{"id":13727367,"url":"https://github.com/meriyah/meriyah","last_synced_at":"2026-10-19T14:37:58.029Z","repository":{"id":39639604,"uuid":"185327227","full_name":"meriyah/meriyah","owner":"meriyah","description":"A 100% compliant, self-hosted javascript parser  - https://meriyah.github.io/meriyah","archived":false,"fork":false,"pushed_at":"2026-10-17T03:53:05.000Z","size":13749,"stargazers_count":1219,"open_issues_count":7,"forks_count":64,"subscribers_count":18,"default_branch":"main","last_synced_at":"2026-10-18T00:39:20.314Z","etag":null,"topics":["acorn","ast","ecmascript","esnext","estree","javascript","jsx","parser","parsing","performance","stability","tc39","typescript"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"isc","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/meriyah.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2019-05-07T05:32:23.000Z","updated_at":"2026-10-06T13:17:06.000Z","dependencies_parsed_at":"2026-09-13T03:35:49.074Z","dependency_job_id":null,"html_url":"https://github.com/meriyah/meriyah","commit_stats":{"total_commits":704,"total_committers":24,"mean_commits":"29.333333333333332","dds":"0.47443181818181823","last_synced_commit":"8226a6088273eb8af03ae2da5273c58c5bf73566"},"previous_names":[],"tags_count":74,"template":false,"template_full_name":null,"purl":"pkg:github/meriyah/meriyah","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meriyah%2Fmeriyah","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meriyah%2Fmeriyah/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meriyah%2Fmeriyah/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meriyah%2Fmeriyah/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/meriyah","download_url":"https://codeload.github.com/meriyah/meriyah/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meriyah%2Fmeriyah/sbom","scorecard":{"id":636972,"data":{"date":"2025-08-11","repo":{"name":"github.com/meriyah/meriyah","commit":"675d7929b0d4fc2145c22704744c59b3d953ddff"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.8,"checks":[{"name":"Code-Review","score":9,"reason":"Found 27/29 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: topLevel 'contents' permission set to 'read': .github/workflows/node.js.yml:13","Warn: topLevel 'contents' permission set to 'write': .github/workflows/update-test262.yml:11","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/node.js.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/node.js.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/node.js.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/node.js.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/node.js.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-test262.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/update-test262.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-test262.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/update-test262.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-test262.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/update-test262.yml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-test262.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/meriyah/meriyah/update-test262.yml/main?enable=pin","Info:   0 out of   8 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE.md:0","Info: FSF or OSI recognized license: ISC License: LICENSE.md:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 28 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-21T09:27:58.026Z","repository_id":39639604,"created_at":"2025-08-21T09:27:58.026Z","updated_at":"2025-08-21T09:27:58.026Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38336268,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-18T02:00:06.448Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acorn","ast","ecmascript","esnext","estree","javascript","jsx","parser","parsing","performance","stability","tc39","typescript"],"created_at":"2024-08-03T01:03:52.153Z","updated_at":"2026-10-19T14:37:58.022Z","avatar_url":"https://github.com/meriyah.png","language":"TypeScript","funding_links":[],"categories":["TypeScript"],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003eMeriyah\u003c/h1\u003e\n\n\u003cp align=\"center\"\u003e 100% compliant, self-hosted javascript parser with high focus on both performance and stability. Stable and already used in production.\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n    \u003ca href=\"https://www.npmjs.com/package/meriyah\"\u003e\u003cimg src=\"https://img.shields.io/npm/v/meriyah.svg?style=flat-square\" alt=\"Meriyah NPM\"/\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/meriyah/meriyah/actions/workflows/node.js.yml?query=branch%3Amain\"\u003e\u003cimg src=\"https://img.shields.io/github/actions/workflow/status/meriyah/meriyah/node.js.yml?branch=main\u0026label=test\u0026style=flat-square\" alt=\"Node.js CI\"/\u003e\u003c/a\u003e\n    \u003ca href=\"https://app.codecov.io/gh/meriyah/meriyah\"\u003e\u003cimg src=\"https://img.shields.io/codecov/c/github/meriyah/meriyah?style=flat-square\" alt=\"Coverage\"/\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/meriyah/meriyah/blob/master/LICENSE.md\"\u003e\u003cimg src=\"https://img.shields.io/github/license/meriyah/meriyah.svg?style=flat-square\" alt=\"License\" /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cbr\u003e\n\n[Interactive Playground](https://meriyah.github.io/meriyah)\n[Benchmark](https://meriyah.github.io/meriyah/performance)\n\n## Features\n\n- Conforms to the standard ECMAScript® 2024 (ECMA-262 15th Edition) language specification\n  - See [RegExp support](#regexp-support)\n- Support some TC39 stage 3 proposals via option \"next\"\n- Support for additional ECMAScript features for Web Browsers (Annex B)\n- JSX support via option \"jsx\"\n- Does **NOT** support TypeScript or Flow syntax\n- Track syntactic node locations with option \"ranges\" or \"loc\"\n- Emits an ESTree-compatible abstract syntax tree\n- No backtracking\n- Low memory usage\n\n## ESNext Stage 3 features\n\n### Supported stage 3 features:\n\nThese features need to be enabled with the `next` option.\n\n- [Decorators](https://github.com/tc39/proposal-decorators)\n- [Source Phase Imports](https://github.com/tc39/proposal-source-phase-imports)\n- [Deferring Module Evaluation](https://github.com/tc39/proposal-defer-import-eval)\n\n## RegExp support\n\nMeriyah doesn't parse RegExp internal syntax, ESTree spec didn't require internal structure of RegExp. Meriyah\ndoes use JavaScript runtime to validate the RegExp literal by default. That means Meriyah's RegExp support is only as good\nas JavaScript runtime's RegExp support.\n\nAs of May 2025, some latest RegExp features requires Node.js\u003e=24.\n\n- [RegExp modifiers](https://github.com/tc39/proposal-regexp-modifiers)\n- [RegExp duplicate named groups](https://github.com/tc39/proposal-duplicate-named-capturing-groups)\n\nUse `validateRegex: false` if you want consistent behavior in different environments or don't need errors for invalid RegExp.\n\n## Installation\n\n```sh\nnpm install meriyah --save-dev\n```\n\n## API\n\nMeriyah generates `AST` according to [ESTree AST format](https://github.com/estree/estree), and can be used to perform [syntactic analysis](https://en.wikipedia.org/wiki/Parsing) (parsing) of a JavaScript program, and with `ES2015` and later a JavaScript program can be either [a script or a module](https://tc39.github.io/ecma262/index.html#sec-ecmascript-language-scripts-and-modules).\n\nThe `parse` method exposed by meriyah takes an optional `options` object which allows you to specify whether to parse in [`script`](https://tc39.github.io/ecma262/#sec-parse-script) mode (the default) or in [`module`](https://tc39.github.io/ecma262/#sec-parsemodule) mode.\n\n```js\nimport { parse } from 'meriyah';\nconst result = parse('let some = \"code\";', { ranges: true });\n```\n\nThe available options:\n\n```ts\n{\n  // Indicate the mode the code should be parsed in 'script', 'module', or 'commonjs' mode, default `'script'`\n  sourceType: 'script' | 'module' | 'commonjs';\n\n  // The flag to enable stage 3 support (ESNext), default `false`\n  next: boolean;\n\n  // Enable start/end offsets to each node, default `false`\n  // true: emit start, end, and range: [start, end] (backwards compatible)\n  // object: selectively enable { start, end, range } — e.g. { start: true, end: true }\n  ranges: boolean | { start?: boolean; end?: boolean; range?: boolean };\n\n  // Enable web compatibility, default `false`\n  webcompat: boolean;\n\n  // The flag to enable line/column location information to each node, default `false`\n  loc: boolean;\n\n  // The flag to attach raw property to each literal and identifier node, default `false`\n  raw: boolean;\n\n  // The flag to enable implied strict mode, default `false`\n  impliedStrict: boolean;\n\n  // Allows comment extraction. Accepts either a function or array, default `undefined`\n  onComment: [];\n\n  // Allows detection of automatic semicolon insertion. Accepts a callback function that will be passed the character offset where the semicolon was inserted, default `undefined`\n  onInsertedSemicolon: (position: number) =\u003e {};\n\n  // Allows token extraction. Accepts either a function or array, default `undefined`\n  onToken: [];\n\n  // Enable non-standard parenthesized expression node, default `false`\n  preserveParens: boolean;\n\n  // Enable lexical binding and scope tracking, default `false`\n  lexical: boolean;\n\n  // Adds a source attribute in every node’s loc object when the locations option is `true`\n  source: string; // Set to source: 'source-file.js'\n\n  // Enable React JSX parsing, default `false`\n  jsx: boolean;\n\n  // Validate regular expressions with runtime, default `true`\n  validateRegex: boolean;\n}\n```\n\n### onComment and onToken\n\nIf an array is supplied, comments/tokens will be pushed to the array, the item in the array contains `start/end/range` information when ranges flag is true, it will also contain `loc` information when loc flag is true.\n\nIf a function callback is supplied, the signature must be\n\n```ts\ndeclare function onComment(type: string, value: string, start: number, end: number, loc: SourceLocation): void;\n\ndeclare function onToken(token: string, start: number, end: number, loc: SourceLocation): void;\n```\n\nNote the `start/end/loc` information are provided to the function callback regardless of the settings on ranges and loc flags. onComment callback has one extra argument `value: string` for the body string of the comment.\n\n### onInsertedSemicolon\n\nIf a function callback is supplied, the signature must be\n\n```ts\ndeclare function onInsertedSemicolon(position: number): void;\n```\n\n### `isParseError`\n\nExposed for error instance checking.\n\n```js\nimport { parse, isParseError } from './meriyah';\n\ntry {\n  parse('invalid code');\n} catch (error) {\n  if (isParseError(error)) {\n    console.error(error.description);\n  } else {\n    throw error;\n  }\n}\n```\n\n## Example usage\n\n```js\nimport { parse } from './meriyah';\n\nparse('({x: [y] = 0} = 1)');\n```\n\nThis will return when serialized in json:\n\n```js\n{\n    type: \"Program\",\n    sourceType: \"script\",\n    body: [\n        {\n            type: \"ExpressionStatement\",\n            expression: {\n                type: \"AssignmentExpression\",\n                left: {\n                    type: \"ObjectPattern\",\n                    properties: [\n                        {\n                            type: \"Property\",\n                            key: {\n                                type: \"Identifier\",\n                                name: \"x\"\n                            },\n                            value: {\n                                type: \"AssignmentPattern\",\n                                left: {\n                                    type: \"ArrayPattern\",\n                                    elements: [\n                                        {\n                                            \"type\": \"Identifier\",\n                                            \"name\": \"y\"\n                                        }\n                                    ]\n                                },\n                                right: {\n                                    type: \"Literal\",\n                                    value: 0\n                                }\n                            },\n                            kind: \"init\",\n                            computed: false,\n                            method: false,\n                            shorthand: false\n                        }\n                    ]\n                },\n                operator: \"=\",\n                right: {\n                    type: \"Literal\",\n                    value: 1\n                }\n            }\n        }\n    ]\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeriyah%2Fmeriyah","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmeriyah%2Fmeriyah","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeriyah%2Fmeriyah/lists"}