tr46 7.0.0

Source: https://github.com/jsdom/tr46
Tag scanned: v7.0.0
Compared with: v6.0.0 (12 signals introduced since)
Files: 13 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 12 info
Scan time: 6.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 12 of 12 warn and critical signals; 12 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 14:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:7:16 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
const cp = {
  Mark: (await import(`@unicode/unicode-${unicodeVersion}/General_Category/Mark/code-points.mjs`)).default,
  JT: await generateUnicodeCodePoints(`https://unicode.org/Public/${unicodeVersion}/ucd/extracted/DerivedJoiningType.txt`, ["L", "R", "D", "T"]),
```
likely benign LLM, confidence 0.93 Build script dynamically imports Unicode code-point data packages versioned by a local variable.
Reasoning
Dynamic import with a template literal interpolating a unicode version into a fixed @unicode package path. This is a build-time script generating regexes from Unicode data; the specifier is controlled by a local version variable, not attacker input, and the same pattern repeats across a coherent set of Unicode property packages.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:12:13 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // https://tools.ietf.org/html/rfc5893#section-1.4
  L: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Left_To_Right/code-points.mjs`)).default,
  R: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Right_To_Left/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode Bidi_Class code-point packages in a regex generation script.
Reasoning
Same benign build-script pattern: templated import of @unicode Bidi_Class data for a local version, consistent with generating IDNA/bidi regex tables per RFC 5893.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:13:13 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  R: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Right_To_Left/code-points.mjs`)).default,
  AL: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Arabic_Letter/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode Right_To_Left bidi data in a build script.
Reasoning
Identical templated @unicode Bidi_Class import in a maintainer build script; no sign of runtime code loading or obfuscation.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:14:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  AL: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Arabic_Letter/code-points.mjs`)).default,
  EN: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/European_Number/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode Arabic_Letter bidi data in a build script.
Reasoning
Templated import of Unicode Arabic_Letter bidi data; benign generator code producing regex tables.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:15:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  EN: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/European_Number/code-points.mjs`)).default,
  ES: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/European_Separator/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode European_Number bidi data in a build script.
Reasoning
Templated import of Unicode European_Number data within a legitimate regex-generation script.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:16:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  ES: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/European_Separator/code-points.mjs`)).default,
  ET: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/European_Terminator/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode European_Separator bidi data in a build script.
Reasoning
Templated import of Unicode European_Separator data; consistent benign build tooling.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:17:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  ET: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/European_Terminator/code-points.mjs`)).default,
  AN: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Arabic_Number/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode European_Terminator bidi data in a build script.
Reasoning
Templated import of Unicode European_Terminator data; benign build-time generation.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:18:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  AN: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Arabic_Number/code-points.mjs`)).default,
  CS: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Common_Separator/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode Arabic_Number bidi data in a build script.
Reasoning
Templated import of Unicode Arabic_Number data; benign build-time generation of regex tables.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:19:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  CS: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Common_Separator/code-points.mjs`)).default,
  NSM: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Nonspacing_Mark/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode Common_Separator bidi data in a build script.
Reasoning
Templated import of Unicode Common_Separator data within the same legitimate generator.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:20:15 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  NSM: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Nonspacing_Mark/code-points.mjs`)).default,
  BN: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Boundary_Neutral/code-points.mjs`)).default,
```
likely benign LLM, confidence 0.93 Templated import of Unicode Nonspacing_Mark bidi data in a build script.
Reasoning
Templated import of Unicode Nonspacing_Mark data; benign regex table generation.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:21:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  BN: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Boundary_Neutral/code-points.mjs`)).default,
  ON: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Other_Neutral/code-points.mjs`)).default
};
```
likely benign LLM, confidence 0.93 Templated import of Unicode Boundary_Neutral bidi data in a build script.
Reasoning
Templated import of Unicode Boundary_Neutral data; benign build-time code and the object literal is a plain data map.
info ~~warn~~ → info by review dynamic-import scripts/generateRegexes.mjs:22:14 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  BN: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Boundary_Neutral/code-points.mjs`)).default,
  ON: (await import(`@unicode/unicode-${unicodeVersion}/Bidi_Class/Other_Neutral/code-points.mjs`)).default
};
```
likely benign LLM, confidence 0.93 Templated import of Unicode Other_Neutral bidi data in a build script.
Reasoning
Templated import of Unicode Other_Neutral data closing a benign constant map in the generator script.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/jsdom/tr46 tr46 && cd tr46
git checkout v7.0.0
disclude scan --severity info --diff v6.0.0 .