chrono 0.4.45

Source: https://github.com/chronotope/chrono
Tag scanned: v0.4.45
Compared with: v0.4.44 (0 signals introduced since)
Files: 54 scanned, 10 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 4.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 21:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review encoding-escape-soup src/offset/local/tz_info/timezone.rs:716:126

35 consecutive `\xNN` escapes (entropy 4.7 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.80)
```
06\0\0\0\0\0\0\0\x07\0\0\0\x06\0\0\0\x14\x80\0\0\0\xbb\x05\x43\x48\xbb\x21\x71\x58\xcb\x89\x3d\xc8\xd2\x23\xf4\x70\xd2\x61\x49\x38\xd5\x8d\x73\x48\x01\x02\x01\x03\x04\x01\x05\xff\xff\x6c\x02\0\0\xff\xff\x6c\x58\0\x04\xff\xff\x7a\x68\x01\x08\xff\xff\x7a\x68\x01\x0c\xff\xff\x7a\x68\x01\x10\xff\xff\x73\x60\0\x04LMT\0HST\0
```
likely benign LLM, confidence 0.90 A hard-coded byte-array literal encoding a TZif timezone data header, used as test or parsing fixture data.
Reasoning
The snippet is a run of \xNN escapes encoding a TZif (timezone database) binary header: the magic-like structure, transition counts, and the ASCII labels 'LMT' and 'HST' at the end. This is a hard-coded byte fixture for timezone parsing, a common pattern in chrono-style test data. The raw pass has a high false-positive rate, and the 'unsafe block' elevation only shows the file contains unsafe code elsewhere, not that this data is executed or decoded maliciously.
info ~~critical~~ → info by review encoding-escape-soup src/offset/local/tz_info/timezone.rs:716:528

68 consecutive `\xNN` escapes (entropy 3.7 bits/byte) [elevated: unsafe block in same file] (raw pass, confidence 0.80)
```
\0\x06\0\0\0\x06\0\0\0\0\0\0\0\x07\0\0\0\x06\0\0\0\x14\xff\xff\xff\xff\x74\xe0\x70\xbe\xff\xff\xff\xff\xbb\x05\x43\x48\xff\xff\xff\xff\xbb\x21\x71\x58\xff\xff\xff\xff\xcb\x89\x3d\xc8\xff\xff\xff\xff\xd2\x23\xf4\x70\xff\xff\xff\xff\xd2\x61\x49\x38\xff\xff\xff\xff\xd5\x8d\x73\x48\x01\x02\x01\x03\x04\x01\x05\xff\xff\x6c\x
```
likely benign LLM, confidence 0.90 Another segment of the embedded TZif timezone binary byte-array fixture.
Reasoning
This is a continuation of the same embedded TZif binary fixture: repeated 0xff/0x01 transition and offset fields with the expected structure of timezone transition records. Nothing in the snippet decodes, executes, or writes the bytes anywhere. It is static data for a timezone parser and has the shape of legitimate test input.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/chronotope/chrono chrono && cd chrono
git checkout v0.4.45
disclude scan --severity info --diff v0.4.44 .