acorn 8.19.0

Source: https://github.com/acornjs/acorn
Tag scanned: 8.19.0
Directory: acorn (only this part of the repository was scanned)
Compared with: 8.18.0 (2 signals introduced since)
Files: 33 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 13:33

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line acorn/src/generated/astralIdentifierCodes.js:2:1 new in this release

line length 1237 characters (raw pass, confidence 0.50)

export default [509, 0, 227, 0, 150, 4, 294, 9, 1368, 2, 2, 1, 6, 3, 41, 2, 5, 0, 166, 1, 574, 3, 9, 9, 7, 9, 32, 4, 318, 1, 31, 4, 33, 15, 71, 10, 50, 3, 123, 2, 54, 14, 32, 10, 3, 1, 11, 3, 46, 10, 8, 0, 46, 9, 7, 2, 37, 13, 2, 9, 6, 1, 45, 0, 13, 2, 49, 13, 9, 3, 2, 11, 83, 11, 7, 0, 3, 0, 158, 11, 6, 9, 7, 3, 56, 1

info ~~warn~~ → info by review long-line acorn/src/generated/astralIdentifierStartCodes.js:2:1 new in this release

line length 2317 characters (raw pass, confidence 0.65)
```
export default [0, 11, 2, 25, 2, 18, 2, 1, 2, 14, 3, 13, 35, 122, 70, 52, 268, 28, 4, 48, 48, 31, 14, 29, 6, 37, 11, 29, 3, 35, 5, 7, 2, 4, 43, 157, 19, 35, 5, 35, 5, 39, 9, 51, 13, 10, 2, 14, 2, 6, 2, 1, 2, 10, 2, 14, 2, 6, 2, 1, 4, 51, 13, 310, 10, 21, 11, 7, 25, 5, 2, 41, 2, 13, 65, 5, 3, 0, 2, 43, 2, 1, 4, 0, 3, 22
```
likely benign LLM, confidence 0.97 A generated JavaScript module exporting a long numeric array of Unicode astral identifier-start code ranges, with the flag raised only for line length.
Reasoning
The finding is a long-line warning on a generated data file. The snippet is a plain array of integer code-point ranges, the kind of table used by JavaScript parsers (Acorn/Babel-style identifier character tables). There is no execution, no encoding of a payload, and no obfuscated logic. A long single line is typical of generated output and is a style issue, not a security concern.

info long-line acorn/src/acorn.d.ts:589:1

line length 537 characters (raw pass, confidence 0.50)

  core: Statement | Expression | Declaration | ModuleDeclaration | Literal | Program | SwitchCase | CatchClause | Property | Super | SpreadElement | TemplateElement | AssignmentProperty | ObjectPattern | ArrayPattern | RestElement | AssignmentPattern | ClassBody | MethodDefinition | MetaProperty | ImportAttribute | Imp

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/acornjs/acorn acorn && cd acorn
git checkout 8.19.0
disclude scan --severity info --diff 8.18.0 acorn