unicode-ident

This crate does exactly one thing: determines if characters are valid Unicode identifiers per UAX #31. The entire API is four functions (is_xid_start, is_xid_continue, and their _ascii variants), making it trivial to audit. I've used this in lexers and parsers where identifier validation matters for security—you don't want injection attacks through weird Unicode edge cases.

From a security perspective, this is a model crate. Zero dependencies, no network calls, no filesystem access, deterministic lookup tables generated from Unicode data. The implementation is just const tables and range checks—no complex logic means no hidden vulnerabilities. Errors are impossible because it only returns bools for char inputs.

The _ascii variants are particularly useful when you want to restrict identifiers to ASCII-only for security policies or backwards compatibility. Having both variants lets you enforce stricter rules in security-sensitive contexts while supporting full Unicode elsewhere.

This crate does exactly one thing: check if characters are valid Unicode identifier starts or continuations per UAX #31. In production, it's completely invisible in the best possible way. The API is two simple functions (is_xid_start/is_xid_continue) that compile down to efficient table lookups with zero allocation. Performance is predictable and excellent - we've used it in hot parsing paths without any measurable overhead.

The crate has no dependencies, no configuration, and no runtime behavior to tune. It just works. The Unicode data is embedded at compile time, so there's no file I/O, no initialization phase, and no failure modes to handle. Updates track Unicode versions reliably, and version bumps have been completely painless - just data table updates with no API changes.

For compiler/parser/lexer work where you need spec-compliant identifier validation, this is the definitive solution. It's the kind of dependency you add once and never think about again.

This is exactly what a low-level security-critical library should be: minimal, focused, and completely transparent. The API is dead simple—two functions (is_xid_start, is_xid_continue) that do exactly what they say. No configuration needed, no surprises. I've used this extensively in parser and lexer implementations where validating identifiers against Unicode standards is essential.

From a security perspective, this is exemplary. It's a pure lookup table with no network calls, no file I/O, no dependencies beyond std. The implementation is deterministic and side-effect free, making it impossible to introduce injection vulnerabilities or timing attacks through this layer. Error handling is not applicable here—invalid inputs simply return false, which is the correct behavior for validation.

The library follows Unicode Standard Annex #31 precisely, which means your identifier validation will be consistent with Unicode specifications. This matters when building compilers, code analyzers, or anything parsing programming languages where identifier rules must be correct.