npm / browserslist / 4.29.3

browserslist 4.29.3

Source

https://github.com/browserslist/browserslist

Tag scanned

4.29.3

Compared with

4.29.2 (0 signals introduced since)

Files

68 scanned, 20 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 19:37

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import node.js:264:19

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var queries = require(require.resolve(name, { paths: ['.', ctx.path] }))
       if (typeof queries === 'object' && queries !== null && queries.__esModule) {
         queries = queries.default

   likely benign LLM, confidence 0.90 Browserslist loads a named query module by resolving its path and requiring it.

   Reasoning

   This is browserslist's query loader resolving a user-supplied query name via require.resolve with explicit paths, then requiring the resolved file. The dynamic specifier is resolved through require.resolve, a common plugin-loading pattern in build tooling. No encoding, obfuscation, or network/shell behavior is present.

2. info warn → info by review dynamic-import node.js:288:17

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var stats = require(
         // Use forward slashes for module paths, also on Windows.
         require.resolve(path.posix.join(name, 'browserslist-stats.json'), {

   likely benign LLM, confidence 0.92 Browserslist requires a stats JSON file resolved relative to a configured name.

   Reasoning

   Loads browserslist-stats.json from a path joined with a fixed filename, with a comment explaining the forward-slash convention. This is ordinary config/data loading with no malicious indicators.

3. info warn → info by review dynamic-import node.js:341:22

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

         try {
           compressed = require('caniuse-lite/data/regions/' + code + '.js')
         } catch (e) {
           throw new BrowserslistError('Unknown region name `' + code + '`.')

   likely benign LLM, confidence 0.93 Requires a caniuse-lite regional data file based on a region code.

   Reasoning

   Concatenates a region code into a require path under caniuse-lite/data/regions, wrapped in try/catch that throws a descriptive error. The path prefix is fixed to a known data package, limiting it to data lookups. Standard dynamic data loading.

4. info warn → info by review dynamic-import node.js:361:20

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

       try {
         compressed = require('caniuse-lite/data/features/' + name + '.js')
       } catch (e) {
         throw new BrowserslistError('Unknown feature name `' + name + '`.')

   likely benign LLM, confidence 0.93 Requires a caniuse-lite feature data file based on a feature name.

   Reasoning

   Same pattern as the region loader: a feature name is appended to a fixed caniuse-lite features directory, with error handling. It can only load data files from that package, so it is a normal dynamic data lookup.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/browserslist/browserslist browserslist && cd browserslist
git checkout 4.29.3
disclude scan --severity info --diff 4.29.2 .