A modern runtime for JavaScript and TypeScript.
This report summarizes scanner evidence for denoland/deno, a Rust project with 108,781 GitHub stars. SynthScan examined 1,335,799 lines of code across 8113 source files, recording 2422 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 1.8 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 2361 finding(s).
Are imports declared and package/API names verified? 51 finding(s).
Are wrappers, guards, and repeated structures necessary? 1290 finding(s).
Which changes need focused human review? 2422 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2422 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/util.js | 285 | function isTransientDownloadStatus(status) { | CODE |
| LOW | tools/update_types_node.ts | 33 | async function downloadAndExtractPackages() { | CODE |
| LOW | tools/update_types_node.ts | 450 | function assertIsVariableWithConditionalTypeOnGlobalThis() { | CODE |
| LOW | tools/update_types_node.ts | 532 | function readPinnedTypesNodeVersion(): string { | CODE |
| LOW | tools/lint.js | 523 | async function ensureWorkflowYmlsUpToDate() { | CODE |
| LOW | tools/lint.js | 564 | async function ensureNoNonPermissionCapitalLetterShortFlags() { | CODE |
| LOW | tools/lint.js | 694 | async function ensureDisallowedMethodsEnforced() { | CODE |
| LOW | tools/lint.js | 812 | async function ensureNoNewTopLevelEntries() { | CODE |
| LOW | tools/startup_order/verify_orderfile.ts | 141 | function longestNondecreasingLength(values: number[]): number { | CODE |
| LOW | tools/release/04_post_publish.ts | 33 | async function forwardReleaseCommitToMain() { | CODE |
| LOW | tools/release/00_start_release.ts | 67 | function buildDenoReleaseInstructionsDoc() { | CODE |
| LOW | tools/release/01_bump_crate_versions.ts | 92 | function incrementRenamedCrateMinor(crate: Crate) { | CODE |
| LOW | tools/lint_plugins/prefer_primordials.ts | 344 | function collectBindingsFromParams( | CODE |
| LOW | tools/lint_plugins/prefer_primordials.ts | 641 | function insideVarDeclLhsOrMemberExprOrPropOrTypeRef( | CODE |
| LOW | ext/crypto/00_crypto.js | 53 | function applyWebIdlInterfaceShape(interface_) { | CODE |
| LOW | ext/crypto/00_crypto.js | 316 | function cryptoKeyExportNodeKeyMaterial(cryptoKey) { | CODE |
| LOW | ext/websocket/02_websocketstream.js | 450 | function validateCloseCodeAndReason(closeInfo) { | CODE |
| LOW | ext/net/03_quic.js | 72 | function promiseFinallyWithoutUnhandled(p, f) { | CODE |
| LOW | ext/web/03_abort_signal.js | 387 | function createDependentAbortSignal(signals, prefix) { | CODE |
| LOW | ext/web/02_event.js | 50 | function getCreateFilteredInspectProxy() { | CODE |
| LOW | ext/web/02_event.js | 77 | function getStopImmediatePropagation(event) { | CODE |
| LOW | ext/web/02_event.js | 119 | function setStopImmediatePropagation( | CODE |
| LOW | ext/web/02_event.js | 500 | function isShadowInclusiveAncestor( | CODE |
| LOW | ext/web/02_event.js | 737 | function innerInvokeEventListeners( | CODE |
| LOW | ext/web/02_event.js | 859 | function normalizeEventHandlerOptions( | CODE |
| LOW | ext/web/02_event.js | 963 | function addEventListenerOptionsConverter(V, prefix) { | CODE |
| LOW | ext/web/01_mimesniff.js | 406 | function imageTypePatternMatchingAlgorithm(input) { | CODE |
| LOW | ext/web/00_infra.js | 152 | function collectSequenceOfCodepoints(input, position, condition) { | CODE |
| LOW | ext/web/00_infra.js | 327 | function serializeJSValueToJSONString(value) { | CODE |
| LOW | ext/web/01_urlpattern.js | 37 | function getCreateFilteredInspectProxy() { | CODE |
| LOW | ext/web/01_dom_exception.js | 33 | function getCreateFilteredInspectProxy() { | CODE |
| LOW | ext/web/01_console.js | 683 | function createFilteredInspectProxy({ object, keys, evaluate }) { | CODE |
| LOW | ext/web/01_console.js | 703 | function getDescendantPropertyDescriptor(object, key) { | CODE |
| LOW | ext/web/00_url.js | 493 | function isSimpleSpecialHostCanonical(host, start, end) { | CODE |
| LOW | ext/web/09_file.js | 116 | function convertLineEndingsToNative(s) { | CODE |
| LOW | ext/web/internal.d.ts | 7 | function collectSequenceOfCodepoints( | CODE |
| LOW | ext/web/internal.d.ts | 45 | function serializeJSValueToJSONString(value: unknown): string; | CODE |
| LOW | ext/web/internal.d.ts | 101 | function isReadableStreamDisturbed(stream: ReadableStream): boolean; | CODE |
| LOW | ext/web/13_message_port.js | 60 | function getCreateFilteredInspectProxy() { | CODE |
| LOW | ext/web/13_message_port.js | 188 | function nodeWorkerThreadMaybeInvokeCloseCb(port) { | CODE |
| LOW | ext/web/13_message_port.js | 580 | function opCreateEntangledMessagePort() { | CODE |
| LOW | ext/web/13_message_port.js | 595 | function resolveTransferableResource(type) { | CODE |
| LOW | ext/web/15_performance.js | 45 | function getCreateFilteredInspectProxy() { | CODE |
| LOW⚡ | ext/web/06_streams.js | 907 | function isReadableStreamDefaultReader(value) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 916 | function isReadableStreamBYOBReader(value) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 925 | function isReadableStreamDisturbed(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 934 | function extractStringErrorFromError(error) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 1340 | function readableStreamIsUnrefable(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 1344 | function readableStreamForRidUnrefableRef(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 1354 | function readableStreamForRidUnrefableUnref(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 1364 | function getReadableStreamResourceBacking(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 1368 | function getReadableStreamResourceBackingUnrefable(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 2201 | function readableStreamDefaultControllerCanCloseOrEnqueue(controller) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 2207 | function readableStreamDefaultControllerClearAlgorithms(controller) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 2216 | function readableStreamDefaultControllerClose(controller) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 3091 | function readableStreamGetNumReadIntoRequests(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 3100 | function readableStreamGetNumReadRequests(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 3109 | function readableStreamHasBYOBReader(stream) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 5245 | function writableStreamDefaultControllerClearAlgorithms(controller) { | CODE |
| LOW⚡ | ext/web/06_streams.js | 5253 | function writableStreamDefaultControllerClose(controller) { | CODE |
| 1220 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/glibc_math_shim.c | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | tools/memfd_create_shim.c | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | tools/build_lzld.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/apply_web_globals_deferral.ts | 1 | #!/usr/bin/env -S deno run -A | COMMENT |
| LOW | tools/apply_web_globals_deferral.ts | 21 | // under the current forked tsc (Deno files' globalThis has no `document`, so the | COMMENT |
| LOW | tools/ops.d.ts | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | tools/startup_order/orderfile_function_tracer_linux.c | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | tools/startup_order/orderfile_function_tracer_linux.c | 21 | COMMENT | |
| LOW | tools/startup_order/orderfile_function_tracer_macos.c | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | tools/startup_order/orderfile_function_tracer_macos.c | 21 | COMMENT | |
| LOW | tools/startup_order/orderfile_trace_runner.c | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | tools/release/purge_cdn_cache.ts | 1 | #!/usr/bin/env -S deno run -A --lock=tools/deno.lock.json | COMMENT |
| LOW | tools/lint_plugins/no_deno_api_in_polyfills.ts | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | tools/bsdiff_helper/main.rs | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | ext/crypto/mldsa.rs | 21 | InvalidKeyData, | COMMENT |
| LOW | ext/crypto/decrypt.rs | 41 | #[error("Decryption failed")] | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 101 | #[required(0)] | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 141 | spawn_blocking(move || run_digest(algorithm, data.0)).await? | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 161 | spawn_blocking(move || run_encrypt(algorithm, key, data.0)).await? | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 181 | /// of `data` under `key`. The `SubtleSignParams` `WebIdlConverter` | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 201 | /// dispatch lives in [`crate::subtle_verify::run`]. | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 241 | /// `baseKey` and imports them as a fresh CryptoKey via the Rust-native | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 321 | /// material for an extractable `CryptoKey`. The `KeyFormat` | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 341 | /// https://wicg.github.io/webcrypto-modern-algos/#SubtleCrypto-method-encapsulateBits | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 361 | #[webidl] algorithm: SubtleEncapsulateParams, | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 381 | extractable: bool, | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 401 | run_get_public_key(scope, key, key_usages) | COMMENT |
| LOW | ext/crypto/subtle_crypto.rs | 421 | spawn_blocking(move || { | COMMENT |
| LOW | ext/crypto/export_key.rs | 21 | COMMENT | |
| LOW | ext/crypto/lib.rs | 141 | #[from] | COMMENT |
| LOW | ext/crypto/lib.rs | 161 | #[class(type)] | COMMENT |
| LOW | ext/crypto/lib.rs | 181 | P256Ecdsa(#[from] p256::ecdsa::Error), | COMMENT |
| LOW | ext/crypto/lib.rs | 201 | #[error("Data must be multiple of 8 bytes")] | COMMENT |
| LOW | ext/crypto/lib.rs | 221 | #[error("The provided value is not an integer-type TypedArray")] | COMMENT |
| LOW | ext/crypto/subtle_encapsulate.rs | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | ext/crypto/digest.rs | 21 | COMMENT | |
| LOW | ext/crypto/digest.rs | 81 | /// the dispatch in [`run`] can throw the WebCrypto-spec-mandated | COMMENT |
| LOW | ext/crypto/algorithm.rs | 361 | #[class("DOMExceptionNotSupportedError")] | COMMENT |
| LOW | ext/crypto/subtle_get_public_key.rs | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | ext/crypto/encrypt.rs | 41 | #[class("DOMExceptionOperationError")] | COMMENT |
| LOW | ext/crypto/key_store.rs | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | ext/crypto/crypto_key.rs | 121 | /// Internal `CryptoKey.fromCloneData(data)` — reconstructs a | COMMENT |
| LOW | ext/crypto/make_key.rs | 21 | use crate::shared::RawKeyData; | COMMENT |
| LOW | ext/crypto/00_crypto.js | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | ext/crypto/00_crypto.js | 41 | COMMENT | |
| LOW | ext/crypto/00_crypto.js | 101 | // CryptoKey by `make_crypto_key` (`ext/crypto/make_key.rs`) returns a | COMMENT |
| LOW | ext/crypto/00_crypto.js | 141 | configurable: true, | COMMENT |
| LOW | ext/crypto/00_crypto.js | 181 | writable: true, | COMMENT |
| LOW | ext/crypto/shared.rs | 101 | Secret(Uint8Array), | COMMENT |
| LOW | ext/crypto/shared.rs | 341 | #[class(type)] | COMMENT |
| LOW | ext/crypto/subtle_import_key.rs | 1 | // Copyright 2018-2026 the Deno authors. MIT license. | COMMENT |
| LOW | ext/websocket/lib.rs | 81 | #[error(transparent)] | COMMENT |
| LOW | ext/websocket/lib.rs | 161 | #[derive(Debug, thiserror::Error, deno_error::JsError)] | COMMENT |
| LOW | ext/websocket/lib.rs | 181 | #[class(type)] | COMMENT |
| LOW | ext/websocket/lib.rs | 641 | buffer: Cell::new(None), | COMMENT |
| LOW | ext/websocket/lib.rs | 661 | /// `HttpServerState` poll-complete future never fires). Cancelling first | COMMENT |
| LOW | ext/net/quic.rs | 61 | #[error("Endpoint created by 'connectQuic' cannot be used for listening")] | COMMENT |
| LOW | ext/net/quic.rs | 81 | #[class(generic)] | COMMENT |
| LOW | ext/net/quic.rs | 101 | ReadError(#[from] quinn::ReadError), | COMMENT |
| LOW | ext/net/quic.rs | 1081 | // copies of the Software, and to permit persons to whom the Software is | COMMENT |
| 951 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | libs/core/runtime/jsruntime.rs | 238 | self.main_realm.0.context_state.pending_ops.shutdown(); | CODE |
| CRITICAL | libs/core/runtime/jsruntime.rs | 252 | self.main_realm.0.context_state.pending_ops.shutdown(); | CODE |
| CRITICAL | libs/core/runtime/jsruntime.rs | 1466 | context_state: self.inner.main_realm.0.context_state.clone(), | CODE |
| CRITICAL | libs/core/runtime/jsruntime.rs | 1964 | self.inner.main_realm.0.context_state.uv_loop_ptr.get() | CODE |
| CRITICAL | libs/core/runtime/jsruntime.rs | 3220 | self.inner.main_realm.0.module_map.mod_evaluate(scope, id) | CODE |
| CRITICAL | libs/npm_installer/lifecycle_scripts.rs | 556 | .map(|p| p.package.id.nv.name.to_string()) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ext/cache/01_cache.js | 288 | // Step 5: return the request keys in insertion order. When a request is | COMMENT |
| LOW⚡ | ext/node_crypto/keys.rs | 4598 | // Step 4: I = S || P. | COMMENT |
| LOW⚡ | ext/node_crypto/keys.rs | 4602 | // Step 5: c = ceil(size / u). | COMMENT |
| LOW | ext/node_crypto/keys.rs | 4574 | // Step 1: D = id repeated v bytes. | COMMENT |
| LOW | ext/node_crypto/keys.rs | 4633 | // Step 8: take the first `size` bytes of A. | COMMENT |
| LOW | .claude/skills/issue-triage/SKILL.md | 12 | ## Step 1: Read the issue | COMMENT |
| LOW | .claude/skills/issue-triage/SKILL.md | 18 | ## Step 2: Classify the issue | COMMENT |
| LOW | .claude/skills/issue-triage/SKILL.md | 32 | ## Step 3: Check for missing information | COMMENT |
| LOW | .claude/skills/issue-triage/SKILL.md | 45 | ## Step 4: Reproduce the bug | COMMENT |
| LOW | .claude/skills/issue-triage/SKILL.md | 114 | ## Step 5: Label the issue | COMMENT |
| LOW | .claude/skills/issue-triage/SKILL.md | 174 | ## Step 6: Comment on the issue | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 12 | ## Step 1: Gather PR context | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 32 | ## Step 2: Gate checks | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 53 | ## Step 3: Code review | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 106 | ## Step 4: PR-type-specific checks | COMMENT |
| LOW | .claude/skills/review-pr/SKILL.md | 123 | ## Step 5: Write your review | COMMENT |
| LOW | .claude/skills/node-compat/SKILL.md | 12 | ## Step 1: Build and run the test | COMMENT |
| LOW | .claude/skills/node-compat/SKILL.md | 22 | ## Step 2: Diagnose the failure | COMMENT |
| LOW | .claude/skills/node-compat/SKILL.md | 40 | ## Step 3: Classify the failure | COMMENT |
| LOW | .claude/skills/node-compat/SKILL.md | 81 | ## Step 4: Fix the implementation | COMMENT |
| LOW | .claude/skills/node-compat/SKILL.md | 108 | ## Step 5: Skip or ignore the test | COMMENT |
| LOW | .claude/skills/node-compat/SKILL.md | 166 | ## Step 6: Verify | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 629 | // Step 3: Run Tarjan's at the node level for computation ordering. | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 633 | // Step 4: Compute NpmPackageIds in topological order. | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 2014 | // Step 2: Add resolved peers to scope so children can see them. | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 2024 | // Step 3: Recurse into regular children AND resolved peer dep nodes. | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 542 | // Step 1: Build per-node peer info and NV-level adjacency graph. | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 579 | // Step 2: Detect cycles at the NV level using Tarjan's algorithm. | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 1953 | // Step 1: Resolve this node's own peer deps from parent_pkgs FIRST, | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 2210 | // Step 5: Fix circular parent references. When children have | COMMENT |
| LOW | libs/npm/resolution/snapshot.rs | 847 | // NOTE: This method intentionally has a verbose name | COMMENT |
| LOW | .github/workflows/pr.ts | 35 | "# WARNING: This workflow runs in the context of the base repository so the", | CODE |
| LOW | .github/workflows/pr.generated.yml | 3 | # WARNING: This workflow runs in the context of the base repository so the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ext/node/polyfills/http2.ts | 2582 | // seamless compatibility with http1. | COMMENT |
| MEDIUM | ext/node/polyfills/internal/errors.ts | 3353 | // Non-robust path join | COMMENT |
| MEDIUM⚡ | tests/bench/testdata/react-dom.js | 18 | */var r=e;function a(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n+ | COMMENT |
| MEDIUM⚡ | tests/bench/testdata/react-dom.js | 18 | */var r=e;function a(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n+ | COMMENT |
| MEDIUM⚡ | tests/bench/testdata/react-dom.js | 27 | */var xt=e;function kt(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length; | COMMENT |
| MEDIUM⚡ | tests/bench/testdata/react-dom.js | 27 | */var xt=e;function kt(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length; | COMMENT |
| MEDIUM | tests/unit/streams_test.ts | 894 | // unbounded leak (those are >>2x) and is robust to baseline size. | COMMENT |
| LOW | tests/registry/npm/imurmurhash/registry.json | 37 | "readme": "iMurmurHash.js\n==============\n\nAn incremental implementation of the MurmurHash3 (32-bit) hashing alg | CODE |
| MEDIUM | cli/tools/x.rs | 68 | /// symlinks, so it is robust regardless of the child's cwd). | COMMENT |
| MEDIUM | cli/tools/desktop.rs | 5443 | // cab name (the MSI File key) to stay robust to ordering. | COMMENT |
| MEDIUM | libs/core/runtime/ops_rust_to_v8.rs | 23 | //! efficiency. Furthermore, `#[op2]` strives to leverage `v8::ReturnValue` setters when possible, eliminating | COMMENT |
| MEDIUM | libs/core/runtime/ops_rust_to_v8.rs | 23 | //! efficiency. Furthermore, `#[op2]` strives to leverage `v8::ReturnValue` setters when possible, eliminating | COMMENT |
| MEDIUM | libs/npm_cache/tarball_extract.rs | 64 | /// This is more robust than `Overwrite` as it better handles multiple | COMMENT |
| MEDIUM | libs/npm/resolution/graph.rs | 7230 | // This was an attempt at reducing duplicate dependencies. Essentially, if we previously | COMMENT |
| MEDIUM | libs/resolver/cjs/analyzer/mod.rs | 422 | // Definitely-non-script extensions never carry CJS exports, regardless of | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ext/node/polyfills/_readline.d.ts | 59 | * const values = ['lorem ipsum', 'dolor sit amet']; | COMMENT |
| LOW | ext/node/polyfills/_readline.d.ts | 59 | * const values = ['lorem ipsum', 'dolor sit amet']; | COMMENT |
| LOW | tests/testdata/run/066_prompt.ts | 1 | const name1 = prompt("What is your name?", "Jane Doe"); // Answer with default | CODE |
| LOW | tests/testdata/run/permission_broker/scratch.txt | 1 | Lorem ipsum dolor sit amet | CODE |
| LOW | tests/testdata/run/permission_broker/scratch.txt | 1 | Lorem ipsum dolor sit amet | CODE |
| LOW | tests/testdata/run/permission_broker/log.txt | 1 | Lorem ipsum dolor sit amet | CODE |
| LOW | tests/testdata/run/permission_broker/log.txt | 1 | Lorem ipsum dolor sit amet | CODE |
| LOW | tests/testdata/run/permission_broker/test1.ts | 6 | "Lorem ipsum dolor sit amet", | CODE |
| LOW | tests/testdata/run/permission_broker/test1.ts | 6 | "Lorem ipsum dolor sit amet", | CODE |
| LOW | tests/bench/cache_api.js | 30 | `Lorem ipsum dolor sit amet, consectetur adipiscing…es ligula in libero. Sed dignissim lacinia nunc. `; | CODE |
| LOW | tests/bench/cache_api.js | 30 | `Lorem ipsum dolor sit amet, consectetur adipiscing…es ligula in libero. Sed dignissim lacinia nunc. `; | CODE |
| LOW | tests/unit/streams_test.ts | 61 | // Long stream with Lorem Ipsum text. | COMMENT |
| LOW | tests/unit/streams_test.ts | 77 | // Long stream with Lorem Ipsum text. | COMMENT |
| LOW | tests/unit/streams_test.ts | 21 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | tests/unit/streams_test.ts | 21 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | tests/unit/kv_test.ts | 2590 | .enqueue({ type: "email", to: "user@example.com" }) | CODE |
| LOW | tests/unit/kv_test.ts | 2608 | inspected.includes('enqueue({ type: "email", to: "user@example.com" })'), | CODE |
| LOW | tests/util/server/npm.rs | 276 | dist.insert("shasum".to_string(), "dummy-value".into()); | CODE |
| LOW | tests/util/server/npm.rs | 397 | dist.insert("shasum".to_string(), "dummy-value".into()); | CODE |
| LOW | tests/specs/fmt/yaml/ignore_file3.yaml | 1 | # Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor | COMMENT |
| LOW | tests/specs/fmt/yaml/ignore_file3.yaml | 1 | # Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor | COMMENT |
| LOW | tests/specs/fmt/sql/ignore_file3.sql | 1 | -- Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor | CODE |
| LOW | tests/specs/fmt/sql/ignore_file3.sql | 1 | -- Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor | CODE |
| LOW | tests/specs/bundle/data_url_css/test.css | 3 | --test-text: url("data:text/plain;charset=utf-8,Lorem ipsum dolor sit amet"); | CODE |
| LOW | tests/specs/bundle/data_url_css/test.css | 3 | --test-text: url("data:text/plain;charset=utf-8,Lorem ipsum dolor sit amet"); | CODE |
| LOW | …s/specs/bump_version/workspace_manual_version/setup.ts | 20 | await run(["git", "config", "user.email", "test@test.com"]); | CODE |
| LOW | …r/npm/localhost_4260/@denotest/esm-basic/registry.json | 8 | "shasum": "dummy-value", | CODE |
| LOW | tests/unit_node/sqlite_test.ts | 614 | insertStmt.run("John Doe", "john@example.com"); | CODE |
| LOW | tests/unit_node/sqlite_test.ts | 628 | assertEquals(backupUsers[0].name, "John Doe"); | CODE |
| LOW | tests/unit_node/zlib_test.ts | 119 | assert(content.startsWith("Lorem ipsum dolor sit amet"), content); | CODE |
| LOW | tests/unit_node/zlib_test.ts | 119 | assert(content.startsWith("Lorem ipsum dolor sit amet"), content); | CODE |
| LOW | tests/unit_node/stream_test.ts | 30 | assert(content.startsWith("Lorem ipsum dolor sit amet")); | CODE |
| LOW | tests/unit_node/stream_test.ts | 30 | assert(content.startsWith("Lorem ipsum dolor sit amet")); | CODE |
| LOW | tests/unit_node/testdata/lorem_ipsum_512kb.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Lorem | CODE |
| LOW | tests/unit_node/testdata/lorem_ipsum_512kb.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Lorem | CODE |
| LOW | tests/unit_node/testdata/lorem_ipsum.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | tests/unit_node/testdata/lorem_ipsum.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | tests/unit_node/_fs/_fs_handle_test.ts | 149 | const buffer3 = Buffer.from("lorem ipsum"); | CODE |
| LOW | tests/unit_node/_fs/_fs_handle_test.ts | 156 | assertEquals(decoder.decode(data), "hello lorem ipsum"); | CODE |
| LOW | libs/core/benches/snapshot/file.js | 5 | return "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore | CODE |
| LOW | libs/core/benches/snapshot/file.js | 5 | return "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore | CODE |
| LOW | libs/resolver/pnpm_lockfile_import.rs | 600 | /// came from, e.g. `fake-data-pkg@file:packages/…/fake-data-pkg-1.0.0.tgz`, | COMMENT |
| LOW | .github/workflows/npm_publish.ts | 145 | "npm config set //localhost:4873/:_authToken dummy-token", | CODE |
| LOW | .github/workflows/npm_publish.generated.yml | 117 | npm config set //localhost:4873/:_authToken dummy-token | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cli/tools/desktop_devtools.rs | 8 | //! ┌──────────────────────────────────────────┐ | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 15 | //! └──────┬─────────────────────────┬─────────┘ | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 872 | // ─── Unified session (v2) ────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 1448 | // ── sessionId dispatch ──────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 1628 | // ── context name rewriting ──────────────────────────────────────── | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 1697 | // ── /json/list shape ────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 1815 | // ── Target.detachFromTarget dispatch ────────────────────────────── | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 1885 | // ── Malformed / edge-case dispatch ──────────────────────────────── | COMMENT |
| MEDIUM | cli/tools/desktop_devtools.rs | 1904 | // ── End-to-end integration ──────────────────────────────────────── | COMMENT |
| MEDIUM | libs/core/uv_compat/tty.rs | 121 | /// fake_fd (fds[0]) <──────────> int_fd (fds[1]) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ext/cache/01_cache.js | 288 | // Step 5: return the request keys in insertion order. When a request is | COMMENT |
| LOW⚡ | ext/node_crypto/keys.rs | 4598 | // Step 4: I = S || P. | COMMENT |
| LOW⚡ | ext/node_crypto/keys.rs | 4602 | // Step 5: c = ceil(size / u). | COMMENT |
| LOW | ext/node_crypto/keys.rs | 4574 | // Step 1: D = id repeated v bytes. | COMMENT |
| LOW | ext/node_crypto/keys.rs | 4633 | // Step 8: take the first `size` bytes of A. | COMMENT |
| LOW | ext/node/polyfills/internal/streams/readable.js | 1265 | // We need to check if there is someone still listening to | COMMENT |
| LOW | ext/node/polyfills/internal/streams/readable.js | 1284 | // We need to check if there is someone still listening to | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 629 | // Step 3: Run Tarjan's at the node level for computation ordering. | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 633 | // Step 4: Compute NpmPackageIds in topological order. | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 2014 | // Step 2: Add resolved peers to scope so children can see them. | COMMENT |
| LOW⚡ | libs/npm/resolution/graph.rs | 2024 | // Step 3: Recurse into regular children AND resolved peer dep nodes. | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 542 | // Step 1: Build per-node peer info and NV-level adjacency graph. | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 579 | // Step 2: Detect cycles at the NV level using Tarjan's algorithm. | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 1953 | // Step 1: Resolve this node's own peer deps from parent_pkgs FIRST, | COMMENT |
| LOW | libs/npm/resolution/graph.rs | 2210 | // Step 5: Fix circular parent references. When children have | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | cli/tsc/compiler.d.ts | 51 | print(msg: string, stderr: boolean): void; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ext/fs/std_fs.rs | 565 | // TODO: implement chown for Windows | COMMENT |
| LOW | ext/fs/std_fs.rs | 610 | // TODO: implement lchown for Windows | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/registry/npm/csstype/registry.json | 58 | "readme": "# CSSType\r\n\r\n[](https://www.npmjs.com/package/cssty | CODE |
| MEDIUM | tests/registry/npm/imurmurhash/registry.json | 37 | "readme": "iMurmurHash.js\n==============\n\nAn incremental implementation of the MurmurHash3 (32-bit) hashing alg | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/tsc/dts/lib.deno_url.d.ts | 720 | * function handleRequest(req: Request) { | COMMENT |
| LOW | cli/tsc/dts/lib.deno.worker.d.ts | 188 | * function processData(data) { | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | libs/resolver/yarn_lockfile_import.rs | 455 | let input = r#"# This file is generated by running "yarn install" | CODE |