npm / browserslist / 4.29.4

browserslist 4.29.4

Source

https://github.com/browserslist/browserslist

Tag scanned

4.29.4

Compared with

4.29.3 (0 signals introduced since)

Files

68 scanned, 20 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 16:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import node.js:264:19

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var queries = require(require.resolve(name, { paths: ['.', ctx.path] }))
       if (typeof queries === 'object' && queries !== null && queries.__esModule) {
         queries = queries.default

   likely benign LLM, confidence 0.90 Dynamic require of a resolved query module in browserslist's query loader.

   Reasoning

   This is browserslist-style code resolving a query module via require.resolve with a paths option and then requiring it, a common pattern for loading plugin/query modules by name. The specifier comes from a resolved path of a user-configured query name, not from encoded or hidden input. Dynamic require is expected for a plugin loader.

2. info warn → info by review dynamic-import node.js:288:17

   `require` called with a non-literal specifier (ast pass, confidence 0.60)

       }
       var stats = require(
         // Use forward slashes for module paths, also on Windows.
         require.resolve(path.posix.join(name, 'browserslist-stats.json'), {

   likely benign LLM, confidence 0.90 Loads browserslist-stats.json via require.resolve of a joined path.

   Reasoning

   The require target is require.resolve of a fixed file name (browserslist-stats.json) joined under a provided package name. This is a normal data-file load in browserslist with a comment about path separators; no execution of untrusted content beyond loading JSON data.

3. info warn → info by review dynamic-import node.js:341:22

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

         try {
           compressed = require('caniuse-lite/data/regions/' + code + '.js')
         } catch (e) {
           throw new BrowserslistError('Unknown region name `' + code + '`.')

   likely benign LLM, confidence 0.92 Lazy-loads caniuse-lite region data by concatenated code name.

   Reasoning

   Concatenates a region code into a caniuse-lite data path inside a try block that rethrows a BrowserslistError on failure. This is the standard lazy data loader for browserslist regions; the prefix is fixed and the input is a validated-ish region name, not an injected payload.

4. info warn → info by review dynamic-import node.js:361:20

   `require` called with a non-literal specifier (ast pass, confidence 0.80)

       try {
         compressed = require('caniuse-lite/data/features/' + name + '.js')
       } catch (e) {
         throw new BrowserslistError('Unknown feature name `' + name + '`.')

   likely benign LLM, confidence 0.92 Lazy-loads caniuse-lite feature data by concatenated feature name.

   Reasoning

   Same pattern as the region loader: a fixed caniuse-lite features directory concatenated with a feature name, wrapped in try/catch with a descriptive error. Standard browserslist data loading with no encoding or obfuscation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/browserslist/browserslist browserslist && cd browserslist
git checkout 4.29.4
disclude scan --severity info --diff 4.29.3 .