disclude.io

npm / json5 / 2.2.3

json5 2.2.3

Source
https://github.com/json5/json5
Tag scanned
v2.2.3
Compared with
v2.2.2 (0 signals introduced since)
Files
28 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 3 info
Scan time
2.3 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 13:54

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line lib/unicode.js:3:1

    line length 7119 characters (raw pass, confidence 0.65)

    module.exports.ID_Start = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u
    likely benign LLM, confidence 0.95 Generated Unicode ID_Start regex character class in a library data module.
    Reasoning

    A 7119-character line in a unicode.js file is a generated Unicode ID_Start character-class regex, a standard data table used by parsers. The long-line signal is a formatting artifact of generated data, with no execution, encoding of payloads, or hidden behavior.

  2. info warn → info by review long-line lib/unicode.js:4:1

    line length 8577 characters (raw pass, confidence 0.65)

    module.exports.ID_Continue = /[\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0300-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u0483-\u0487\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\
    likely benign LLM, confidence 0.95 Generated Unicode ID_Continue regex character class in a library data module.
    Reasoning

    The 8577-character line is the generated ID_Continue Unicode regex class, matching the sibling ID_Start table. It is a legitimate large data table with no suspicious behavior; the raw long-line flag is expected for such generated code.

  3. info identifier-low-length lib/util.js:1:1

    31 of 62 non-conventional identifiers are single-character (50%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/json5/json5 json5 && cd json5
git checkout v2.2.3
disclude scan --severity info --diff v2.2.2 .