disclude.io

npm / tr46 / 7.0.0

tr46 7.0.0

Source
https://github.com/jsdom/tr46
Artifact scanned
tr46-7.0.0.tgz (npm tarball · 64.1 KB · SHA-256 71ae6e18972e…)
Compared with
tr46-6.0.0.tgz (9 signals introduced since)
Files
6 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 9 info
Scan time
6.4 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version
4.3.0
Scanned (UTC)
2026-10-23 17:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review long-line lib/regexes.js:3:1 new in this release

    line length 4531 characters (raw pass, confidence 0.65)

    const combiningMarks = /[\u0300-\u036F\u0483-\u0489\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\u05C7-\u05C9\u0610-\u061A\u064B-\u065F\u0670\u06D6-\u06DC\u06DF-\u06E4\u06E7\u06E8\u06EA-\u06ED\u0711\u0730-\u074A\u07A6-\u07B0\u07EB-\u07F3\u07FD\u0816-\u0819\u081B-\u0823\u0825-\u0827\u0829-\u082D\u0859-\u085B\u0897-\u089F\
    likely benign LLM, confidence 0.93 A very long regex character class listing Unicode combining mark ranges.
    Reasoning

    Raw pass long-line signal on a regex character class of Unicode combining marks. The snippet is a generated Unicode range table, a normal pattern for text-processing libraries. Long generated data lines are common and carry no execution or hidden payload.

  2. info warn → info by review long-line lib/regexes.js:5:1 new in this release

    line length 11096 characters (raw pass, confidence 0.65)

    const validZWNJ = /[\u0620\u0626\u0628\u062A-\u062E\u0633-\u063F\u0641-\u0647\u0649\u064A\u066E\u066F\u0678-\u0687\u069A-\u06BF\u06C1\u06C2\u06CC\u06CE\u06D0\u06D1\u06FA-\u06FC\u06FF\u0712-\u0714\u071A-\u071D\u071F-\u0727\u0729\u072B\u072D\u072E\u074E-\u0758\u075C-\u076A\u076D-\u0770\u0772\u0775-\u0777\u077A-\u077F\u07
    likely benign LLM, confidence 0.93 A very long regex character class of Unicode letter ranges for ZWNJ validation.
    Reasoning

    Raw long-line finding on a regex character class of Unicode code points for ZWNJ validity, consistent with an IDNA/bidi validation table. It is data, not executable obfuscation.

  3. info warn → info by review long-line lib/regexes.js:6:1 new in this release

    line length 2114 characters (raw pass, confidence 0.65)

    const bidiDomain = /[\u05BE\u05C0\u05C3\u05C6\u05D0-\u05EA\u05EF-\u05F4\u0600-\u0605\u0608\u060B\u060D\u061B-\u064A\u0660-\u0669\u066B-\u066F\u0671-\u06D5\u06DD\u06E5\u06E6\u06EE\u06EF\u06FA-\u070D\u070F\u0710\u0712-\u072F\u074D-\u07A5\u07B1\u07C0-\u07EA\u07F4\u07F5\u07FA\u07FE-\u0815\u081A\u0824\u0828\u0830-\u083E\u08
    likely benign LLM, confidence 0.93 A long regex character class of bidi-domain Unicode ranges.
    Reasoning

    Raw long-line finding on a Unicode bidi-class regex table. The line is a generated character class, and the file as a whole looks like an IDNA or bidi validation module.

  4. info warn → info by review long-line lib/regexes.js:7:1 new in this release

    line length 11221 characters (raw pass, confidence 0.65)

    const bidiS1LTR = /[A-Za-z\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02B8\u02BB-\u02C1\u02D0\u02D1\u02E0-\u02E4\u02EE\u0370-\u0373\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0482\u048A-\u052F\u0531-\u0556\u0558-\u0589\u058B\u058C\u0903-\u0939\u093B\u093D-\u0940\u0949-\u094C\u094
    likely benign LLM, confidence 0.93 A long regex character class of bidi S1 LTR Unicode ranges.
    Reasoning

    Raw long-line finding on a Unicode bidi left-to-right regex table, consistent with the other tables in the same file. It is generated data with no execution path.

  5. info warn → info by review long-line lib/regexes.js:8:1 new in this release

    line length 2037 characters (raw pass, confidence 0.65)

    const bidiS1RTL = /[\u05BE\u05C0\u05C3\u05C6\u05D0-\u05EA\u05EF-\u05F4\u0608\u060B\u060D\u061B-\u064A\u066D-\u066F\u0671-\u06D5\u06E5\u06E6\u06EE\u06EF\u06FA-\u070D\u070F\u0710\u0712-\u072F\u074D-\u07A5\u07B1\u07C0-\u07EA\u07F4\u07F5\u07FA\u07FE-\u0815\u081A\u0824\u0828\u0830-\u083E\u0840-\u0858\u085E\u0860-\u086A\u087
    likely benign LLM, confidence 0.93 A long regex character class of bidi S1 RTL Unicode ranges.
    Reasoning

    Raw long-line finding on a Unicode bidi right-to-left regex table. Same generated pattern as the sibling findings in this file.

  6. info warn → info by review long-line lib/regexes.js:9:1 new in this release

    line length 8156 characters (raw pass, confidence 0.65)

    const bidiS2 = /^[\0-\x08\x0E-\x1B!-@\[-`\{-\x84\x86-\xA9\xAB-\xB4\xB6-\xB9\xBB-\xBF\xD7\xF7\u02B9\u02BA\u02C2-\u02CF\u02D2-\u02DF\u02E5-\u02ED\u02EF-\u036F\u0374\u0375\u037E\u0384\u0385\u0387\u03F6\u0483-\u0489\u058A\u058D-\u058F\u0591-\u05C9\u05D0-\u05EA\u05EF-\u05F4\u0600-\u070D\u070F-\u074A\u074D-\u07B1\u07C0-\u07F
    likely benign LLM, confidence 0.93 A long anchored regex character class of bidi S2 Unicode ranges.
    Reasoning

    Raw long-line finding on a Unicode bidi S2 regex table. It is a long anchored character class of code point ranges, a standard data structure in bidi validation.

  7. info warn → info by review long-line lib/regexes.js:10:1 new in this release

    line length 6809 characters (raw pass, confidence 0.65)

    const bidiS3 = /[0-9\xB2\xB3\xB9\u05BE\u05C0\u05C3\u05C6\u05D0-\u05EA\u05EF-\u05F4\u0600-\u0605\u0608\u060B\u060D\u061B-\u064A\u0660-\u0669\u066B-\u066F\u0671-\u06D5\u06DD\u06E5\u06E6\u06EE-\u070D\u070F\u0710\u0712-\u072F\u074D-\u07A5\u07B1\u07C0-\u07EA\u07F4\u07F5\u07FA\u07FE-\u0815\u081A\u0824\u0828\u0830-\u083E\u084
    likely benign LLM, confidence 0.93 A long regex character class of bidi S3 Unicode ranges.
    Reasoning

    Raw long-line finding on a Unicode bidi S3 regex table. It is generated code-point ranges and contains no executable or encoded payload.

  8. info warn → info by review long-line lib/regexes.js:13:1 new in this release

    line length 10336 characters (raw pass, confidence 0.65)

    const bidiS5 = /^[\0-\x08\x0E-\x1B!-\x84\x86-\u0377\u037A-\u037F\u0384-\u038A\u038C\u038E-\u03A1\u03A3-\u052F\u0531-\u0556\u0558-\u058F\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\u05C7-\u05C9\u0606\u0607\u0609\u060A\u060C\u060E-\u061A\u064B-\u065F\u066A\u0670\u06D6-\u06DC\u06DE-\u06E4\u06E7-\u06ED\u06F0-\u06F9\u0711\u0
    likely benign LLM, confidence 0.93 A long anchored regex character class of bidi S5 Unicode ranges.
    Reasoning

    Raw long-line finding on a Unicode bidi S5 regex table. The content is a long anchored character class of code point ranges, consistent with the rest of the file.

  9. info warn → info by review long-line lib/regexes.js:14:1 new in this release

    line length 15885 characters (raw pass, confidence 0.65)

    const bidiS6 = /[0-9A-Za-z\xAA\xB2\xB3\xB5\xB9\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02B8\u02BB-\u02C1\u02D0\u02D1\u02E0-\u02E4\u02EE\u0370-\u0373\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0482\u048A-\u052F\u0531-\u0556\u0558-\u0589\u058B\u058C\u06F0-\u06F9\u0903-\u0939\u093B\u093D
    likely benign LLM, confidence 0.93 A very long regex character class of bidi S6 Unicode ranges.
    Reasoning

    Raw long-line finding on a Unicode bidi S6 regex table. It is generated range data, and the long line is explained by the table size.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o tr46-7.0.0.tgz https://registry.npmjs.org/tr46/-/tr46-7.0.0.tgz
printf '%s  %s\n' 71ae6e18972e8cccfb5fe09a5e1a47ad2897e8e13c9c10029168e8fa4a03c71d tr46-7.0.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf tr46-7.0.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg