semver 7.8.5

Source: https://github.com/npm/node-semver
Tag scanned: v7.8.5
Compared with: v7.8.4 (0 signals introduced since)
Files: 146 scanned, 8 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 4.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 09:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution .github/actions/create-check/action.yml:39:45

[embedded bash] command name is a variable (`$serverUrl`, `$owner`, `$repo`, `$SHA`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
          return [
            `This check is assosciated with ${serverUrl}/${owner}/${repo}/commit/${SHA}.`,
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
```
dismissed LLM, confidence 0.93 JavaScript template-literal string building in a create-check GitHub Action, mis-flagged as a variable command in embedded bash.
Reasoning
The snippet is JavaScript (return array of template literals joined with spaces) inside a GitHub Action YAML file. The 'embedded bash' pass has misparsed JS template-literal interpolations (${serverUrl}, ${owner}) as shell command names. No shell execution is shown, so this is a parser false positive.
info ~~critical~~ → info by review dynamic-execution .github/actions/create-check/action.yml:41:30

[embedded bash] command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)
```
            'Run logs:',
            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
          ].join(' ')
```
dismissed LLM, confidence 0.93 JavaScript fallback expression building a run-log message, incorrectly treated as an executed shell command.
Reasoning
The flagged 'substitution' is a JS template literal `could not be found for a job ending with: "${JOB_NAME}"` combined with `job?.html_url ||` in a return expression. This is ordinary JavaScript fallback string logic, not a runtime-determined shell command. The critical severity comes from the same misclassification of JS as bash.
info ~~warn~~ → info by review dynamic-execution .github/workflows/release.yml:228:29

[embedded bash] command name is a variable (`$owner`, `$repo`, `$runId`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
            const issue_number = releases[0].prNumber
            const runUrl = `https://github.com/${owner}/${repo}/actions/runs/${runId}`

            return [
```
dismissed LLM, confidence 0.92 JavaScript template literal constructing a GitHub Actions run URL, mis-flagged as a dynamic bash command.
Reasoning
The snippet builds a URL with a JS template literal (`https://github.com/${owner}/${repo}/actions/runs/${runId}`) inside a github-script block, followed by a return of an array. This is standard GitHub Actions script code. The bash classification is a false positive from the YAML embedded-script parser.
info identifier-low-length internal/identifiers.js:1:1

22 of 53 non-conventional identifiers are single-character (42%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/npm/node-semver node-semver && cd node-semver
git checkout v7.8.5
disclude scan --severity info --diff v7.8.4 .