chokidar 6.0.0

Source: https://github.com/paulmillr/chokidar
Tag scanned: 6.0.0
Compared with: 5.0.0 (1 signals introduced since)
Files: 17 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 1 info
Scan time: 2.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 23:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import benchmark/bench.mjs:215:26 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  await resetRuntimePaths(root);
  const chokidar = await import(CHOKIDAR);
  const options = watcherOptions(root, mode, config);
  global.gc?.();
```
likely benign LLM, confidence 0.90 A benchmark script dynamically imports the chokidar watcher library via a constant-named specifier.
Reasoning
A dynamic import of a constant identifier named CHOKIDAR in a benchmark script is a common pattern for loading an optional or comparison library at runtime. The surrounding code (resetting runtime paths, building watcher options, calling global.gc) is ordinary benchmarking harness code with no encoding, decoding, or network activity. The specifier is not attacker-controlled input in any visible way.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/paulmillr/chokidar chokidar && cd chokidar
git checkout 6.0.0
disclude scan --severity info --diff 5.0.0 .