fix: reject a float exponent without digits

Assisted-by: GLM 5.3 Flash

number.go

@@ -74,15 +74,16 @@ func decodeFloat(tok string) (any, error) {
 	sign, s := splitSign(tok)
 
 	mantissa, exp := s, ""
+	hasExp := false
 	if i := strings.IndexAny(s, "eE"); i >= 0 {
-		mantissa, exp = s[:i], s[i+1:]
+		mantissa, exp, hasExp = s[:i], s[i+1:], true
 	}
 
 	intPart, frac, hasDot := mantissa, "", false
 	if i := strings.IndexByte(mantissa, '.'); i >= 0 {
 		intPart, frac, hasDot = mantissa[:i], mantissa[i+1:], true
 	}
-	if !hasDot && exp == "" {
+	if !hasDot && !hasExp {
 		return nil, fmt.Errorf("invalid float %q", tok)
 	}
 
@@ -102,7 +103,9 @@ func decodeFloat(tok string) (any, error) {
 		}
 		build += "." + fp
 	}
-	if exp != "" {
+	// The ABNF requires at least one digit after the exponent marker, so a
+	// trailing e or E is an error even though strconv would accept it.
+	if hasExp {
 		esign, edigits := splitSign(exp)
 		ed, err := joinDigits(edigits, isDecDigit)
 		if err != nil {