─── dashboardMetadataPlugin ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 690 | // ─── hmrPlugin ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 778 | // ─── dashboardTailwindSourcePlugin ─────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 927 | // ─── bundleEntryPlugin (#4719) ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 927 | // ─── bundleEntryPlugin (#4719) ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 1004 | // ─── viteConfigPlugin: useExperimentalBundle (#4719) ───────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 1004 | // ─── viteConfigPlugin: useExperimentalBundle (#4719) ───────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/vite/tests/plugin-hooks.spec.ts | 1103 | // ─── filterActivePluginInfo ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/tests/sales/orders.spec.ts | 1514 | // ── Helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 59 | // ─── Scalar field types ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 82 | // ─── Nullable option select ────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 122 | // ─── Non-nullable field with a default ─────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 162 | // ─── Tab grouping ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 227 | // ─── Scalar save & persist ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 253 | // ─── String list (tag-style input) ─────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 318 | // ─── Struct (single) ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 411 | // ─── List inside struct ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ages/dashboard/e2e/tests/catalog/custom-fields.spec.ts | 450 | // ─── List of structs ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ard/e2e/tests/catalog/translation-placeholders.spec.ts | 95 | // ── Setup: add German to the channel's available languages ────────── | COMMENT |
| MEDIUM | …ard/e2e/tests/catalog/translation-placeholders.spec.ts | 174 | // ── Test 2: Slug placeholder ──────────────────────────────────────── | COMMENT |
| MEDIUM | …ard/e2e/tests/catalog/translation-placeholders.spec.ts | 189 | // ── Test 3: No placeholder on default language ────────────────────── | COMMENT |
| MEDIUM⚡ | …ard/e2e/tests/catalog/translation-placeholders.spec.ts | 207 | // ── Test 4: Placeholder hidden once user types a translation ──────── | COMMENT |
| MEDIUM⚡ | …ard/e2e/tests/catalog/translation-placeholders.spec.ts | 226 | // ── Test 5: Placeholder for rich text description ─────────────────── | COMMENT |
| MEDIUM | …ard/e2e/tests/catalog/translation-placeholders.spec.ts | 443 | // ── Cleanup: switch back to English ───────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 111 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 113 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 128 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 130 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 151 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 153 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 167 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 169 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 180 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 182 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 201 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 203 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 216 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 218 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 247 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/e2e/utils/crud-test-factory.ts | 249 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …src/lib/components/shared/asset/asset-upload-modal.tsx | 18 | // ─── Types ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …src/lib/components/shared/asset/asset-upload-modal.tsx | 46 | // ─── Pure helpers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …src/lib/components/shared/asset/asset-upload-modal.tsx | 96 | // ─── Component ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/dashboard/src/lib/graphql/api.ts | 154 | // ─── Upload with progress ─────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/dev-server/test-plugins/sso-auth-strategy.ts | 39 | if (data.email !== 'test@test.com') { | CODE |
| LOW | …t-reviews-list/all-product-reviews-list.component.html | 64 | <div class="placeholder"> | CODE |
| LOW | packages/core/e2e/settings-store.e2e-spec.ts | 69 | emailAddress: 'test@test.com', | CODE |
| LOW | packages/core/e2e/settings-store.e2e-spec.ts | 76 | await adminClient.asUserWithCredentials('test@test.com', 'password'); | CODE |
| LOW | packages/core/e2e/shop-order.e2e-spec.ts | 967 | emailAddress: 'test@test.com', | CODE |
| LOW | packages/core/e2e/shop-order.e2e-spec.ts | 980 | expect(customer.emailAddress).toBe('test@test.com'); | CODE |
| LOW | packages/core/e2e/shop-order.e2e-spec.ts | 987 | emailAddress: 'test@test.com', | CODE |
| LOW | packages/core/e2e/shop-order.e2e-spec.ts | 1000 | expect(customer.emailAddress).toBe('test@test.com'); | CODE |
| LOW | packages/core/e2e/shop-order.e2e-spec.ts | 1924 | emailAddress: 'test@test.com', | CODE |
| LOW | packages/core/e2e/shop-order.e2e-spec.ts | 1944 | emailAddress: 'test@test.com', | CODE |
| LOW | packages/core/e2e/administrator.e2e-spec.ts | 117 | emailAddress: 'test@test.com', | CODE |
| LOW | packages/core/e2e/custom-field-relations.e2e-spec.ts | 592 | emailAddress: "test@test.com" | CODE |
| LOW | packages/core/e2e/order-recalculation.e2e-spec.ts | 223 | phoneNumber: '555-0100', | CODE |
| LOW | packages/core/e2e/order-recalculation.e2e-spec.ts | 274 | input: { firstName: 'Test', lastName: 'User', emailAddress: 'test@test.com' }, | CODE |
| LOW | packages/core/e2e/order-recalculation.e2e-spec.ts | 412 | phoneNumber: '555-0100', | CODE |
| LOW | packages/core/e2e/sso-account-takeover.e2e-spec.ts | 302 | phoneNumber: '555-0100', | CODE |
| LOW | packages/core/e2e/sso-account-takeover.e2e-spec.ts | 324 | expect(pendingCustomer.phoneNumber).toBe('555-0100'); | CODE |
| LOW⚡ | packages/core/src/common/utils.spec.ts | 50 | expect(normalizeEmailAddress(' test@test.com ')).toBe('test@test.com'); | CODE |
| LOW⚡ | packages/core/src/common/utils.spec.ts | 55 | expect(normalizeEmailAddress('TEST@TEST.COM')).toBe('test@test.com'); | CODE |
| LOW⚡ | packages/core/src/common/utils.spec.ts | 64 | expect(normalizeEmailAddress('TEST@TEST.COM ')).toBe('test@test.com'); | CODE |
| LOW | …ice/helpers/utils/check-superadmin-credentials.spec.ts | 6 | const SAFE = { identifier: 'admin@example.com', password: 'a-very-long-random-passphrase' }; | CODE |
| LOW | …ice/helpers/utils/check-superadmin-credentials.spec.ts | 18 | { identifier: 'admin@example.com', password: 'superadmin' }, | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1001 | .setRecipient(() => 'test@test.com') | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1003 | .setOptionalAddressFields(() => ({ cc: 'foo@bar.com' })); | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1009 | expect(onSend.mock.calls[0][0].cc).toBe('foo@bar.com'); | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1016 | .setRecipient(() => 'test@test.com') | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1018 | .setOptionalAddressFields(() => ({ bcc: 'foo@bar.com' })); | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1024 | expect(onSend.mock.calls[0][0].bcc).toBe('foo@bar.com'); | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1031 | .setRecipient(() => 'test@test.com') | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1033 | .setOptionalAddressFields(() => ({ replyTo: 'foo@bar.com' })); | CODE |
| LOW⚡ | packages/email-plugin/src/plugin.spec.ts | 1039 | expect(onSend.mock.calls[0][0].replyTo).toBe('foo@bar.com'); | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 109 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 118 | expect(onSend.mock.calls[0][0].recipient).toBe('test@test.com'); | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 132 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 153 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 174 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 200 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 215 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 235 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 250 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 266 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 297 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 330 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 347 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 369 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 384 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 400 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 416 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 437 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 464 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 479 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 504 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 533 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 561 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 585 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 607 | expect(onSend.mock.calls[0][0].recipient).toBe('test@test.com'); | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 640 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 654 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 673 | .setRecipient(() => 'test@test.com') | CODE |
| LOW | packages/email-plugin/src/plugin.spec.ts | 692 | .setRecipient(() => 'test@test.com') | CODE |
| 54 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bunfig.toml | 1 | # Bun package manager configuration. | COMMENT |
| LOW | scripts/npm-stage-approve-all.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 21 | # | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 101 | # so it must be revoked before we can create the new dual-permission one — | COMMENT |
| LOW | …ue-1873/custom-fields/product-variant-custom-fields.ts | 1 | import type { CustomFieldConfig } from '@vendure/core'; | COMMENT |
| LOW | …ue-1873/custom-fields/product-variant-custom-fields.ts | 41 | type: 'relation', | COMMENT |
| LOW | …ue-1873/custom-fields/product-variant-custom-fields.ts | 61 | // eager: true, | COMMENT |
| LOW | …es/dev-server/test-plugins/reviews/dashboard/index.tsx | 101 | // query { | COMMENT |
| LOW | …es/dev-server/test-plugins/reviews/dashboard/index.tsx | 161 | label="My Custom Action" | COMMENT |
| LOW | …s/product-bundle-list/product-bundle-list.component.ts | 41 | > { | COMMENT |
| LOW | packages/core/e2e/entity-hydrator.e2e-spec.ts | 401 | // Before the fix, the second line's variant (the same shared instance) was | COMMENT |
| LOW | packages/core/e2e/channel.e2e-spec.ts | 121 | }, | COMMENT |
| LOW | packages/core/e2e/order-promotion.e2e-spec.ts | 1981 | // Capture the pre-payment total from one client. All clients have | COMMENT |
| LOW | packages/core/e2e/order-promotion.e2e-spec.ts | 2021 | COMMENT | |
| LOW | packages/core/src/package-dependencies.spec.ts | 1 | import fs from 'fs'; | COMMENT |
| LOW | packages/core/src/bootstrap.ts | 401 | COMMENT | |
| LOW | …core/src/service/helpers/entity-hydrator/merge-deep.ts | 61 | return { value: a, complete: false }; | COMMENT |
| LOW | …e/src/service/helpers/order-splitter/order-splitter.ts | 81 | .createQueryBuilder() | COMMENT |
| LOW | …vice/helpers/order-calculator/order-calculator.spec.ts | 1481 | }); | COMMENT |
| LOW | …vice/helpers/order-calculator/order-calculator.spec.ts | 1501 | // discountedLinePrice: order.lines[1].discountedLinePrice, | COMMENT |
| LOW | …rvice/helpers/translatable-saver/translation-differ.ts | 81 | ); | COMMENT |
| LOW | packages/core/src/service/services/order.service.ts | 1481 | // Re-fetch order if coupons were removed, so totals reflect recalculated prices | COMMENT |
| LOW | packages/core/src/service/services/customer.service.ts | 421 | // True when we are adding a native credential to a pre-existing account (e.g. SSO-only). In | COMMENT |
| LOW | …s/asset-server-plugin/src/package-dependencies.spec.ts | 1 | import fs from 'fs'; | COMMENT |
| LOW | packages/email-plugin/src/package-dependencies.spec.ts | 1 | import fs from 'fs'; | COMMENT |
| LOW | …ages/dashboard/scripts/translate/audit-translations.js | 61 | // Most script tables (REQUIRED_SCRIPTS, SCRIPT_RANGES, ALLOWED_SCRIPTS) | COMMENT |
| LOW | packages/dashboard/e2e/tests/settings/channels.spec.ts | 201 | await expect(lp.getRows().filter({ hasText: 'e2e-test-channel' })).toHaveCount(0); | COMMENT |
| LOW | …ckages/dashboard/e2e/tests/catalog/collections.spec.ts | 861 | // The debounced query then narrows the destination tree to the match. | COMMENT |
| LOW | …s/regression/issue-4155-nullable-custom-fields.spec.ts | 1 | import { type Page, expect, test } from '@playwright/test'; | COMMENT |
| LOW | …ion/issue-4729-alerts-do-not-poll-multi-plugin.spec.ts | 1 | import { expect, test } from '@playwright/test'; | COMMENT |
| LOW | packages/dashboard/src/vite-env.d.ts | 1 | /// <reference types="vite/client" /> | COMMENT |
| LOW | …/app/routes/_authenticated/_channels/channels_.$id.tsx | 141 | }) | COMMENT |
| LOW | …d/src/lib/framework/form-engine/use-generated-form.tsx | 181 | // Callers typically pass `setValues` as an inline arrow function, which | COMMENT |
| LOW | …d/src/lib/framework/form-engine/use-generated-form.tsx | 261 | // back empty, and `stripUntouchedTranslations` would then keep every seeded row (see its docs). | COMMENT |
| LOW | packages/dashboard/src/lib/providers/auth.tsx | 301 | // Clear any stale error from a previous logout attempt. Matches the | COMMENT |
| LOW | …/core/src/shared/components/chart/chart.component.scss | 1 | ::ng-deep { | COMMENT |
| LOW | …ared/components/rich-text-editor/prosemirror/keymap.ts | 21 | // :: (Schema, ?Object) → Object | COMMENT |
| LOW | …d/components/rich-text-editor/prosemirror/menu/menu.ts | 61 | COMMENT | |
| LOW | …d/components/rich-text-editor/prosemirror/menu/menu.ts | 81 | // | COMMENT |
| LOW | …d/components/rich-text-editor/prosemirror/menu/menu.ts | 101 | // | COMMENT |
| LOW | …c/shared/components/form-item/form-item.component.scss | 21 | // margin-top: calc(var(--space-unit) * 2); | COMMENT |
| LOW | packages/admin-ui/src/lib/static/polyfills.ts | 21 | /** IE9, IE10 and IE11 requires all of the following polyfills. **/ | COMMENT |
| LOW | …es/admin-ui/src/lib/static/styles/global/_clarity.scss | 21 | //Icons & Images | COMMENT |
| LOW | …es/admin-ui/src/lib/static/styles/global/_clarity.scss | 41 | //depends on variables.clarity, mixins.clarity, color.clarity, helpers.clarity, list-group.clarity, buttons.clarity | COMMENT |
| LOW | …es/admin-ui/src/lib/static/styles/global/_clarity.scss | 121 | COMMENT | |
| LOW | packages/create/src/create-vendure-app.ts | 501 | } | COMMENT |
| LOW | .github/workflows/typeorm_v1.yml | 1 | name: TypeORM v1 compatibility | COMMENT |
| LOW | .github/workflows/dependency_impact.yml | 1 | name: Dependency impact | COMMENT |
| LOW | .github/workflows/publish_to_npm.yml | 161 | # using the Trusted Publishing workflow for some reason. | COMMENT |
| LOW | .github/workflows/floating_deps_check.yml | 1 | name: Floating dependency check | COMMENT |
| LOW | .github/workflows/back_merge.yml | 1 | name: Back-merge | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/npm-trust-bulk.sh | 97 | # Step 1: find any existing trust entry and revoke it. | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 145 | # Step 2: create the new trust entry with both flags. | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 183 | # Step 3: require 2FA for any token/human publish. | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 362 | // Step 1: Customer logs in and adds an item to their order | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 369 | // Step 2: Log out and create a guest order with a different product | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 376 | // Step 3: Disable the product that owns variant T_5 (Curvy Monitor = product T_2). | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 383 | // Step 4: Attempt login — triggers mergeOrders with UseGuestStrategy. | COMMENT |
| LOW | packages/core/e2e/order-merge.e2e-spec.ts | 398 | // Step 5: The existing order should be preserved with its original line | COMMENT |
| LOW⚡ | packages/dashboard/.storybook/extract-jsdoc-plugin.js | 139 | // Step 1: Find the position of the component export | COMMENT |
| LOW⚡ | packages/dashboard/.storybook/extract-jsdoc-plugin.js | 148 | // Step 2: Look backward from the export to find the JSDoc comment immediately before it | COMMENT |
| LOW | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 40 | // Step 1: Compile and discover plugins (like the real build process does) | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 56 | // Step 2: Extract the package path from the discovered plugin | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 64 | // Step 3: Create linguiBabelPlugin with the discovered package | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 69 | // Step 4: Read the actual dashboard file that contains Lingui macros | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 79 | // Step 5: Transform the file using linguiBabelPlugin | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 83 | // Step 6: Verify the macros were transformed | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 134 | // Step 1: Create a draft order from the list page | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 141 | // Step 2: Set a customer — CustomerSelector uses Command/Popover | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 151 | // Step 3: Add a product variant — ProductVariantSelector uses Command/Popover | COMMENT |
| LOW | packages/dashboard/e2e/tests/sales/orders.spec.ts | 162 | // Step 4: Set shipping address — CustomerAddressSelector uses Popover with Card elements | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 173 | // Step 5: Select a shipping method — inline cards (not a popover) | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 183 | // Step 6: Complete the draft order | COMMENT |
| LOW | …/_authenticated/_orders/components/payment-details.tsx | 204 | {/* We need to check if there is errorMessage field in the Payment type */} | CODE |
| LOW | packages/create/src/helpers.ts | 748 | // Now we need to check if the docker daemon is running | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/npm-trust-bulk.sh | 97 | # Step 1: find any existing trust entry and revoke it. | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 145 | # Step 2: create the new trust entry with both flags. | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 183 | # Step 3: require 2FA for any token/human publish. | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 362 | // Step 1: Customer logs in and adds an item to their order | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 369 | // Step 2: Log out and create a guest order with a different product | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 376 | // Step 3: Disable the product that owns variant T_5 (Curvy Monitor = product T_2). | COMMENT |
| LOW⚡ | packages/core/e2e/order-merge.e2e-spec.ts | 383 | // Step 4: Attempt login — triggers mergeOrders with UseGuestStrategy. | COMMENT |
| LOW | packages/core/e2e/order-merge.e2e-spec.ts | 398 | // Step 5: The existing order should be preserved with its original line | COMMENT |
| LOW⚡ | packages/dashboard/.storybook/extract-jsdoc-plugin.js | 139 | // Step 1: Find the position of the component export | COMMENT |
| LOW⚡ | packages/dashboard/.storybook/extract-jsdoc-plugin.js | 148 | // Step 2: Look backward from the export to find the JSDoc comment immediately before it | COMMENT |
| LOW | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 40 | // Step 1: Compile and discover plugins (like the real build process does) | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 56 | // Step 2: Extract the package path from the discovered plugin | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 64 | // Step 3: Create linguiBabelPlugin with the discovered package | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 69 | // Step 4: Read the actual dashboard file that contains Lingui macros | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 79 | // Step 5: Transform the file using linguiBabelPlugin | COMMENT |
| LOW⚡ | packages/dashboard/vite/tests/lingui-npm-plugin.spec.ts | 83 | // Step 6: Verify the macros were transformed | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 134 | // Step 1: Create a draft order from the list page | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 141 | // Step 2: Set a customer — CustomerSelector uses Command/Popover | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 151 | // Step 3: Add a product variant — ProductVariantSelector uses Command/Popover | COMMENT |
| LOW | packages/dashboard/e2e/tests/sales/orders.spec.ts | 162 | // Step 4: Set shipping address — CustomerAddressSelector uses Popover with Card elements | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 173 | // Step 5: Select a shipping method — inline cards (not a popover) | COMMENT |
| LOW⚡ | packages/dashboard/e2e/tests/sales/orders.spec.ts | 183 | // Step 6: Complete the draft order | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | packages/mcp-plugin/e2e/shop-tools.e2e-spec.ts | 1714 | const standard = quotes.body.result.structuredContent.methods.find( | CODE |
| CRITICAL | packages/mcp-plugin/e2e/shop-tools.e2e-spec.ts | 2603 | const usOnly = quotes.body.result.structuredContent.methods.find( | CODE |
| CRITICAL | …uct-options-editor/product-options-editor.component.ts | 65 | this.optionGroups$ = this.route.snapshot.data.entity.pipe( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/ui-devkit/src/compiler/scaffold.ts | 277 | // copy scaffold | COMMENT |
| MEDIUM | packages/create/src/create-vendure-app.ts | 555 | // scaffold proceed against a broken schema. | COMMENT |
| MEDIUM | packages/create/src/helpers.ts | 601 | // resolve it as a transitive dep (npm/yarn/bun hoist, and the scaffold forces yarn's | COMMENT |
| MEDIUM | packages/create/src/create-vendure-app.spec.ts | 8 | // One object stands in for everything the scaffold requires from the new project: ts-node, | COMMENT |
| MEDIUM | packages/create/src/interactive-prompts.spec.ts | 60 | // for commander so the import runs an interactive (non --ci) scaffold of state.projectDir. | COMMENT |
| MEDIUM | packages/create/src/helpers.spec.ts | 524 | // so the scaffold works under either version. | COMMENT |
| MEDIUM | packages/create/src/helpers.spec.ts | 805 | // scaffold's TYPEORM_VERSION being updated to match. | COMMENT |
| MEDIUM | …s/create/src/scaffolded-config-storefront-port.spec.ts | 10 | // the probe makes the port the scaffold settles on deterministic, so these tests can assert | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …src/telemetry/collectors/system-info.collector.spec.ts | 35 | // Test a few combinations to ensure the function is robust | COMMENT |
| MEDIUM | packages/core/src/service/services/session.service.ts | 389 | // Using a query builder here because sessions utilize @TableInheritance, | COMMENT |
| MEDIUM | packages/dashboard/plugin/static-server.ts | 61 | // are numeric/UUID; list filters live in the query string). The structurally robust | COMMENT |
| MEDIUM | .github/workflows/typeorm_v1.yml | 32 | # The harness these jobs run through. Without it a change to the version | COMMENT |
| MEDIUM | .github/workflows/scripts/dashboard-tests.js | 84 | // Wait for dashboard elements to appear with a more robust approach | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/core/src/config/catalog/collection-filter.ts | 30 | * Here's a simple example of a custom CollectionFilter: | COMMENT |
| MEDIUM | packages/dashboard/.storybook/providers.tsx | 136 | * normally for demonstration purposes. | COMMENT |
| MEDIUM | …ard/src/lib/framework/form-engine/form-engine-types.ts | 181 | * Here's a simple example: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ample-plugins/multivendor-plugin/multivendor.plugin.ts | 45 | * ## Create a Seller | COMMENT |
| MEDIUM | packages/email-plugin/src/handler/event-handler.ts | 81 | * ## Defining a custom handler | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/npm-stage-approve-all.sh | 16 | # Usage: | COMMENT |
| LOW | scripts/npm-trust-bulk.sh | 27 | # Usage: | COMMENT |