npm / baseline-browser-mapping / 2.11.28

baseline-browser-mapping 2.11.28

Source: https://github.com/web-platform-dx/baseline-browser-mapping
Tag scanned: v2.11.28
Compared with: v2.11.27 (0 signals introduced since)
Files: 23 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:58

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import spec/legacy-tests/legacy-test.cjs:7:13

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  var lib = require(distPath);
  var getCompatibleVersions = lib.getCompatibleVersions;
```
likely benign LLM, confidence 0.80 A legacy test file loads a library via require() with a variable path (distPath) and reads getCompatibleVersions from it.
Reasoning
The require call uses a variable path (distPath), which is a common pattern in test harnesses that load a built distribution file by computed path. The file is under spec/legacy-tests, a test directory, and the snippet shows only loading a library and reading an exported function. No decoding, shell execution, or network activity is visible. The non-literal specifier is worth noting but is typical for tests, so the finding is most likely benign, though distPath's origin is not shown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/web-platform-dx/baseline-browser-mapping baseline-browser-mapping && cd baseline-browser-mapping
git checkout v2.11.28
disclude scan --severity info --diff v2.11.27 .