fix: add checks to dictionaries for ssr by KevinVandy · Pull Request #6338 · TanStack/table

KevinVandy · 2026-06-20T20:18:33Z

🎯 Changes

✅ Checklist

I have followed the steps in the Contributing guide.
I have tested this code locally with pnpm test:pr.

Summary by CodeRabbit

Bug Fixes
- Improved handling of edge-case column and row identifiers that match JavaScript reserved property names (e.g., __proto__, constructor), ensuring reliable behavior in all scenarios.
Tests
- Added comprehensive test coverage for prototype-safe dictionary key handling across row and column models.

coderabbitai · 2026-06-20T20:18:47Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e80f3371-663a-4b89-b117-e9a0f923fc51

📥 Commits

Reviewing files that changed from the base of the PR and between dde8248 and 84568d3.

📒 Files selected for processing (21)

examples/angular/custom-plugin/src/app/density/density-feature.ts
examples/preact/custom-plugin/src/main.tsx
examples/react/custom-plugin/src/main.tsx
packages/table-core/src/core/columns/coreColumnsFeature.utils.ts
packages/table-core/src/core/row-models/createCoreRowModel.ts
packages/table-core/src/core/rows/constructRow.ts
packages/table-core/src/core/rows/coreRowsFeature.utils.ts
packages/table-core/src/features/column-filtering/columnFilteringFeature.ts
packages/table-core/src/features/column-filtering/createFilteredRowModel.ts
packages/table-core/src/features/column-filtering/filterRowsUtils.ts
packages/table-core/src/features/column-grouping/columnGroupingFeature.ts
packages/table-core/src/features/column-grouping/columnGroupingFeature.utils.ts
packages/table-core/src/features/column-grouping/createGroupedRowModel.ts
packages/table-core/src/features/column-resizing/columnResizingFeature.utils.ts
packages/table-core/src/features/column-sizing/columnSizingFeature.utils.ts
packages/table-core/src/features/column-visibility/columnVisibilityFeature.utils.ts
packages/table-core/src/features/row-expanding/rowExpandingFeature.utils.ts
packages/table-core/src/features/row-selection/rowSelectionFeature.utils.ts
packages/table-core/src/features/row-sorting/createSortedRowModel.ts
packages/table-core/src/utils.ts
packages/table-core/tests/implementation/prototypeSafeDictionaries.test.ts

📝 Walkthrough

Walkthrough

Adds two new utilities — makeObjectMap (creates null-prototype objects via Object.create(null)) and hasOwn (safe own-property check via Object.prototype.hasOwnProperty.call) — and propagates them as replacements for {} literals and .hasOwnProperty calls across every internal lookup map, cache, and state object in table-core. A new test suite verifies prototype-named column and row IDs work correctly end-to-end. Three density plugin examples also update to cast table.options to TableOptions_Density before invoking onDensityChange.

Changes

Prototype-safe dictionary refactor

Layer / File(s)	Summary
New `makeObjectMap` and `hasOwn` utilities `packages/table-core/src/utils.ts`	Exports `makeObjectMap<TValue>()` (returns `Object.create(null)`) and `hasOwn(obj, key)` (calls `Object.prototype.hasOwnProperty.call`). Updates `cloneState` to use null-prototype destination objects and `Object.defineProperty` when cloning null-prototype sources.
Row construction and core row/column lookup maps `packages/table-core/src/core/rows/constructRow.ts`, `packages/table-core/src/core/rows/coreRowsFeature.utils.ts`, `packages/table-core/src/core/columns/coreColumnsFeature.utils.ts`, `packages/table-core/src/core/row-models/createCoreRowModel.ts`	Row `_valuesCache`/`_uniqueValuesCache`, `rowsById`, `getAllFlatColumnsById`/`getAllLeafColumnsById` result maps, and `row_getAllCellsByColumnId` output all switch from `{}` to `makeObjectMap()`. Cache presence checks in `row_getValue` and `row_getUniqueValues` switch from `.hasOwnProperty` to `hasOwn`.
Column feature lookup maps: filtering, grouping, sizing, visibility, resizing `packages/table-core/src/features/column-filtering/...`, `packages/table-core/src/features/column-grouping/...`, `packages/table-core/src/features/column-sizing/...`, `packages/table-core/src/features/column-visibility/...`, `packages/table-core/src/features/column-resizing/...`	All per-row and per-column maps (`columnFilters`, `columnFiltersMeta`, `newFilteredRowsById`, `_groupingValuesCache`, `groupedRowsById`, `getDefaultColumnSizingState`, `column_resetSize`, `table_resetColumnSizing`, visibility state maps) migrate from `{}` to `makeObjectMap()`. Property access guards switch from `.hasOwnProperty` to `hasOwn`.
Row feature lookup maps: expanding, selection, sorting `packages/table-core/src/features/row-expanding/rowExpandingFeature.utils.ts`, `packages/table-core/src/features/row-selection/rowSelectionFeature.utils.ts`, `packages/table-core/src/features/row-sorting/createSortedRowModel.ts`	Expanding, selection, and sorting state/lookup maps all switch to `makeObjectMap()`. New `isExpandedRowId` and `isRowIdSelected` helpers use `hasOwn` for safe membership checks. Bulk-toggle and reset APIs use `Object.assign(makeObjectMap(), ...)` instead of `{ ...old }` spreads.
Prototype-safe dictionary test suite `packages/table-core/tests/implementation/prototypeSafeDictionaries.test.ts`	New test file validates that prototype-named column IDs (`hasOwnProperty`, `toString`, `__proto__`, etc.) and row IDs produce null-prototype maps with correct own-key presence, correct cached values, and correct filter/sort/group/select results.

Density plugin type-cast fix in examples

Layer / File(s)	Summary
Density `onDensityChange` type-cast `examples/angular/custom-plugin/src/app/density/density-feature.ts`, `examples/preact/custom-plugin/src/main.tsx`, `examples/react/custom-plugin/src/main.tsx`	`setDensity` and `toggleDensity` in all three example apps now cast `table.options` to `TableOptions_Density` before invoking the optional `onDensityChange` callback.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

TanStack/table#6268: Modifies the same constructRow, table_getAllFlatColumnsById, and table_getAllLeafColumnsById code paths that this PR converts to makeObjectMap.
TanStack/table#6305: Modifies the same density plugin table_setDensity/table_toggleDensity call sites that this PR updates with TableOptions_Density type casts.

Poem

🐇 A rabbit once hopped through a prototype chain,
And found __proto__ was causing great pain.
With Object.create(null) I'll build you a map,
Where hasOwn guards every key on the trap.
No more prototype tricks — the table stands tall,
Safe dictionaries for columns and rows, one and all! 🗺️

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.51% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'fix: add checks to dictionaries for ssr' is vague and does not clearly convey the main changes in the PR, which involve introducing prototype-safe dictionary utilities (makeObjectMap, hasOwn) and updating numerous files to use them consistently.	Consider a more descriptive title such as 'fix: ensure prototype-safe dictionary handling for SSR compatibility' or 'fix: add null-prototype dictionaries and hasOwn checks for SSR' to better reflect the core changes.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ssr-prototype-safer

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nx-cloud · 2026-06-20T20:19:02Z

View your CI Pipeline Execution ↗ for commit 84568d3

Command	Status	Duration	Result
`nx affected --targets=test:eslint,test:sherif,t...`	✅ Succeeded	5m 17s	View ↗
`nx run-many --targets=build --exclude=examples/**`	✅ Succeeded	24s	View ↗

☁️ Nx Cloud last updated this comment at 2026-06-20 20:25:08 UTC

pkg-pr-new · 2026-06-20T20:21:15Z

More templates

@tanstack/angular-table

npm i https://pkg.pr.new/TanStack/table/@tanstack/angular-table@6338

@tanstack/angular-table-devtools

npm i https://pkg.pr.new/TanStack/table/@tanstack/angular-table-devtools@6338

@tanstack/lit-table

npm i https://pkg.pr.new/TanStack/table/@tanstack/lit-table@6338

@tanstack/match-sorter-utils

npm i https://pkg.pr.new/TanStack/table/@tanstack/match-sorter-utils@6338

@tanstack/preact-table

npm i https://pkg.pr.new/TanStack/table/@tanstack/preact-table@6338

@tanstack/preact-table-devtools

npm i https://pkg.pr.new/TanStack/table/@tanstack/preact-table-devtools@6338

@tanstack/react-table

npm i https://pkg.pr.new/TanStack/table/@tanstack/react-table@6338

@tanstack/react-table-devtools

npm i https://pkg.pr.new/TanStack/table/@tanstack/react-table-devtools@6338

@tanstack/solid-table

npm i https://pkg.pr.new/TanStack/table/@tanstack/solid-table@6338

@tanstack/solid-table-devtools

npm i https://pkg.pr.new/TanStack/table/@tanstack/solid-table-devtools@6338

@tanstack/svelte-table

npm i https://pkg.pr.new/TanStack/table/@tanstack/svelte-table@6338

@tanstack/table-core

npm i https://pkg.pr.new/TanStack/table/@tanstack/table-core@6338

@tanstack/table-devtools

npm i https://pkg.pr.new/TanStack/table/@tanstack/table-devtools@6338

@tanstack/vue-table

npm i https://pkg.pr.new/TanStack/table/@tanstack/vue-table@6338

@tanstack/vue-table-devtools

npm i https://pkg.pr.new/TanStack/table/@tanstack/vue-table-devtools@6338

commit: 84568d3

fix: add checks to dictionaries for ssr

84568d3

KevinVandy merged commit f237e20 into beta Jun 20, 2026
8 checks passed

KevinVandy deleted the ssr-prototype-safer branch June 20, 2026 20:25

KevinVandy mentioned this pull request Jun 20, 2026

fix(table-core): prototype-named column ids poisoning row value caches #6337

Open

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: add checks to dictionaries for ssr#6338

fix: add checks to dictionaries for ssr#6338
KevinVandy merged 1 commit into
betafrom
ssr-prototype-safer

KevinVandy commented Jun 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

nx-cloud Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jun 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

KevinVandy commented Jun 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Changes

✅ Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

nx-cloud Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

KevinVandy commented Jun 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading

nx-cloud Bot commented Jun 20, 2026 •

edited

Loading