Skip to content

fix: prevent setState on unmounted component in HIPAADashboard#13479

Merged
kubestellar-hive[bot] merged 1 commit into
kubestellar:mainfrom
AdeshDeshmukh:fix/hipaa-race-condition
May 13, 2026
Merged

fix: prevent setState on unmounted component in HIPAADashboard#13479
kubestellar-hive[bot] merged 1 commit into
kubestellar:mainfrom
AdeshDeshmukh:fix/hipaa-race-condition

Conversation

@AdeshDeshmukh
Copy link
Copy Markdown
Contributor

Fourth dashboard in the compliance suite with the same pattern —
four API calls fire on mount, resolve asynchronously, and dump into
setState with no one checking if the component is still around.

Same cancelledRef fix — .json() parsing pulled ahead of the guard,
checks in catch and finally, ref reset on mount and flipped in
cleanup. Nothing fancy, just the same treatment the other three
already got.

HIPAADashboard fires four parallel API calls on mount — safeguards,
PHI namespaces, data flows, and summary. The useEffect had no
cleanup, so navigating away mid-flight left setState calls firing
on an unmounted component.

Separated .json() parsing from state updates so the cancelledRef
check runs after all async work completes, with guards in catch
and finally. Same pattern applied across the compliance dashboard
suite — this was the fourth one.

Signed-off-by: AdeshDeshmukh <adeshkd123@gmail.com>
Copilot AI review requested due to automatic review settings May 13, 2026 17:06
@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label May 13, 2026
@kubestellar-prow
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@netlify
Copy link
Copy Markdown

netlify Bot commented May 13, 2026

Deploy Preview for kubestellarconsole ready!

Built without sensitive environment variables

Name Link
🔨 Latest commit 3f671d5
🔍 Latest deploy log https://app.netlify.com/projects/kubestellarconsole/deploys/6a04af9efca18f0008de2204
😎 Deploy Preview https://deploy-preview-13479.console-deploy-preview.kubestellar.io
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@kubestellar-prow kubestellar-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label May 13, 2026
@github-actions
Copy link
Copy Markdown
Contributor

👋 Hey @AdeshDeshmukh — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.


This is an automated message.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Prevents React warnings/errors caused by calling setState after HIPAADashboardContent unmounts by adding a cancellation ref guard around async fetch completion.

Changes:

  • Added a cancelledRef (useRef) that is reset on mount and flipped in the useEffect cleanup.
  • Moved .json() parsing into local variables and added cancelledRef guards before setState calls in success, catch, and finally.
Copy link
Copy Markdown
Contributor

@kubestellar-hive kubestellar-hive Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security review: PASS

  • Standard React unmount guard pattern (useRef + cleanup function)
  • No new API calls, no input handling changes
  • All state updates correctly gated by cancelledRef.current check
  • JSON parsing completes before the guard check (correct — avoids dangling promises)

Clean fix.

@kubestellar-prow
Copy link
Copy Markdown
Contributor

@kubestellar-hive[bot]: changing LGTM is restricted to collaborators

Details

In response to this:

Security review: PASS

  • Standard React unmount guard pattern (useRef + cleanup function)
  • No new API calls, no input handling changes
  • All state updates correctly gated by cancelledRef.current check
  • JSON parsing completes before the guard check (correct — avoids dangling promises)

Clean fix.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copy link
Copy Markdown
Contributor

@kubestellar-hive kubestellar-hive Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sec-check: Safe. Standard React unmount-guard pattern using useRef. Prevents state updates after unmount — no security implications. The cancelledRef check correctly gates all setState calls and the error handler.

@kubestellar-prow
Copy link
Copy Markdown
Contributor

@kubestellar-hive[bot]: changing LGTM is restricted to collaborators

Details

In response to this:

sec-check: Safe. Standard React unmount-guard pattern using useRef. Prevents state updates after unmount — no security implications. The cancelledRef check correctly gates all setState calls and the error handler.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copy link
Copy Markdown
Contributor

@kubestellar-hive kubestellar-hive Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security & quality review: PASS

  • cancelledRef pattern correctly prevents setState-after-unmount race condition
  • .json() parsing moved before the guard — prevents dangling promise resolution from triggering state updates
  • Guard in catch and finally blocks covers all async paths
  • Ref reset on mount + flip in cleanup is idiomatic React
  • No new attack surface, no sensitive data exposure
  • Matches the established pattern used in the other 3 compliance dashboards

LGTM — safe to merge.

@kubestellar-prow
Copy link
Copy Markdown
Contributor

@kubestellar-hive[bot]: changing LGTM is restricted to collaborators

Details

In response to this:

Security & quality review: PASS

  • cancelledRef pattern correctly prevents setState-after-unmount race condition
  • .json() parsing moved before the guard — prevents dangling promise resolution from triggering state updates
  • Guard in catch and finally blocks covers all async paths
  • Ref reset on mount + flip in cleanup is idiomatic React
  • No new attack surface, no sensitive data exposure
  • Matches the established pattern used in the other 3 compliance dashboards

LGTM — safe to merge.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@kubestellar-hive kubestellar-hive Bot merged commit 8b99012 into kubestellar:main May 13, 2026
39 of 41 checks passed
@github-actions
Copy link
Copy Markdown
Contributor

✅ Post-Merge Verification: passed

Commit: 8b990123f3e4f71fae067d769579a1411f76bfad
Specs run: smoke.spec.ts
Report: https://github.com/kubestellar/console/actions/runs/25815612511

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dco-signoff: yes Indicates the PR's author has signed the DCO. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. tier/2-standard

2 participants