semver 7.8.5

Source: https://github.com/npm/node-semver
Tag scanned: v7.8.5
Compared with: v7.8.4 (0 signals introduced since)
Files: 146 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 4.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution .github/actions/create-check/action.yml:39:45

[embedded bash] command name is a variable (`$serverUrl`, `$owner`, `$repo`, `$SHA`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
          return [
            `This check is assosciated with ${serverUrl}/${owner}/${repo}/commit/${SHA}.`,
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
```
dismissed LLM, confidence 0.90 JavaScript template literal building a check-run summary string with commit and run URLs.
Reasoning
The snippet is JavaScript (a template-literal array passed to join) inside a github-script step. The ${serverUrl}, ${owner} and ${repo} placeholders are ordinary JS string interpolation building a commit URL for a check-run summary. The 'embedded bash' classification is a parser misfire, and nothing here executes a command.
info ~~critical~~ → info by review dynamic-execution .github/actions/create-check/action.yml:41:30

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
          ].join(' ')
```
dismissed LLM, confidence 0.88 JavaScript fallback string interpolating JOB_NAME into a log message.
Reasoning
The flagged construct is a JS template literal `could not be found for a job ending with: "${JOB_NAME}"` used in a || fallback and then joined. It is string interpolation, not a shell command substitution. The critical severity comes from misreading JS as bash, so there is no runtime command execution here.
info ~~warn~~ → info by review dynamic-execution .github/workflows/release.yml:228:29

[embedded bash] command name is a variable (`$owner`, `$repo`, `$runId`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
            const issue_number = releases[0].prNumber
            const runUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}`

            return [
```
dismissed LLM, confidence 0.90 JavaScript template literal constructing a GitHub Actions run URL in a release script.
Reasoning
The snippet is JavaScript in a workflow script: it builds a GitHub Actions run URL with a template literal from owner, repo and runId and returns an array. Those are plain string interpolations, not a command name executed by a shell. This is the same misclassification pattern as the create-check action.
info identifier-low-length internal/identifiers.js:1:1

22 of 53 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/npm/node-semver node-semver && cd node-semver
git checkout v7.8.5
disclude scan --severity info --diff v7.8.4 .