regex 1.13.1

Source: https://github.com/rust-lang/regex
Artifact scanned: regex-1.13.1.crate (crate · 153.4 KB · SHA-256 f020237b6c8e…)
Compared with: regex-1.13.0.crate (0 signals introduced since)
Files: 26 scanned, 29 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 0.2 s
LLM review: LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 02:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info encoding-hex src/bytes.rs:43:13

16 consecutive `\xNN` escapes (entropy 3.9 bits/byte) (in comment) (raw pass, confidence 0.39)

).unwrap();
let hay = b"\x12\xd0\x3b\x5f\x7b\xa9\x85\xe2\x98\x83\x80\x98\x54\x76\x68\x65";

// Notice that despite the `.*` at the end, it will only match valid UTF-8

info unicode-mixed-script src/lib.rs:611:18

identifier `abcΔᎠβⅠᏴγδⅡxyz` mixes scripts: Latin + Greek + Other (in string/comment) (raw pass, confidence 0.40)
```
let re = Regex::new(r"[\pN\p{Greek}\p{Cherokee}]+").unwrap();
let m = re.find("abcΔᎠβⅠᏴγδⅡxyz").unwrap();
assert_eq!(3..23, m.range());
```
```

info unicode-mixed-script src/lib.rs:626:37

identifier `ΔδΔ𐅌ΔδΔ` mixes scripts: Greek + Other (in string/comment) (raw pass, confidence 0.40)

let re = Regex::new(r"[\p{Greek}&&\pL]+").unwrap();
let subs: Vec<&str> = re.find_iter("ΔδΔ𐅌ΔδΔ").map(|m| m.as_str()).collect();
assert_eq!(subs, vec!["ΔδΔ", "ΔδΔ"]);

info unicode-mixed-script src/lib.rs:631:37

identifier `ΔδΔ𐅌ΔδΔ` mixes scripts: Greek + Other (in string/comment) (raw pass, confidence 0.40)

let re = Regex::new(r"\p{Greek}+").unwrap();
let subs: Vec<&str> = re.find_iter("ΔδΔ𐅌ΔδΔ").map(|m| m.as_str()).collect();
assert_eq!(subs, vec!["ΔδΔ𐅌ΔδΔ"]);
```

info unicode-mixed-script src/lib.rs:632:24

identifier `ΔδΔ𐅌ΔδΔ` mixes scripts: Greek + Other (in string/comment) (raw pass, confidence 0.40)
```
let subs: Vec<&str> = re.find_iter("ΔδΔ𐅌ΔδΔ").map(|m| m.as_str()).collect();
assert_eq!(subs, vec!["ΔδΔ𐅌ΔδΔ"]);
```
```

info unicode-mixed-script src/regexset/bytes.rs:579:20

identifier `βa1` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// ]).unwrap();
    /// let hay = "βa1".as_bytes();
    /// let matches: Vec<_> = set.matches(hay).iter().collect();
    /// assert_eq!(matches, vec![0, 1, 3]);

info unicode-mixed-script src/regexset/bytes.rs:596:20

identifier `βa1` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// ]).unwrap();
    /// let hay = "βa1".as_bytes();
    /// let mut matches = vec![];
    /// for index in set.matches(hay) {

info unicode-mixed-script src/regexset/bytes.rs:648:16

identifier `βa1` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// ]).unwrap();
/// let hay = "βa1".as_bytes();
/// let mut matches = vec![];
/// for index in set.matches(hay) {
```

info unicode-mixed-script src/regexset/string.rs:575:20

identifier `βa1` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

    /// ]).unwrap();
    /// let hay = "βa1";
    /// let matches: Vec<_> = set.matches(hay).iter().collect();
    /// assert_eq!(matches, vec![0, 1, 3]);

info unicode-mixed-script src/regexset/string.rs:592:20

identifier `βa1` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
    /// ]).unwrap();
    /// let hay = "βa1";
    /// let mut matches = vec![];
    /// for index in set.matches(hay) {
```
info unicode-mixed-script src/regexset/string.rs:644:16

identifier `βa1` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)
```
/// ]).unwrap();
/// let hay = "βa1";
/// let mut matches = vec![];
/// for index in set.matches(hay) {
```

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o regex-1.13.1.crate 'https://static.crates.io/crates/regex/regex-1%2E13%2E1.crate'
printf '%s  %s\n' f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d regex-1.13.1.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf regex-1.13.1.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg