Is the order of transaction inputs malleable? I'm looking to track transactions in a non-malleable way. To achieve this I've read the recommendations in this answer, but I don't understand how the order of transaction inputs isn't malleable. It's my understanding that each separate input is signed by the private key it's address is associated with, and thus a malleability attack could just swap the order of inputs and a tracking hash dependent a specific order would be rendered useless. Am I missing something here?
The signature associated with an input doesn't just sign that input, it signs the entire transaction payload - basically every part of the transaction except the signatures themselves. (Technically, it appears to actually sign a hash of a serialized version of the transaction.)

It has to be that way. Otherwise, you could take someone else's signed transaction and modify the outputs to pay it to yourself instead of the intended recipient.

So if you modify the order of the inputs, you modify the signed payload. The signatures will no longer verify and the modified transaction will not be accepted as valid by anyone.

The malleable transaction attack worked by modifying the signature itself to a different but still valid alternate version. The payload of the transaction never changed.