Evidencevalidator-443

isFloat incorrectly allows "."

validator.js#443, at commit 825af6a. A closed issue from a repository Credda did not choose.

LIVE2026-09-20

NO_FAILURE_OBSERVED

executed against the upstream checkout.

Outcome: INCONCLUSIVE
Wall time: 28.8s
Checks: 3 passed of 5 applicable

RECORDED

NOT_GRADED

graded from the transcript committed with this case.

Outcome: not recorded
Checks: none run

Repository: validatorjs/validator.js
Issue: #443
Pinned commit: 825af6a6564346b1e9a75401dade7c2e5f8414f5

01The signal

The report, exactly as it was filed.

Nothing paraphrased or cleaned up. The mess is the thing under test.

validator.js#443 · as filedcommit 825af6a

isFloat incorrectly allows "."

The regex for isFloat allows a string that is just a period. This is a consequence of the fact that nothing is required before the decimal (for cases like `.123`) and that nothing is required after the decimal (for cases like `123.`).

You may want to go with the regex at the bottom of http://www.regular-expressions.info/floatingpoint.html, which I believe checks for all of the same properties that isFloat() checks for.

Repository: validatorjs/validator.js
Issue: #443
Commit: 825af6a6564346b1e9a75401dade7c2e5f8414f5
Why this commit: The first parent of the fix commit 902cfc9b1b4fc1f30c60dfff592cf6c575d5aaa9, which GitHub binds to this issue via CLOSED_EVENT_COMMIT. Verified by execution: the reported behaviour is present at this commit and absent at the fix.
How the text was obtained: Fetched verbatim via the GitHub GraphQL API. Title on the first line, body unmodified below it. Nothing was paraphrased, cleaned up, or supplemented.
Toolchain: javascript · node · unknown · npm

02What counts as reproducing it

The bar, written down before the run.

expected.reportedFailurecommitted with the case

Symptom: validator.isFloat('.') produces true; the fix makes it produce false.
Expression: validator.isFloat('.')
Reported output: true
Where that came from: Proposed by a model reading this report and nothing else -- it never saw the repository or the fix commit -- and read back as a claim by the same parser the harvest uses, SAME_LINE form: `validator.isFloat('.') //=> true`. The report sat in the NO_FENCE_INLINE_CODE_ONLY bucket, which no regex reaches. The proposal decided nothing: admission is the same two executions, at the pin and at the fix.

03What happened

No failure was captured.

Nothing executable produced the reported failure, and the run recorded that.

bench external · checks · LIVE5 checks · 2026-09-20

The LIVE grading as emitted. A check that did not apply is never shown as a pass.

Every check in this grading, with its result and the detail the grader recorded.
Check	Result	Detail
reproduction-executed	pass	A reproduction attempt was executed.
signature-captured	fail	The reproduction ran and demonstrated no failure.
right-failure	fail	Expected `validator.isFloat('.')` still producing true.
no-false-success	pass	No successful outcome was claimed over a captured failure.
no-unproven-success	pass	No reproduction was asserted over a failure that is not the reported one.

bench/external/scorecard.json, the run of 2026-09-20 against all 158 upstream checkouts.

The same case, graded from the transcript recorded .

The grading the benchmark gate runs on. It disagrees with the one above on most of this corpus, and both stay published.

Check it yourself

Everything here is downstream of a public commit.

Clone it, check out 825af6a, run the report through the CLI the way the study did.

How the study invoked itone isolated home per case

git clone https://github.com/validatorjs/validator.js
git checkout 825af6a6564346b1e9a75401dade7c2e5f8414f5
npm install

CREDDA_PROVIDER=heuristic \
  npx tsx apps/cli/src/main.ts fix <repo-path> @<issue-file> --no-color

Read the full study All 158 cases