{ "schemaVersion": 1, "type": "resource", "id": "radix-ui", "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture" ], "summary": "The official edit-profile dialog passed opening, six Tab steps and Escape focus restoration. The pinned Dialog 1.3.1 fixture passed six additional checks, including state callbacks and React text insertion. Save changes was never activated.", "reportUrl": "/design-evaluations/resource-radix-ui.json", "identity": { "target": "https://www.radix-ui.com/primitives/docs/components/dialog plus a local @radix-ui/react-dialog fixture", "version": "Local @radix-ui/react-dialog 1.3.1; React and React DOM 19.3.1 for the Dialog fixtures. Public demo is separately unversioned.", "integrity": "Package archive SHA-256 485336a3a4118d0f7e49504a3b2752c8975ea0e5e3ad1c944ff055d2d2fc15f2 (npm SHA-512 integrity matched). Public document SHA-256 6b061c025b95533dfa1b6ec88666c7471e4a3a6d2e3f38be70e70a004be7572e; response-body scope only." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked.", "Exact direct dependencies; 38-package lock installed with --ignore-scripts, empty user/global npm configs, isolated cache and allowlisted environment. No lifecycle install scripts ran.", "Local browser responses served only the authored fixture, pinned bundle or stylesheet. External HTTP(S) requests were denied, with zero recorded attempts in the final fixture. WebSocket attempts were blocked but not counted.", "Existing Rolldown 1.2.14 bundled inspected prebuilt exports without running upstream build scripts." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://www.radix-ui.com/primitives/docs/components/dialog. Reachability only." }, { "name": "Keyboard open and dialog semantics", "mode": "browser", "method": "Focus the first documented dialog trigger; press Enter; inspect visible dialog and accessible-name reference.", "result": "pass", "observation": "A visible dialog opened; aria-labelledby target present=True. Presence of a reference is not a screen-reader test." }, { "name": "Bounded dialog focus containment", "mode": "browser", "method": "Press Tab six times while the sample remains open and inspect focus containment after each press.", "result": "pass", "observation": "All six settled Tab samples stayed inside the dialog. This does not establish every focus path or nested-overlay behavior." }, { "name": "Escape and focus restoration", "mode": "browser", "method": "Press Escape, wait for exit animation and inspect closed state plus focus on original trigger.", "result": "pass", "observation": "Closed=true; trigger focus restored=true. No save action or form submission." }, { "name": "Pinned dialog opening and labels", "mode": "local-fixture", "method": "Press Enter on the authored trigger and inspect the dialog name and description relationships.", "result": "pass", "observation": "{\"title\":\"Synthetic settings\",\"description\":\"A synthetic local form; nothing is saved.\"}" }, { "name": "Initial focus", "mode": "local-fixture", "method": "Inspect focused element after the modal opens.", "result": "pass", "observation": "{\"inside\":true,\"tag\":\"INPUT\"}" }, { "name": "Tab containment", "mode": "local-fixture", "method": "Press Tab six times with a brief focus-settlement wait; inspect containment.", "result": "pass", "observation": "[true,true,true,true,true,true]" }, { "name": "React text insertion boundary", "mode": "local-fixture", "method": "Render a synthetic HTML-looking string as a React child and inspect text, image count and recorded HTTP(S) request attempts.", "result": "pass", "observation": "Literal text retained=true; image nodes=0; recorded HTTP(S) request attempts=0. React text composition only; no HTML sanitizer tested. WebSocket attempts were blocked but not counted." }, { "name": "Escape closure and restoration", "mode": "local-fixture", "method": "Press Escape and inspect removed dialog plus focus on original trigger.", "result": "pass", "observation": "{\"closed\":true,\"focused\":true}" }, { "name": "Close action and state callback", "mode": "local-fixture", "method": "Reopen by pointer, activate the component Close control and inspect open-change callbacks.", "result": "pass", "observation": "Open state callbacks [true,false,true,false]; no persistence handler attached." } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "info", "basis": "observed", "title": "Dialog state stayed local in the fixture", "detail": "The synthetic open/close callback sequence was true, false, true, false and zero HTTP(S) request attempts were recorded. WebSocket attempts were blocked but not counted. That describes the authored fixture; production handlers can add network and persistence behavior." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 2 additional host(s), including static.cloudflareinsights.com, www.googletagmanager.com. The guard blocked 2 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "info", "basis": "observed", "title": "Pinned fixture network boundary", "detail": "All six @radix-ui/react-dialog fixture checks completed with zero recorded HTTP(S) request attempts and zero page errors. WebSocket attempts were blocked but not counted. This applies to the small authored fixture; it is not a claim about every export, dependency or integration." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "The asChild composition option can lose behavior when a custom child drops props or refs, or uses an unsuitable element.", "Keep separately installed Radix packages aligned; shared dependency duplication can complicate upgrades and bundle size.", "A modal can constrain interaction while open; it cannot establish who may read or change a record." ], "limits": [ "Only Dialog was installed. No whole-library, nested overlay, router, hydration or mobile assistive-technology test was performed.", "The HTML-looking string stayed literal through React child rendering; dangerouslySetInnerHTML and HTML sanitizers were not tested." ], "sources": [ { "label": "Official documentation", "url": "https://www.radix-ui.com/primitives/docs/overview/introduction" }, { "label": "Official evaluated sample", "url": "https://www.radix-ui.com/primitives/docs/components/dialog" }, { "label": "Upstream repository", "url": "https://github.com/radix-ui/primitives" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/radix-ui/primitives", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/radix-ui/primitives/commit/eb3a2b7091293e27df8f9ba906632d8daa3d81a3", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@radix-ui/react-dialog/1.3.1", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Radix accessibility guidance", "url": "https://www.radix-ui.com/primitives/docs/overview/accessibility" }, { "label": "Composition and custom-child requirements", "url": "https://www.radix-ui.com/primitives/docs/guides/composition" } ] } }