fancy-regex 0.20.0

Source: https://github.com/fancy-regex/fancy-regex
Artifact scanned: fancy-regex-0.20.0.crate (crate · 262.7 KB · SHA-256 20ed7f62ce0a…)
Compared with: fancy-regex-0.19.2.crate (6 signals introduced since)
Files: 54 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 36 info
Scan time: 0.3 s
LLM review: LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-29 23:12

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-homoglyph src/byte_set.rs:462:17 new in this release

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

            // lead bytes are exact for the class range: U+03B1..U+03C9 are 0xCE.. and 0xCF..
            (r"[α-ω]x", Some(vec![0xCE, 0xCF])),
            (r"a?", None),
            (r"(?!x)", None),

info unicode-homoglyph src/byte_set.rs:484:21 new in this release

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

            (r"(?i)[à-ÿ]", Some(vec![0xC3, 0xC5, 0xE2])),
            (r"(?i)[α-ω]", Some(vec![0xC2, 0xCD, 0xCE, 0xCF, 0xE1, 0xE2])),
            // Non-letters don't fold
            (r"(?i)[0-9_]", Some(b"0123456789_".to_vec())),

info unicode-homoglyph tests/matching.rs:1133:52 new in this release

identifier `xПРИВЕТ` contains homoglyph candidates: Р (0420)→P, В (0412)→B, Е (0415)→E, Т (0422)→T (in string/comment) (raw pass, confidence 0.35)
```
    // Cyrillic folding
    assert!(match_text(r"(?<=x)(?i)привет", "xПРИВЕТ"));
    assert!(match_text(r"(?<=x)(?i)ПРИВЕТ", "xпривет"));
```

info unicode-mixed-script tests/matching.rs:1133:52 new in this release

identifier `xПРИВЕТ` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

    // Cyrillic folding
    assert!(match_text(r"(?<=x)(?i)привет", "xПРИВЕТ"));
    assert!(match_text(r"(?<=x)(?i)ПРИВЕТ", "xпривет"));

info unicode-homoglyph tests/matching.rs:1134:52 new in this release

identifier `xпривет` contains homoglyph candidates: р (0440)→p, е (0435)→e (in string/comment) (raw pass, confidence 0.35)

    assert!(match_text(r"(?<=x)(?i)привет", "xПРИВЕТ"));
    assert!(match_text(r"(?<=x)(?i)ПРИВЕТ", "xпривет"));

    // Width-changing fold variants: U+212A KELVIN SIGN (3 bytes) matches

info unicode-mixed-script tests/matching.rs:1134:52 new in this release

identifier `xпривет` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

    assert!(match_text(r"(?<=x)(?i)привет", "xПРИВЕТ"));
    assert!(match_text(r"(?<=x)(?i)ПРИВЕТ", "xпривет"));

    // Width-changing fold variants: U+212A KELVIN SIGN (3 bytes) matches

info unicode-homoglyph benches/bench.rs:456:28

identifier `ωμεγα` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
    if with_match {
        haystack.push_str("ωμεγα ΩΜΕΓΑ");
    }
    c.bench_function(name, |b| {
```
info unicode-mixed-script benches/bench.rs:456:28

identifier `ωμεγα` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
    if with_match {
        haystack.push_str("ωμεγα ΩΜΕΓΑ");
    }
    c.bench_function(name, |b| {
```

info unicode-mixed-script src/vm.rs:1889:48

identifier `aΛb` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

        // Mixed ASCII/non-ASCII content.
        assert!(matches_literal_casei_unicode("aΛb", "AλB"));
        // Simple folding does not include full case folding (ß ≠ ss).
        assert!(!matches_literal_casei_unicode("straße", "STRASSE"));

info unicode-mixed-script src/vm.rs:1889:56

identifier `AλB` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

        // Mixed ASCII/non-ASCII content.
        assert!(matches_literal_casei_unicode("aΛb", "AλB"));
        // Simple folding does not include full case folding (ß ≠ ss).
        assert!(!matches_literal_casei_unicode("straße", "STRASSE"));

info unicode-homoglyph src/vm.rs:1895:49

identifier `αα` contains homoglyph candidates: α (03B1)→a, α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
        assert!(!matches_literal_casei_unicode("ſa", "ſab"));
        assert!(!matches_literal_casei_unicode("αα", "α"));
    }
```

info unicode-homoglyph src/vm.rs:1895:57

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

        assert!(!matches_literal_casei_unicode("ſa", "ſab"));
        assert!(!matches_literal_casei_unicode("αα", "α"));
    }

info unicode-mixed-script tests/bytes/matching.rs:220:42

identifier `δabcABC` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    // Non-ASCII prefix before ASCII capture – exercises the is_ascii() fix
    assert_match_bytes(r"(abc)(?i:\1)", "δabcABC".as_bytes());

    // Unicode case folding (δ ↔ Δ) is NOT applied in BytesMode::Ascii because

info unicode-mixed-script tests/captures.rs:893:30

identifier `xπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "$ππ", "");
    assert_expansion(&cap, "$xπ", "");
    assert_expansion(&cap, "${0}π", "abcdπ");
    assert_expansion(&cap, "${1}π", "aπ");

info unicode-mixed-script tests/captures.rs:894:39

identifier `abcdπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "$xπ", "");
    assert_expansion(&cap, "${0}π", "abcdπ");
    assert_expansion(&cap, "${1}π", "aπ");
    assert_expansion(&cap, "${2}π", "bπ");

info unicode-mixed-script tests/captures.rs:895:39

identifier `aπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "${0}π", "abcdπ");
    assert_expansion(&cap, "${1}π", "aπ");
    assert_expansion(&cap, "${2}π", "bπ");
    assert_expansion(&cap, "${3}π", "cπ");

info unicode-mixed-script tests/captures.rs:896:39

identifier `bπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "${1}π", "aπ");
    assert_expansion(&cap, "${2}π", "bπ");
    assert_expansion(&cap, "${3}π", "cπ");
    assert_expansion(&cap, "${4}π", "dπ");

info unicode-mixed-script tests/captures.rs:897:39

identifier `cπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "${2}π", "bπ");
    assert_expansion(&cap, "${3}π", "cπ");
    assert_expansion(&cap, "${4}π", "dπ");
    assert_expansion(&cap, "${π}π", "cπ");

info unicode-mixed-script tests/captures.rs:898:39

identifier `dπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "${3}π", "cπ");
    assert_expansion(&cap, "${4}π", "dπ");
    assert_expansion(&cap, "${π}π", "cπ");
    assert_expansion(&cap, "${x}π", "dπ");

info unicode-mixed-script tests/captures.rs:899:40

identifier `cπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "${4}π", "dπ");
    assert_expansion(&cap, "${π}π", "cπ");
    assert_expansion(&cap, "${x}π", "dπ");
    assert_expansion(&cap, "$", "$");

info unicode-mixed-script tests/captures.rs:900:39

identifier `dπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_expansion(&cap, "${π}π", "cπ");
    assert_expansion(&cap, "${x}π", "dπ");
    assert_expansion(&cap, "$", "$");
    assert_expansion(&cap, "$π√", "c√");

info unicode-mixed-script tests/captures.rs:913:45

identifier `abcdπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\x", "\\x");
    assert_python_expansion(&cap, "\\0π", "abcdπ");
    assert_python_expansion(&cap, "\\1π", "aπ");
    assert_python_expansion(&cap, "\\2π", "bπ");

info unicode-mixed-script tests/captures.rs:914:45

identifier `aπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\0π", "abcdπ");
    assert_python_expansion(&cap, "\\1π", "aπ");
    assert_python_expansion(&cap, "\\2π", "bπ");
    assert_python_expansion(&cap, "\\3π", "cπ");

info unicode-mixed-script tests/captures.rs:915:45

identifier `bπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\1π", "aπ");
    assert_python_expansion(&cap, "\\2π", "bπ");
    assert_python_expansion(&cap, "\\3π", "cπ");
    assert_python_expansion(&cap, "\\4π", "dπ");

info unicode-mixed-script tests/captures.rs:916:45

identifier `cπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\2π", "bπ");
    assert_python_expansion(&cap, "\\3π", "cπ");
    assert_python_expansion(&cap, "\\4π", "dπ");
    assert_python_expansion(&cap, "\\ππ", "\\ππ");

info unicode-mixed-script tests/captures.rs:917:45

identifier `dπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\3π", "cπ");
    assert_python_expansion(&cap, "\\4π", "dπ");
    assert_python_expansion(&cap, "\\ππ", "\\ππ");
    assert_python_expansion(&cap, "\\xπ", "\\xπ");

info unicode-mixed-script tests/captures.rs:919:38

identifier `xπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\ππ", "\\ππ");
    assert_python_expansion(&cap, "\\xπ", "\\xπ");
    assert_python_expansion(&cap, "\\g<0>π", "abcdπ");
    assert_python_expansion(&cap, "\\g<1>π", "aπ");

info unicode-mixed-script tests/captures.rs:919:47

identifier `xπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\ππ", "\\ππ");
    assert_python_expansion(&cap, "\\xπ", "\\xπ");
    assert_python_expansion(&cap, "\\g<0>π", "abcdπ");
    assert_python_expansion(&cap, "\\g<1>π", "aπ");

info unicode-mixed-script tests/captures.rs:920:48

identifier `abcdπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\xπ", "\\xπ");
    assert_python_expansion(&cap, "\\g<0>π", "abcdπ");
    assert_python_expansion(&cap, "\\g<1>π", "aπ");
    assert_python_expansion(&cap, "\\g<2>π", "bπ");

info unicode-mixed-script tests/captures.rs:921:48

identifier `aπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\g<0>π", "abcdπ");
    assert_python_expansion(&cap, "\\g<1>π", "aπ");
    assert_python_expansion(&cap, "\\g<2>π", "bπ");
    assert_python_expansion(&cap, "\\g<3>π", "cπ");

info unicode-mixed-script tests/captures.rs:922:48

identifier `bπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\g<1>π", "aπ");
    assert_python_expansion(&cap, "\\g<2>π", "bπ");
    assert_python_expansion(&cap, "\\g<3>π", "cπ");
    assert_python_expansion(&cap, "\\g<4>π", "dπ");

info unicode-mixed-script tests/captures.rs:923:48

identifier `cπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\g<2>π", "bπ");
    assert_python_expansion(&cap, "\\g<3>π", "cπ");
    assert_python_expansion(&cap, "\\g<4>π", "dπ");
    assert_python_expansion(&cap, "\\g<π>π", "cπ");

info unicode-mixed-script tests/captures.rs:924:48

identifier `dπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\g<3>π", "cπ");
    assert_python_expansion(&cap, "\\g<4>π", "dπ");
    assert_python_expansion(&cap, "\\g<π>π", "cπ");
    assert_python_expansion(&cap, "\\g<x>π", "dπ");

info unicode-mixed-script tests/captures.rs:925:49

identifier `cπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\g<4>π", "dπ");
    assert_python_expansion(&cap, "\\g<π>π", "cπ");
    assert_python_expansion(&cap, "\\g<x>π", "dπ");
    assert_python_expansion(&cap, "\\", "\\");

info unicode-mixed-script tests/captures.rs:926:48

identifier `dπ` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    assert_python_expansion(&cap, "\\g<π>π", "cπ");
    assert_python_expansion(&cap, "\\g<x>π", "dπ");
    assert_python_expansion(&cap, "\\", "\\");
    assert_python_expansion(&cap, "\\\\π", "\\π");

info unicode-mixed-script tests/matching.rs:328:35

identifier `δΔfoo` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
    assert_no_match(r"(δ)\1", "δΔ");
    assert_no_match(r"(δδ)\1", "δΔfoo");
    assert_no_match(r"(δδ)\1", "δΔ");
```

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o fancy-regex-0.20.0.crate 'https://static.crates.io/crates/fancy%2Dregex/fancy%2Dregex-0%2E20%2E0.crate'
printf '%s  %s\n' 20ed7f62ce0ae0da1a8b93c3c7104ab7e0760a74491e097c701fff966e945390 fancy-regex-0.20.0.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf fancy-regex-0.20.0.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg