uri-js 4.4.1

Source: https://github.com/garycourt/uri-js
Artifact scanned: uri-js-4.4.1.tgz (npm tarball · 128.9 KB · SHA-256 5612de52afe8…)
Compared with: uri-js-4.4.0.tgz (0 signals introduced since)
Files: 29 scanned, 16 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 2.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 23:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info whitespace-anomaly dist/es5/uri.all.js:3:1

file mixes tab and space indentation (272 tab-indented and 722 space-indented lines) (raw pass, confidence 0.40)

(function (global, factory) {
	typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
	typeof define === 'function' && define.amd ? define(['exports'], factory) :
	(factory((global.URI = global.URI || {})));

info long-line dist/esnext/regexps-uri.js:7:1

line length 613 characters (raw pass, confidence 0.50)

    UNRESERVED$$ = merge(ALPHA$$, DIGIT$$, "[\\-\\.\\_\\~]", UCSCHAR$$), SCHEME$ = subexp(ALPHA$$ + merge(ALPHA$$, DIGIT$$, "[\\+\\-\\.]") + "*"), USERINFO$ = subexp(subexp(PCT_ENCODED$ + "|" + merge(UNRESERVED$$, SUB_DELIMS$$, "[\\:]")) + "*"), DEC_OCTET$ = subexp(subexp("25[0-5]") + "|" + subexp("2[0-4]" + DIGIT$$) +

info long-line dist/esnext/regexps-uri.js:21:1

line length 711 characters (raw pass, confidence 0.50)

    REG_NAME$ = subexp(subexp(PCT_ENCODED$ + "|" + merge(UNRESERVED$$, SUB_DELIMS$$)) + "*"), HOST$ = subexp(IP_LITERAL$ + "|" + IPV4ADDRESS$ + "(?!" + REG_NAME$ + ")" + "|" + REG_NAME$), PORT$ = subexp(DIGIT$$ + "*"), AUTHORITY$ = subexp(subexp(USERINFO$ + "@") + "?" + HOST$ + subexp("\\:" + PORT$) + "?"), PCHAR$ = su

info ~~warn~~ → info by review long-line dist/esnext/regexps-uri.js:24:1

line length 2036 characters (raw pass, confidence 0.65)
```
    PATH_EMPTY$ = "(?!" + PCHAR$ + ")", PATH$ = subexp(PATH_ABEMPTY$ + "|" + PATH_ABSOLUTE$ + "|" + PATH_NOSCHEME$ + "|" + PATH_ROOTLESS$ + "|" + PATH_EMPTY$), QUERY$ = subexp(subexp(PCHAR$ + "|" + merge("[\\/\\?]", IPRIVATE$$)) + "*"), FRAGMENT$ = subexp(subexp(PCHAR$ + "|[\\/\\?]") + "*"), HIER_PART$ = subexp(subexp(
```
likely benign LLM, confidence 0.95 A generated dist build of URI regular expression definitions with a very long concatenated line.
Reasoning
Raw long-line finding in a bundled/compiled dist file from a URI library. The snippet shows regex-building string concatenation for RFC 3986 URI patterns (PATH, QUERY, FRAGMENT, HIER_PART), which is a typical generated regex module. Long lines are common in minified or generated builds and the raw pass has a high false-positive rate; no encoding, execution, or network behavior is present.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o uri-js-4.4.1.tgz https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz
printf '%s  %s\n' 5612de52afe83da73e66b519e83aa56aa81151c844b90bcf8e045df5ecec8d2d uri-js-4.4.1.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf uri-js-4.4.1.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg