npm / @rolldown/binding-linux-x64-gnu / 1.2.15

@rolldown/binding-linux-x64-gnu 1.2.15

Source: https://github.com/rolldown/rolldown
Tag scanned: v1.2.15
Compared with: v1.2.14 (26 signals introduced since)
Files: 9675 scanned, 4531 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 99 warn · 222 info
Scan time: 86.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): the 122 most severe of 221 warn and critical signals (122 with a verdict); 122 demoted to info. The rest are unreviewed.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 03:16

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn dynamic-import crates/rolldown/tests/rolldown/function/experimental/strict_execution_order/cross_chunk_dynamic_importer_uses_call_site_trigger/_test.mjs:16:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const { aTargetPromise } = await import(new URL('./dist/a.js', import.meta.url));
const nsFromA = await aTargetPromise;
assert.strictEqual(nsFromA.value, 1);
```
warn dynamic-import crates/rolldown/tests/rolldown/function/experimental/strict_execution_order/cross_chunk_dynamic_importer_uses_call_site_trigger/_test.mjs:30:47

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const implementationModules = await Promise.all(
  implementationSpecifiers.map((specifier) => import(new URL(specifier, aOutputUrl))),
);
const targetNamespace = implementationModules
```
warn dynamic-import crates/rolldown/tests/rolldown/function/experimental/strict_execution_order/standalone_cjs_entry_node_module/_test.mjs:8:16

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
const bundlePath = fileURLToPath(new URL('./dist/main.js', import.meta.url));
const bundle = require(bundlePath);
const cli = spawnSync(process.execPath, [bundlePath], { encoding: 'utf8' });
```
warn dynamic-import crates/rolldown/tests/rolldown/function/external/external_named_export_live_bindings/_test.mjs:10:9

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
    globalThis.__configName === 'esm'
      ? import(`./dist/${entry}.js`)
      : require(`./dist/${entry}.js`),
  ),
```
warn dynamic-import crates/rolldown/tests/rolldown/function/external/external_named_export_live_bindings/_test.mjs:11:9

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
      ? import(`./dist/${entry}.js`)
      : require(`./dist/${entry}.js`),
  ),
);
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/11013/main.js:4:17

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  const existing = './dep.js';
  return [await import(a), await import(existing), await import('no-such-\u0070kg-h')];
}
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/11013/main.js:4:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  const existing = './dep.js';
  return [await import(a), await import(existing), await import('no-such-\u0070kg-h')];
}
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/1443/main.js:1:27

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
module.exports = (mod) => require(mod);
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/2833/main.js:4:3

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  window.foo; // to prevent inlining `path`
  import(path);
}
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/6263/main.js:3:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
await import(/* @vite-ignore */ p);
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/6943/lib.js:2:3

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
export function tryPatchHandler(taskRoot, handlerPath) {
  require(taskRoot);
}
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/8989/_test.mjs:13:9

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
for (const entry of ['entry0.js', 'entry1.js', 'entry2.js', 'entry3.js']) {
  await import(`./dist/${entry}`);
}
```

warn dynamic-import crates/rolldown/tests/rolldown/issues/9320/_test.mjs:22:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

const distDir = path.join(import.meta.dirname, 'dist');
await import(pathToFileURL(path.join(distDir, 'main.js')).href);
await globalThis.__9320_done;

warn dynamic-import crates/rolldown/tests/rolldown/issues/9320_single_export/_test.mjs:11:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

const distDir = path.join(import.meta.dirname, 'dist');
await import(pathToFileURL(path.join(distDir, 'main.js')).href);
await globalThis.__9320_single_export_done;

warn dynamic-import crates/rolldown/tests/rolldown/issues/9320_star/_test.mjs:10:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

const distDir = path.join(import.meta.dirname, 'dist');
await import(pathToFileURL(path.join(distDir, 'main.js')).href);
await globalThis.__9320_star_done;

warn dynamic-import crates/rolldown/tests/rolldown/issues/9463/_test.mjs:14:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

// Load ONLY entry `b`.
await import(new URL('./dist/b.js', import.meta.url));
// Let the dynamic `import('./shared.js')` continuation settle.
await new Promise((resolve) => setTimeout(resolve, 0));

warn dynamic-import crates/rolldown/tests/rolldown/issues/9463/_test.mjs:29:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

// Sanity: entry `a`'s side effect is not dead — it runs when `a` itself is loaded.
await import(new URL('./dist/a.js', import.meta.url));
assert.ok(
  globalThis.sideEffectLog.includes('a'),

warn dynamic-import crates/rolldown/tests/rolldown/issues/9463_plain_group/_test.mjs:6:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
globalThis.sideEffectLog = [];
await import(new URL('./dist/b.js', import.meta.url));
await new Promise((resolve) => setTimeout(resolve, 0));
```
warn dynamic-import crates/rolldown/tests/rolldown/issues/9463_three_entries/_test.mjs:6:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
globalThis.sideEffectLog = [];
await import(new URL('./dist/b.js', import.meta.url));
await new Promise((resolve) => setTimeout(resolve, 0));
```
warn dynamic-import crates/rolldown/tests/rolldown/misc/require_deconflict/main.js:2:45

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
export const __require = 'test';
export default () => require('test-dep') || require(`test-dep${666}`);
```
warn dynamic-import crates/rolldown/tests/rolldown/optimization/chunk_merging/already_loaded_cjs_format/_test.mjs:13:16

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
try {
  const main = require(join(import.meta.dirname, 'dist', 'main.js'));
  keys = await main.done;
} finally {
```
warn dynamic-import crates/rolldown/tests/rolldown/topics/dynamic_import_options/non_static_specifier_in_cjs/main.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
// Non-static specifier, one argument: lowered to `require`.
import(moduleName).then(console.log);

// Non-static specifier with attributes: kept as a native `import()`.
```

warn dynamic-import crates/rolldown/tests/rolldown/topics/dynamic_import_options/non_static_specifier_in_cjs/main.js:5:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

// Non-static specifier with attributes: kept as a native `import()`.
import(moduleName, { with: { type: 'json' } }).then(console.log);

// `@vite-ignore` suppresses the import record the same way.

warn dynamic-import crates/rolldown/tests/rolldown/topics/dynamic_import_options/non_static_specifier_in_cjs/main.js:8:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
// `@vite-ignore` suppresses the import record the same way.
import(/* @vite-ignore */ './ignored.js', { with: { type: 'json' } }).then(console.log);
```

warn encoding-base64 crates/rolldown/tests/rolldown/topics/new_url/dataurl/main.js:2:27

base64-like blob (3440 bytes, compression ratio 0.76) (raw pass, confidence 0.60)

  'data:image/webp;base64,UklGRgoKAABXRUJQVlA4WAoAAAAQAAAAXwAAXwAAQUxQSIACAAABkCNt/5tGP42DZjSqVEmjFs4htY6lnCqoUsNNuEA6gAMVJ9iIKyqcGMeOWIY/3v9vAyDp//9m64iYAFLTcMJytdV5niwkzycvt61qKXAMQume1+6WnODyrnbhAvArXwWnuPha8bXaOm4LTl20j7Z0sUp9VrRfsHQwix+s8HvBVG6vx4r39tTyLn+x8vLSU8c4G7GWo1NDEbshWVPZtJXIdFnjblaBYMBaD8PUohlrPo9SygnWXu

warn dynamic-import crates/rolldown/tests/rolldown/tree_shaking/require_module_determined_in_runtime/foo.js:2:3

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
export default function applyExtends(config) {
  require(config.extends);
}
```

warn dynamic-import crates/rolldown_plugin_hmr/src/runtime/runtime-extra-dev-default.js:102:7

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

    if (typeof process === 'object') {
      import(data.path);
      console.debug(`[hmr]: Importing HMR patch: ${data.path}`);
    } else {

warn dynamic-import crates/rolldown_plugin_lazy_compilation/src/proxy-module-template-fetched.js:2:9

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const lazyExports = (async () => {
  await import($MODULE_ID);
  return __rolldown_runtime__.loadExports($STABLE_MODULE_ID);
})();
```

warn dynamic-import crates/rolldown_plugin_lazy_compilation/src/proxy-module-template.js:8:9

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  // We send the proxy module ID (with ?rolldown-lazy=1) so the server can mark it as fetched.
  await import(
    /* @vite-ignore */ `/@vite/lazy?id=${encodeURIComponent($PROXY_MODULE_ID)}&clientId=${__rolldown_runtime__.clientId}`
  );

warn encoding-base64 docs/in-depth/directives.md:32:114

base64-like blob (220 bytes, compression ratio 0.90) (raw pass, confidence 0.60)

rict mode scope ([REPL](https://repl.rolldown.rs/#eNptjk0KAyEMha8SsrGF4gGE3mQ24mhxsMmgsR0YvHu1pT+LbpJ8L+G97BjQ7Bhp9pteypgJzZdP6Dr6beUsRQdmOEOo5CQygT0cYZ8IQNXioUiOTtTg7KVmAtXvO7eJuo9HI7n6dsLMKc18J+2YQrxo+cT+2fw+ALMPtibpoXnEcJW1inkjQOB8tV1QbinqJbbRngVbz751s2TFF8H2AIc5VRY=))

warn encoding-base64 docs/in-depth/directives.md:33:111

base64-like blob (292 bytes, compression ratio 0.86) (raw pass, confidence 0.60)

an entry module ([REPL](https://repl.rolldown.rs/#eNptUEtuhDAMvYqVDVCN6Kobuuw12FBwpqmCQx2nTYVy9zGD5qPRbJK8Z7+PshprutU4mjC333F7k+lu+GBGhVWKCFHYjVK99+TmJbDA1/+C/JE+ESyHGar2Nf6kgVF121ZPY6AYPLY+HOvrcv3WNDpVZzSdcMJyMFfdJf9GPC3QE+ZzhQntkLyATTSKCwS7sM4NrD0BMEpiggwvkFVXNFfjOHg/hT9qtaB1x7vcJ5O9wEPe2vNmH5IsSboLBLCB50GJatQ/2MmyXe

warn encoding-base64 docs/in-depth/directives.md:34:117

base64-like blob (316 bytes, compression ratio 0.86) (raw pass, confidence 0.60)

les` is enabled ([REPL](https://repl.rolldown.rs/#eNptkE1uhDAMha9iZQNUiK66ocuuewM2FJwpVYip40ypUO5eZxAz1Wg2Sfzz/L14M9a0m5n8iGvzFfLbm/YW12bQsIgBIQhPgxSvnZ/mhVjg83dBfosfCJZphqJ5Dt+xZ1Rd7ur8QD6Qw8bRqbw2ly9VpVWdjKYVjphqc9Ud/FvioQFcLwZGtH10Ajb6QSbysMvKtYKt8wCMEtnDCk+wqiopVWFMzo304xu1Z6fTP+qDyo6/420d5/EUZYnSHiGAJZ57TRSDbqA+sg

warn encoding-base64 docs/in-depth/directives.md:42:81

base64-like blob (220 bytes, compression ratio 0.90) (raw pass, confidence 0.60)


- The directive is not in the top-level scope ([REPL](https://repl.rolldown.rs/#eNptjt0KwyAMhV8l5MYNig8g7E16I1ZHi02Kxq1QfPfpxn4udpPkOwnn5MCA5sCZJr/rJfeZ0Hx5QNfQ7xsnyTowwwVCISczE9jTGY6RAFTJHlzJwqvqnLyURKDafeM6UvPxaCQVXwdMHOPEd9KOKcxXLZ/YP5vfB2DywZYoLTT1GC6yFTFvBAicVtsE5ZasXmLt7VmwtuxbM4tWfBasD4hqVRg=))

warn encoding-base64 docs/in-depth/directives.md:43:110

base64-like blob (300 bytes, compression ratio 0.86) (raw pass, confidence 0.60)

 a entry module ([REPL](https://repl.rolldown.rs/#eNptUM1OwzAMfhUrl7ZolBOXcuQ1eimtM4pSuzgOdKr67riLtiHYJYn9/Sqr865Z3UgDLvVH3N/kmtt8cL2NRYoIfYrK0yOSyql4aWmcZhaF99OM8preELzwBEX9FD9TJ2jqndVSzxQ5YB34WF7J5XNVGWr+6BqVhNvBXXWXFrfF/xoZywm4nJsM6LsUFHyiXkcmyJxyqWBtCUBQkxAs8ACL6TaLt1ThEAb+ptp6+vH4K/4Oknv8yVtb2e056Zy0uYwAnmXqbFH09h

warn encoding-base64 docs/in-depth/directives.md:44:117

base64-like blob (328 bytes, compression ratio 0.85) (raw pass, confidence 0.60)

les` is enabled ([REPL](https://repl.rolldown.rs/#eNptkM9ShDAMxl8l0wvgIJ684NGzb8AFIV1xSoNps7LD8O6mMOw6upe2+fPl+zWLsaZezOB7nKvPkN7e1Le4NJ2GmQSETkKk8RF95Ev20vhhnIgjfFwm5Fd5R7BMI2TVU/iSllHVqavxHflADitHp/zanD8XhVZ1Ppo6suBamqvuoLgl/mOM1IvD5IDzxtGjbcVFsOK7OJCHXZ3PBSyNB2CMwh5meIBZVauaqyeTcz19+0op7XD6ZX6nslP88VsaTuNJ4iSxPkIASz

warn long-line internal-docs/code-splitting/implementation.md:118:1

line length 2036 characters (raw pass, confidence 0.65)

`create_order_wrap_entry_facades` and `restore_order_wrap_entry_facades` share one statement-aware scan of live dynamic importers. When a pure dynamic entry has a synchronous activation target and every surviving call site can be rewritten, the create path avoids minting a strict-only facade (or the restore path leaves

warn long-line internal-docs/code-splitting/implementation.md:188:1

line length 2158 characters (raw pass, confidence 0.65)

On top of the base, `entry_export_service_targets` models the imports `register_entry_export_depended_symbols` creates: an entry chunk imports the canonical symbol of every live resolved export it serves (plus re-exported ESM wrapper inits), even when no included statement of the entry references it — an unused re-ex

warn dynamic-import internal-docs/lazy-compilation/design.md:122:9

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  // We send the proxy module ID (with ?rolldown-lazy=1) so the server can mark it as fetched.
  await import(
    /* @vite-ignore */ `/@vite/lazy?id=${encodeURIComponent($PROXY_MODULE_ID)}&clientId=${__rolldown_runtime__.clientId}`
  );

warn dynamic-import internal-docs/lazy-compilation/design.md:144:9

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const lazyExports = (async () => {
  await import($MODULE_ID);
  return __rolldown_runtime__.loadExports($STABLE_MODULE_ID);
})();
```
warn dynamic-import internal-docs/module-tags/implementation.md:87:3

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(/* rolldownEntryName: 'admin' */ './admin-panel.js');
  // rolldown automatically tags reachable modules with $entry:admin
  
```

warn dynamic-import packages/rolldown/build.ts:254:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

async function buildRuntimeEntry() {
  const helperNames = Object.keys(await import(pathToFileURL(runtimeBaseInputFile).href));
  await build({
    input: { 'experimental-runtime': commonRuntimeInputFile },

warn dynamic-import packages/rolldown/src/binding.cjs:69:31

`require` called with a non-literal specifier (ast pass, confidence 0.60)

    try {
      const overrideBinding = require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH)
      // The override may be a generated WASI loader, which already reports its
      // own flavor. Adopt it: `module.exports` aliases this object, so claiming

warn dynamic-import packages/rolldown/src/parallel-plugin-worker.ts:15:36

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

      pluginInfos.map(async (pluginInfo) => {
        const pluginModule = await import(pluginInfo.fileUrl);
        const definePluginImpl = pluginModule.default as ReturnType<
          typeof defineParallelPluginImplementation

warn dynamic-import packages/rolldown/src/utils/load-config.ts:81:19

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  try {
    return (await import(pathToFileURL(file).href)).default;
  } finally {
    fs.unlink(file, () => {}); // Ignore errors

warn dynamic-import packages/rolldown/src/utils/load-config.ts:152:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)

  // Runtimes without Module-hook support (e.g. Bun/Deno)
  const mod = await import(url + '?t=' + Date.now());
  return mod.default;
}

warn dynamic-import packages/rolldown/src/utils/load-config.ts:182:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

    ) {
      return (await import(pathToFileURL(configPath).href)).default;
    } else if (SUPPORTED_TS_CONFIG_FORMATS.includes(ext)) {
      const rawConfigPath = path.resolve(configPath);

warn dynamic-import packages/rolldown/src/webcontainer-fallback.cjs:21:18

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
module.exports = require(bindingEntry);
```

warn dynamic-import packages/rolldown/tests/behaviors/dependency-path-escaping.test.ts:70:72

`require` called with a non-literal specifier (ast pass, confidence 0.60)

            const define = (ids: string[], factory: (...args: unknown[]) => void) => {
              factory(...ids.map((id) => (id === 'exports' ? exports : require(id))));
            };
            define.amd = true;

warn dynamic-import packages/rolldown/tests/behaviors/inline-common-chunks/run-root.mjs:44:29

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  try {
    const namespace = await import(pathToFileURL(file).href);
    await globalThis.__chain;
    root.exports = Object.fromEntries(
```

warn dynamic-import packages/rolldown/tests/dev/dev-lazy-compile.test.ts:582:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)


    const { DevRuntime } = await import(import.meta.resolve('rolldown/experimental/runtime'));
    const runtime = new DevRuntime('require-unused-client');
    runtime.hooks = {

warn dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:12:53

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  const runtimeUrl = import.meta.resolve('rolldown/experimental/runtime');
  const { DevRuntime, MissingFactoryError } = await import(runtimeUrl);
  return { runtime: new DevRuntime('test-client') as any, MissingFactoryError };
}

warn dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:31:31

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

test('the runtime entry exports only the runtime classes', async () => {
  const runtimeModule = await import(import.meta.resolve('rolldown/experimental/runtime'));
  expect(Object.keys(runtimeModule).sort()).toStrictEqual(['DevRuntime', 'MissingFactoryError']);
});

warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function singleDir(name) {
  return import(`./dir/a/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function multiDirs(dir, name) {
  return import(`./dir/${dir}/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function noFile(name) {
  return import(/* hello */ `./dir/c/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withAlias(name) {
  return import(/** @vite-ignore */ `@/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withIgnoreTag(name) {
  return import(/* @vite-ignore */ `./dir/a/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/filter/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function dynamicImport(name) {
  return import(`./mod/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-after-paren.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withCommentAfterParen(name) {
  return import(/* comment */ `./dir/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-before-paren.js:3:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // oxfmt-ignore
  return import /* comment */ (`./dir/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function basic(base) {
  return import(`./mods/${base}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPath(base) {
  return import(`@/${base}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPathWithMultiParentDir(base) {
  return import(`#/${base}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQuery(base) {
  return import(`./mods/${base}.js?foo=bar`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryRaw(base) {
  return import(`./mods/${base}.js?raw`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:22:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryUrl(base) {
  return import(`./mods/${base}.js?url`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:26:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function wildcardInVariables(base) {
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:32:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:38:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mo?ds/${base ?? foo}.js?worker`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:42:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withParentDirAndItself(name) {
  return import(`../dynamicImportVar/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:46:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withMultiParentDirAndItself(name) {
  return import(`../../plugins/dynamicImportVar/${name}.js`);
}
```
warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:17:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  async afterTest() {
    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);
```

warn dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:18:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);

    expect(Object.hasOwn(producer, 'module.exports')).toBe(true);

warn dynamic-import packages/rolldown/tests/fixtures/misc/rolldown-file-url/_config.ts:36:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(

warn dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:30:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  afterTest: async () => {
    const main = await import('./dist/main.js' as string);
    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);

warn dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:32:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);
    expect(dep.default).toBe('dep.js');
  },

warn dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url/_config.ts:38:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(

warn dynamic-import packages/rolldown/tests/fixtures/output/es-module/common-chunks/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
warn dynamic-import packages/rolldown/tests/fixtures/output/es-module/false/_config.ts:24:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
warn dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-false/_config.ts:26:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
warn dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-true/_config.ts:26:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
warn dynamic-import packages/rolldown/tests/fixtures/output/es-module/true/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
warn dynamic-import packages/rolldown/tests/fixtures/output/minify/dce-only/main.js:3:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(/* @vite-ignore annotation comment is kept */ 'node:module');

export function foo() {
```

warn encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:18:52

base64-like blob (188 bytes, compression ratio 0.90) (raw pass, confidence 0.60)

    expect(output.output[0].map!.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbi5qcyIsIm5hbWVzIjpbXSwic291cmNlcyI6WyIuLi9tYWluLmpzIl0sInNvdXJjZXNDb250ZW50IjpbImNvbnNvbGUubG9nKGZvbyk7XG4iXSwibWFwcGluZ3MiOiI7QUFBQSxRQUFRLElBQUksR0FBRyJ9"`,
    );

warn encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:26:52

base64-like blob (192 bytes, compression ratio 0.89) (raw pass, confidence 0.60)

    expect(map.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbjIuanMiLCJuYW1lcyI6W10sInNvdXJjZXMiOlsiLi4vbWFpbi5qcyJdLCJzb3VyY2VzQ29udGVudCI6WyJjb25zb2xlLmxvZyhmb28pO1xuIl0sIm1hcHBpbmdzIjoiO0FBQUEsUUFBUSxJQUFJLEdBQUcifQ=="`,
    );
  },

warn encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:233:53

base64-like blob (192 bytes, compression ratio 0.86) (raw pass, confidence 0.60)

        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsQ0FBQyxDQUFDLENBQU8sQ0FBQyxDQUFDIn0=',
      );

warn encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:319:53

base64-like blob (180 bytes, compression ratio 0.91) (raw pass, confidence 0.60)

        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsR0FBRyxHQUFNLENBQUMifQ==',
      );

warn dynamic-import packages/rolldown/tests/src/load-binding.ts:17:10

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
  }
  return require(`../../dist/${bindingFile}`);
}
```

warn long-line packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:11670:1

line length 4052 characters (raw pass, confidence 0.65)

  /^(?:children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|

warn long-line packages/rolldown/tests/stability/issue-3453/src/lib/file37.js:37:1

line length 3972 characters (raw pass, confidence 0.65)

      /^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|ce

warn dynamic-import packages/rollup-tests/test/function/index.js:45:17

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

		return code === undefined
			? isImport ? import(importee) : require(importee)
			: (exportsMap[outputId] = requireWithContext(
				// Here replaced `import` to avoid unexpected error

warn dynamic-import packages/rollup-tests/test/function/index.js:45:36

`require` called with a non-literal specifier (ast pass, confidence 0.60)

		return code === undefined
			? isImport ? import(importee) : require(importee)
			: (exportsMap[outputId] = requireWithContext(
				// Here replaced `import` to avoid unexpected error

warn dynamic-import packages/rollup-tests/test/utils.js:380:17

`require` called with a non-literal specifier (ast pass, confidence 0.60)

	const configFile = join(directory, '_config.js');
	const config = require(configFile);
	if (!config || !config.description) {
		throw new Error(`Found invalid config without description: ${configFile}`);

warn dynamic-import packages/rollup-tests/test/watch/index.js:1745:9

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
	delete require.cache[resolved];
	return require(resolved);
}
```

warn dynamic-import packages/test-dev-server/src/utils/load-dev-config.ts:7:25

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

export async function loadDevConfig(dir: string): Promise<DevConfig> {
  const exports = await import(nodeUrl.pathToFileURL(nodePath.join(dir, 'dev.config.mjs')).href);
  return exports.default;
}

warn dynamic-import packages/test-dev-server/src/vite-server.ts:130:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  }
  return import(nodeUrl.pathToFileURL(viteDistEntry).href) as Promise<{
    createServer: (config: ViteInlineConfig) => Promise<ViteDevServerLike>;
  }>;

warn dynamic-import packages/test-dev-server/tests/playground/vitest-setup.ts:127:25

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

      // navigates.
      const mod = await import(customServe);
      const serve: (ctx: ServeContext) => Promise<DevServerHandle> =
        mod.serve ?? mod.default?.serve;

warn dynamic-import scripts/misc/bump-version.js:21:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

  const pkgPath = path.resolve(REPO_ROOT, './packages/rolldown/package.json');
  const result = await import(pkgPath, {
    with: {
      type: 'json',

warn dynamic-import scripts/src/esbuild-tests/snap-diff/diff.ts:75:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

      try {
        const mod = (await import(configPath)).default;
        rewriteConfig = mod.rewrite ?? {};
        customResolver = mod.resolver;

info unicode-surrogate crates/rolldown/tests/rolldown/cjs_compat/lone_surrogate_export_name/cjs.js:1:10 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
exports['\uD800'] = 'assigned';
Object.defineProperty(exports, '\uDC00', { enumerable: true, value: 'defined' });
exports.foo = 'foo';
```
info unicode-surrogate crates/rolldown/tests/rolldown/cjs_compat/lone_surrogate_export_name/cjs.js:2:33 new in this release

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
exports['\uD800'] = 'assigned';
Object.defineProperty(exports, '\uDC00', { enumerable: true, value: 'defined' });
exports.foo = 'foo';
```

info unicode-surrogate crates/rolldown/tests/rolldown/cjs_compat/lone_surrogate_export_name/main.js:5:25 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

// A name with a lone surrogate is treated like a computed one, so its property survives.
assert.strictEqual(cjs['\uD800'], 'assigned');
assert.strictEqual(cjs['\uDC00'], 'defined');
assert.strictEqual(cjs.foo, 'foo');

info unicode-surrogate crates/rolldown/tests/rolldown/cjs_compat/lone_surrogate_export_name/main.js:6:25 new in this release

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)
```
assert.strictEqual(cjs['\uD800'], 'assigned');
assert.strictEqual(cjs['\uDC00'], 'defined');
assert.strictEqual(cjs.foo, 'foo');
```
info unicode-surrogate crates/rolldown/tests/rolldown/errors/assign_to_import/main.js:12:5 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
// The message prints the lone surrogate as `\ud800`.
ns['\uD800'] = 1;
```
info unicode-surrogate crates/rolldown/tests/rolldown/errors/lone_surrogate_file_url/main.js:2:44 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
// A file URL name with a lone surrogate matches no emitted file.
console.log(import.meta['ROLLDOWN_FILE_URL_\uD800']);
```
info unicode-surrogate crates/rolldown/tests/rolldown/function/external/import_attributes_are_escaped/main.js:4:41 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
export * from 'ext-star' with { custom: 'a"b' };
import 'ext-surrogate' with { custom: 'a\uD800', 'k\uD800': 'b' };
console.log(x);
```
info unicode-surrogate crates/rolldown/tests/rolldown/function/external/import_attributes_are_escaped/main.js:4:52 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
export * from 'ext-star' with { custom: 'a"b' };
import 'ext-surrogate' with { custom: 'a\uD800', 'k\uD800': 'b' };
console.log(x);
```
info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:5:19 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
// `./a\uD800.js` names the file `a\u{FFFD}.js`.
import a from './a\uD800.js';
export * from './b\uD800.js';
export { c } from './c\uD800.js';
```
info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:6:19 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
import a from './a\uD800.js';
export * from './b\uD800.js';
export { c } from './c\uD800.js';
```
info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:7:23 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
export * from './b\uD800.js';
export { c } from './c\uD800.js';

assert.strictEqual(a, 'a');
```
info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:10:38 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
assert.strictEqual(a, 'a');
assert.strictEqual((await import('./d\uD800.js')).d, 'd');
assert.strictEqual(require(`./e\uD800.cjs`), 'e');
let f;
```
info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:11:32 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
assert.strictEqual((await import('./d\uD800.js')).d, 'd');
assert.strictEqual(require(`./e\uD800.cjs`), 'e');
let f;
try {
```
info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:14:19 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
try {
  f = require('./f\uD800.cjs');
} catch {}
assert.strictEqual(f, 'f');
```
info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:17:37 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
assert.strictEqual(f, 'f');
assert.ok(fs.existsSync(new URL('./g\uD800.bin', import.meta.url)));

// An ignored request and a data URL are left as written.
```
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:20:30 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
// An ignored request and a data URL are left as written.
export const ignored = () => import(/* @vite-ignore */ './h\uD800.js');
export const ignoredUrl = new URL(/* @vite-ignore */ './i\uD800.bin', import.meta.url);
export const dataUrl = new URL('data:text/plain,\uD800', import.meta.url);
```
likely benign LLM, confidence 0.90 Resolver test fixture with ignored dynamic import and URL with lone surrogate.
Reasoning
Fixture uses @vite-ignore comments and lone surrogates to test resolver edge cases; no execution of attacker content.

info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:20:60 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

// An ignored request and a data URL are left as written.
export const ignored = () => import(/* @vite-ignore */ './h\uD800.js');
export const ignoredUrl = new URL(/* @vite-ignore */ './i\uD800.bin', import.meta.url);
export const dataUrl = new URL('data:text/plain,\uD800', import.meta.url);

info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:21:58 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

export const ignored = () => import(/* @vite-ignore */ './h\uD800.js');
export const ignoredUrl = new URL(/* @vite-ignore */ './i\uD800.bin', import.meta.url);
export const dataUrl = new URL('data:text/plain,\uD800', import.meta.url);

info unicode-surrogate crates/rolldown/tests/rolldown/resolve/lone_surrogate_specifier/main.js:22:49 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
export const ignoredUrl = new URL(/* @vite-ignore */ './i\uD800.bin', import.meta.url);
export const dataUrl = new URL('data:text/plain,\uD800', import.meta.url);
```
info unicode-surrogate crates/rolldown/tests/rolldown/topics/hmr/import_meta_hot_accept_lone_surrogate/parent.js:1:32 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
import { count as a } from './a\uD800.js';
import { count as b } from './b\uD800.js';
```
info unicode-surrogate crates/rolldown/tests/rolldown/topics/hmr/import_meta_hot_accept_lone_surrogate/parent.js:2:32 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
import { count as a } from './a\uD800.js';
import { count as b } from './b\uD800.js';

globalThis.parentRuns = (globalThis.parentRuns ?? 0) + 1;
```
info unicode-surrogate crates/rolldown/tests/rolldown/topics/hmr/import_meta_hot_accept_lone_surrogate/parent.js:8:28 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
// Each lone surrogate becomes U+FFFD, so these accept `a\u{FFFD}.js` and `b\u{FFFD}.js`.
import.meta.hot.accept('./a\uD800.js', (mod) => {
  globalThis.saw[0] = mod.count;
});
```
info unicode-surrogate crates/rolldown/tests/rolldown/topics/hmr/import_meta_hot_accept_lone_surrogate/parent.js:11:29 new in this release

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
```
});
import.meta.hot.accept([`./b\uD800.js`], ([mod]) => {
  globalThis.saw[1] = mod.count;
});
```
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/builtin-plugin/vite-resolve.test.ts:152:51 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
  const { output } = await bundle.generate({ format: 'esm' });
  const { read }: { read: () => unknown } = await import(
    `data:text/javascript,${encodeURIComponent(output[0].code)}`
  );
```
likely benign LLM, confidence 0.90 Test helper that imports freshly bundled ESM output through a data: URI to check its exports.
Reasoning
The data: URI import evaluates code that the test itself just produced by bundling (bundle.generate output), inside a test file of a bundler repo. No external or attacker-controlled input reaches it, and it is a common technique for testing bundle output in-memory.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/build-import-analysis/await-in-import-argument/main.js:6:16 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export async function load() {
  return await import(await resolveSpecifier());
}
```
likely benign LLM, confidence 0.90 Fixture function doing a dynamic import whose specifier is awaited, used to test import analysis.
Reasoning
This is a fixture for testing how the bundler handles dynamic import() with an awaited, non-literal specifier. The specifier comes from a local test helper, and the pattern is exactly what the fixture is meant to exercise.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/build-import-analysis/await-in-import-argument/main.js:10:16 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export async function loadThen() {
  return await import(await resolveSpecifier()).then((m) => m.foo);
}
```
likely benign LLM, confidence 0.90 Fixture function using an awaited dynamic import with a .then chain, for import-analysis testing.
Reasoning
Same fixture as the previous finding, here with a .then chain. It tests bundler import analysis of non-literal specifiers and has no malicious indicators.

info long-line CHANGELOG-2024.md:112:1

line length 743 characters (raw pass, confidence 0.50)

* allow mutating `chunk.imports` and more ([#3008](https://github.com/rolldown/rolldown/issues/3008)) ([9e58163](https://github.com/rolldown/rolldown/commit/9e58163a305d1895ee62efc03b268a9e01d5d992)), closes [/github.com/vitejs/vite/blob/8f0a9dcff112c866d9aa911647fd3cf9adc50bf1/packages/vite/src/node/plugins/css.ts#L10

info long-line CHANGELOG-2024.md:116:1

line length 770 characters (raw pass, confidence 0.50)

* check falsy plugin in options hook ([#2670](https://github.com/rolldown/rolldown/issues/2670)) ([66680f5](https://github.com/rolldown/rolldown/commit/66680f5a558934b515d64d146a132e9ed75199a0)), closes [/github.com/rolldown/rolldown/blob/f3a159b51ce05b6b513d121d279cd3b9a799544a/packages/rolldown/src/utils/normalize-pl

info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:116:555

4 rows of base64-like lines, lines 116-119 (first: base64-like blob (68 bytes, compression ratio 0.91)) (raw pass, confidence 0.60)
```
github.com/rolldown/rolldown/pull/2670/files#diff-48cd2591bdcb44946219841aaccab8eb2d54381960f9607cb7542c40f446d92eR105](https://github.com//github.com/rolldown/rolldown/pull/2670/files/issues/diff-48cd2591bdcb44946219841aaccab8eb2d54381960f9607cb7542c40f446d92eR105)
```
dismissed LLM, confidence 0.95 Markdown changelog entry with a GitHub diff link whose hex hash matched the base64 pattern.
Reasoning
The flagged text is part of a GitHub pull-request diff link. The long run is a hexadecimal commit or file hash, which a base64 matcher picks up. A markdown changelog containing such links is normal, and nothing in the snippet is executable or hidden.

info long-line CHANGELOG-2024.md:119:1

line length 617 characters (raw pass, confidence 0.50)

* **cjs:** fix named default export ([#2923](https://github.com/rolldown/rolldown/issues/2923)) ([11a6693](https://github.com/rolldown/rolldown/commit/11a6693e1cb8f7377531859a272d6d66eb9fa1a2)), closes [/github.com/rolldown/rolldown/issues/2903#issuecomment-2496018956](https://github.com//github.com/rolldown/rolldown/i

info long-line CHANGELOG-2024.md:131:1

line length 558 characters (raw pass, confidence 0.50)

* emit error when `output.format` did not support `topLevelAwait` ([#2629](https://github.com/rolldown/rolldown/issues/2629)) ([db018fa](https://github.com/rolldown/rolldown/commit/db018faa550ba894202afe8da53b1f9215f52259)), closes [/github.com/evanw/esbuild/commit/5fe21253ee75fb4c5ea395a0877b2a5ab51c3575#diff-f312cd3f

info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:131:313

base64-like blob (69 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
mit/5fe21253ee75fb4c5ea395a0877b2a5ab51c3575#diff-f312cd3ffe8d88cf424d3f0bd04b41e5b0ad36e549874b5688028bf9091a61f5L2238](https://github.com//github.com/evanw/esbuild/commit/5fe21253ee75fb4c5ea395a0877b2a5ab51c3575/issues/diff-f312cd3ffe8d88cf424d3f0bd04b41e5b0ad36e549874b5688028bf9091a61f5L2238)
```
dismissed LLM, confidence 0.95 Changelog link to an esbuild commit whose hex SHA triggered the base64 heuristic.
Reasoning
The blob is a 40-character hexadecimal git commit SHA and a 64-character diff hash inside a GitHub commit link in a changelog. Hex strings match base64-like heuristics, and the context is ordinary release-note linking.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:131:489

base64-like blob (69 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
21253ee75fb4c5ea395a0877b2a5ab51c3575/issues/diff-f312cd3ffe8d88cf424d3f0bd04b41e5b0ad36e549874b5688028bf9091a61f5L2238)
```
dismissed LLM, confidence 0.95 Continuation of a GitHub commit link in the changelog, matched on a hex hash.
Reasoning
This is the tail of the same GitHub commit URL, with a hex commit SHA and diff hash. It is a repository link in release notes and carries no encoded payload.

info long-line CHANGELOG-2024.md:138:1

line length 1462 characters (raw pass, confidence 0.50)

* fix cjs live binding import source map ([#2878](https://github.com/rolldown/rolldown/issues/2878)) ([390e42f](https://github.com/rolldown/rolldown/commit/390e42f425a41d9871e25f5ffaf801de03ee0e1a)), closes [/esbuild.github.io/try/#dAAwLjI0LjAALS1zb3VyY2VtYXAgLS1mb3JtYXQ9Y2pzAGltcG9ydCBhc3NlcnQgZnJvbSAnbm9kZTphc3NlcnQn

info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:138:233

base64-like blob (103 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
```
f801de03ee0e1a)), closes [/esbuild.github.io/try/#dAAwLjI0LjAALS1zb3VyY2VtYXAgLS1mb3JtYXQ9Y2pzAGltcG9ydCBhc3NlcnQgZnJvbSAnbm9kZTphc3NlcnQnOwoKYXNzZXJ0Lm9](https://github.com//esbuild.github.io/try//issues/dAAwLjI0LjAALS1zb3VyY2VtYXAgLS1mb3JtYXQ9Y2pzAGltcG9ydCBhc3NlcnQgZnJvbSAnbm9kZTphc3NlcnQnOwoKYXNzZXJ0Lm9) [/evanw.gi
```
likely benign LLM, confidence 0.90 Changelog link to the esbuild try-it playground with base64-encoded example code in the URL.
Reasoning
The fragment after the esbuild playground hash is base64 of a small sample input (for example, a package.json-style test program). This is a shareable playground link in a changelog entry, which is a legitimate documentation practice. It is not an executable dropper, and the text is visible to readers.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:138:373

base64-like blob (118 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
oKYXNzZXJ0Lm9](https://github.com//esbuild.github.io/try//issues/dAAwLjI0LjAALS1zb3VyY2VtYXAgLS1mb3JtYXQ9Y2pzAGltcG9ydCBhc3NlcnQgZnJvbSAnbm9kZTphc3NlcnQnOwoKYXNzZXJ0Lm9) [/evanw.github.io/source-map-visualization/#MTI1NwB2YXIgX19jcmVhdGUgPSBPYmplY3QuY3JlYXRlOwp2YXIgX19kZWZQcm9wID0gT2JqZWN0LmRlZmluZVByb3BlcnR5Owp2YXIgX1
```
likely benign LLM, confidence 0.90 Changelog links to the esbuild playground and source-map visualizer with base64 example data in the URLs.
Reasoning
This is another esbuild playground or source-map-visualization link whose URL fragment encodes example input and output as base64. It is ordinary documentation linking in a changelog, with no decoding or execution code present.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:165:299

base64-like blob (69 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
mit/4780075ace9f5f59b61018326ec57da624a7d7a2#diff-58e541e6e2d17614efb5fc6c2a9e4151f54f5c599a0f0acde43bca8da970be64R1674](https://github.com//github.com/evanw/esbuild/commit/4780075ace9f5f59b61018326ec57da624a7d7a2/issues/diff-58e541e6e2d17614efb5fc6c2a9e4151f54f5c599a0f0acde43bca8da970be64R1674)
```
dismissed LLM, confidence 0.95 Changelog reference to an esbuild commit with a hex hash that matched the base64 pattern.
Reasoning
The blob is a hexadecimal commit SHA and diff hash in a GitHub link inside a changelog. The base64 heuristic fired on hex characters. This is a normal reference to a commit.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:165:475

base64-like blob (69 bytes, compression ratio 0.87) (raw pass, confidence 0.60)
```
0075ace9f5f59b61018326ec57da624a7d7a2/issues/diff-58e541e6e2d17614efb5fc6c2a9e4151f54f5c599a0f0acde43bca8da970be64R1674)
```
dismissed LLM, confidence 0.95 Tail of a GitHub commit link in the changelog, matched on a hex hash.
Reasoning
This is the tail of a GitHub commit URL with a hex SHA and diff anchor. It is a repository link in release notes and is not a payload.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:203:261

base64-like blob (67 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
mit/9b83e55e3511c1d108d31ba22f49e675c6eec1b9#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR19](https://github.com//github.com/evanw/esbuild/commit/9b83e55e3511c1d108d31ba22f49e675c6eec1b9/issues/diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR19)
```
dismissed LLM, confidence 0.95 Changelog link to an esbuild commit whose hex hash matched the base64 heuristic.
Reasoning
The matched text is a 40-character hex commit SHA plus a diff hash in a GitHub link. Hex is in the base64 alphabet, so the heuristic fired. The context is an ordinary changelog reference.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:203:435

base64-like blob (67 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
3e55e3511c1d108d31ba22f49e675c6eec1b9/issues/diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR19)
```
dismissed LLM, confidence 0.95 Tail of a GitHub commit link in the changelog, matched on a hex hash.
Reasoning
This is the tail of a GitHub commit URL in a changelog, with hex SHA and diff anchor characters. It is a benign repository reference.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:208:293

base64-like blob (67 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
mit/394ff827ea819775ab54958e5c316df32a2be0aa#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR56](https://github.com//github.com/evanw/esbuild/commit/394ff827ea819775ab54958e5c316df32a2be0aa/issues/diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR56)
```
dismissed LLM, confidence 0.95 Changelog link to an esbuild commit whose hex hash matched the base64 heuristic.
Reasoning
The flagged string is a hex commit SHA and diff hash inside a GitHub commit link in release notes. No encoded or executable content is present.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:208:467

base64-like blob (67 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
ff827ea819775ab54958e5c316df32a2be0aa/issues/diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR56)
```
dismissed LLM, confidence 0.95 Tail of a GitHub commit link in the changelog, matched on a hex hash.
Reasoning
This is the tail of a GitHub commit URL with hex SHA and diff anchor characters. It is ordinary changelog linking.

info long-line CHANGELOG-2024.md:228:1

line length 886 characters (raw pass, confidence 0.50)

* pass the remaining normalized fields from rust to js ([#2987](https://github.com/rolldown/rolldown/issues/2987)) ([f1c8656](https://github.com/rolldown/rolldown/commit/f1c8656cd231ddff20ded658665a987a78e41fd6)), closes [#2906](https://github.com/rolldown/rolldown/issues/2906) [/github.com/rolldown/rolldown/blob/71e68

info long-line CHANGELOG-2024.md:251:1

line length 632 characters (raw pass, confidence 0.50)

* use `BuildResult` for `validate_options_for_multi_chunk_output` ([#2800](https://github.com/rolldown/rolldown/issues/2800)) ([5fdd14e](https://github.com/rolldown/rolldown/commit/5fdd14e4085fd6d868cb22a42f725ab71045d5c1)), closes [#2565](https://github.com/rolldown/rolldown/issues/2565) [/github.com/rolldown/rolldown

info long-line CHANGELOG-2024.md:304:1

line length 602 characters (raw pass, confidence 0.50)

* builtin module side effects free ([#2599](https://github.com/rolldown/rolldown/issues/2599)) ([517e7b0](https://github.com/rolldown/rolldown/commit/517e7b0dc249a3e36920c2e6287c9d65fc938204)), closes [/github.com/evanw/esbuild/blob/d34e79e2a998c21bb71d57b92b0017ca11756912/internal/ast/ast.go#L130-L131](https://github.

info long-line CHANGELOG-2024.md:311:1

line length 692 characters (raw pass, confidence 0.50)

* extend PluginContext with MinimalPluginContext ([#2316](https://github.com/rolldown/rolldown/issues/2316)) ([824315d](https://github.com/rolldown/rolldown/commit/824315d5b242e46fa7ffee226735d84f641c737e)), closes [/github.com/rollup/rollup/blob/89a68c2a69eefaaf5544f83367f31d98360354ed/src/rollup/types.d.ts#L237](http

info long-line CHANGELOG-2024.md:339:1

line length 765 characters (raw pass, confidence 0.50)

* toplevel class decl rewrite ([#2465](https://github.com/rolldown/rolldown/issues/2465)) ([01f0d17](https://github.com/rolldown/rolldown/commit/01f0d17fbe3555aad3eb32fe498c4dbaf75d6426)), closes [/github.com/evanw/esbuild/blob/d34e79e2a998c21bb71d57b92b0017ca11756912/internal/js_parser/js_parser_lower_class.go#L2028-L

info long-line CHANGELOG-2024.md:400:1

line length 683 characters (raw pass, confidence 0.50)

* warning diagnostic import-is-undefined ([#2358](https://github.com/rolldown/rolldown/issues/2358)) ([00fa6ff](https://github.com/rolldown/rolldown/commit/00fa6ffd8e20cf567c5fba5b6741273a0d87830c)), closes [/esbuild.github.io/try/#YgAwLjIwLjIALS1idW5kbGUgLS1taW5pZnk9ZmFsc2UgLS1mb3JtYXQ9ZXNtAGUAZW50cnkuanMAaW1wb3J0ICog

info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:400:233

base64-like blob (199 bytes, compression ratio 0.85) (raw pass, confidence 0.60)
```
41273a0d87830c)), closes [/esbuild.github.io/try/#YgAwLjIwLjIALS1idW5kbGUgLS1taW5pZnk9ZmFsc2UgLS1mb3JtYXQ9ZXNtAGUAZW50cnkuanMAaW1wb3J0ICogYXMgbnMgZnJvbSAnLi9mb28uanMnCgpjb25zb2xlLmxvZyhucy5kZWZhdWx0KQoKAABmb28uanMALy8gZm9vLmpzCmV4cG9ydCBjb25zdCBhID0](https://github.com//esbuild.github.io/try//issues/YgAwLjIwLjIALS1idW5
```
likely benign LLM, confidence 0.90 Changelog link to the esbuild playground with base64-encoded example project in the URL.
Reasoning
The fragment after the esbuild playground link is base64 of a multi-file example input, used to share a reproduction. This is common in changelogs for bug reports. It is not executed or hidden from readers.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:400:469

base64-like blob (214 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
Bjb25zdCBhID0](https://github.com//esbuild.github.io/try//issues/YgAwLjIwLjIALS1idW5kbGUgLS1taW5pZnk9ZmFsc2UgLS1mb3JtYXQ9ZXNtAGUAZW50cnkuanMAaW1wb3J0ICogYXMgbnMgZnJvbSAnLi9mb28uanMnCgpjb25zb2xlLmxvZyhucy5kZWZhdWx0KQoKAABmb28uanMALy8gZm9vLmpzCmV4cG9ydCBjb25zdCBhID0)
```
likely benign LLM, confidence 0.93 Long base64-looking string embedded in a changelog link URL to an esbuild playground.
Reasoning
Base64-like run inside a markdown changelog is an esbuild try-link URL fragment with embedded code text; it is a benign documentation artifact, a raw-pass false positive.

info long-line CHANGELOG-2024.md:436:1

line length 736 characters (raw pass, confidence 0.50)

* mark knownGlobals global ident and global member access as side effects free ([#2154](https://github.com/rolldown/rolldown/issues/2154)) ([00ff45d](https://github.com/rolldown/rolldown/commit/00ff45dc7833cb8b0ad4dd6c526bb1acd50c8ad9)), closes [/github.com/evanw/esbuild/blob/9c13ae1f06dfa909eb4a53882e3b7e4216a503fe/in

info long-line CHANGELOG-2024.md:509:1

line length 550 characters (raw pass, confidence 0.50)

* resolve conflict `exports` key in `CJS` and `IIFE`. ([#1837](https://github.com/rolldown/rolldown/issues/1837)) ([2953b90](https://github.com/rolldown/rolldown/commit/2953b9023450639a5450ac94d9ba666c04ae86ae)), closes [#1836](https://github.com/rolldown/rolldown/issues/1836) [#1623](https://github.com/rolldown/rolldo

info long-line CHANGELOG-2024.md:520:1

line length 1688 characters (raw pass, confidence 0.50)

* strict emit warning `commonjs var in esm` ([#2101](https://github.com/rolldown/rolldown/issues/2101)) ([4c9feeb](https://github.com/rolldown/rolldown/commit/4c9feeb058f0212228e430450004967c99af9177)), closes [/esbuild.github.io/try/#YgAwLjIzLjEALS1idW5kbGUgLS1taW5pZnk9ZmFsc2UgLS1mb3JtYXQ9ZXNtAGUAZW50cnkuanMALyoqIERld

info long-line CHANGELOG-2024.md:547:1

line length 595 characters (raw pass, confidence 0.50)

* align OutputOptions#esModule with rollup ([#1898](https://github.com/rolldown/rolldown/issues/1898)) ([c14406f](https://github.com/rolldown/rolldown/commit/c14406fb61051cba19833368a23539a4342c8e80)), closes [#1888](https://github.com/rolldown/rolldown/issues/1888) [/github.com/rolldown/rolldown/blob/e0751e4db539ce8e2

info long-line CHANGELOG-2024.md:559:1

line length 889 characters (raw pass, confidence 0.50)

* gracefully shutdown the process when panic in `fetch_all_modules` ([#2036](https://github.com/rolldown/rolldown/issues/2036)) ([c85883b](https://github.com/rolldown/rolldown/commit/c85883bb5a2ff8631d318816ef186ce5e7e723bd)), closes [#2033](https://github.com/rolldown/rolldown/issues/2033) [/github.com/rolldown/rolldo

info long-line CHANGELOG-2024.md:593:1

line length 569 characters (raw pass, confidence 0.50)

* support `skipSelf` option in `PluginContext.resolve` ([#1703](https://github.com/rolldown/rolldown/issues/1703)) ([a18a8da](https://github.com/rolldown/rolldown/commit/a18a8dafed5e156452ec0b5cf4934ba445c2da3b)), closes [#1554](https://github.com/rolldown/rolldown/issues/1554) [#819](https://github.com/rolldown/rolldo

info long-line CHANGELOG-2024.md:594:1

line length 611 characters (raw pass, confidence 0.50)

* support flag for regex in plugin transform ([#1969](https://github.com/rolldown/rolldown/issues/1969)) ([f4f6b49](https://github.com/rolldown/rolldown/commit/f4f6b49b3e316ff9588bf8176dae208cbc32ae0f)), closes [#1914](https://github.com/rolldown/rolldown/issues/1914) [#1915](https://github.com/rolldown/rolldown/issues

info long-line CHANGELOG-2024.md:614:1

line length 574 characters (raw pass, confidence 0.50)

* improve generate_namespace_definition ([#1986](https://github.com/rolldown/rolldown/issues/1986)) ([d90802f](https://github.com/rolldown/rolldown/commit/d90802fb8b4ca82a8b6bc01db183c5487a65448c)), closes [#1861](https://github.com/rolldown/rolldown/issues/1861) [/github.com/rolldown/rolldown/blob/745c1a57e66433df7182

info long-line CHANGELOG-2024.md:679:1

line length 563 characters (raw pass, confidence 0.50)

* **output:** support emit output of iife format ([#1570](https://github.com/rolldown/rolldown/issues/1570)) ([7c9d537](https://github.com/rolldown/rolldown/commit/7c9d5374811d10dccaea9e54b1bd74d7d84eff88)), closes [/esbuild.github.io/try/#YgAwLjIzLjAALS1mb3JtYXQ9aWlmZSAtLWJ1bmRsZSAtLW91dGRpcj0iZGlzdCIAZQBlbnRyeS5qcwBp

info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:679:241

base64-like blob (135 bytes, compression ratio 0.97) (raw pass, confidence 0.60)
```
bd74d7d84eff88)), closes [/esbuild.github.io/try/#YgAwLjIzLjAALS1mb3JtYXQ9aWlmZSAtLWJ1bmRsZSAtLW91dGRpcj0iZGlzdCIAZQBlbnRyeS5qcwBpbXBvcnQoIi4vY2pzIikKaW1wb3J0KCIuL2VzbSIpLnRoZW4oKG0pID0](https://github.com//esbuild.github.io/try//issues/YgAwLjIzLjAALS1mb3JtYXQ9aWlmZSAtLWJ1bmRsZSAtLW91dGRpcj0iZGlzdCIAZQBlbnRyeS5qcwBpbXB
```
likely benign LLM, confidence 0.93 Base64-like fragment in a changelog URL pointing to the esbuild playground.
Reasoning
Same pattern: a base64-like fragment inside a changelog issue link to the esbuild try page, no execution context; benign raw-pass noise.
info ~~warn~~ → info by review encoding-base64 CHANGELOG-2024.md:679:413

base64-like blob (150 bytes, compression ratio 0.95) (raw pass, confidence 0.60)
```
RoZW4oKG0pID0](https://github.com//esbuild.github.io/try//issues/YgAwLjIzLjAALS1mb3JtYXQ9aWlmZSAtLWJ1bmRsZSAtLW91dGRpcj0iZGlzdCIAZQBlbnRyeS5qcwBpbXBvcnQoIi4vY2pzIikKaW1wb3J0KCIuL2VzbSIpLnRoZW4oKG0pID0)
```
likely benign LLM, confidence 0.93 Base64-like fragment in a changelog issue URL.
Reasoning
Another fragment of the same changelog link URL; no decoding or execution, so it is a false positive.

info long-line CHANGELOG-2024.md:885:1

line length 607 characters (raw pass, confidence 0.50)

* **rust:** render external imports after normal imports ([#1171](https://github.com/rolldown/rolldown/issues/1171)) ([f102cc0](https://github.com/rolldown/rolldown/commit/f102cc0ef4550cd71f8fe7340618a420a6f93367)), closes [/github.com/rolldown/rolldown/blob/5c3b4fbb732dda092bc5298b2ad1b85786735977/crates/rolldown/test

info long-line CHANGELOG-2025.md:3679:1

line length 509 characters (raw pass, confidence 0.50)

- dynamic require by unused function ([#3271](https://github.com/rolldown/rolldown/issues/3271)) ([d07e45c](https://github.com/rolldown/rolldown/commit/d07e45cce088f0f5acee935c496f01797e89094f)), closes [#3268](https://github.com/rolldown/rolldown/issues/3268) [/github.com/evanw/esbuild/blob/d34e79e2a998c21bb71d57b92b0

info long-line CHANGELOG-2025.md:3719:1

line length 515 characters (raw pass, confidence 0.50)

- **link_stage:** improve `LinkStage#wrap_modules` ([#3321](https://github.com/rolldown/rolldown/issues/3321)) ([35fb1f8](https://github.com/rolldown/rolldown/commit/35fb1f881c48fcabe7137ba20e90d02d58cd3c5e)), closes [/github.com/rolldown/rolldown/blob/42ee4c997588b2ee205eceae36b48a18c95aed96/crates/rolldown/src/stages

info whitespace-anomaly crates/rolldown/src/ast_scanner/stmt_eval_analyzer/mod.rs:6:1

file mixes tab and space indentation (3 tab-indented and 2480 space-indented lines) (raw pass, confidence 0.40)

use oxc::ast::ast::{
  self, Argument, AssignmentTarget, BindingPattern, CallExpression, ChainElement, Expression,
  IdentifierReference, SpreadElement, UnaryOperator, VariableDeclarationKind,
};

info identifier-low-length crates/rolldown/tests/esbuild/dce/cross_module_constant_folding_number/const-entry.js:1:1

mean non-conventional identifier length 1.37 over 57 names (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/dce/cross_module_constant_folding_number/enum-entry.ts:1:1

mean non-conventional identifier length 1.38 over 55 names (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/dce/cross_module_constant_folding_string/const-entry.js:1:1

mean non-conventional identifier length 1.62 over 34 names (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/dce/cross_module_constant_folding_string/enum-entry.ts:1:1

mean non-conventional identifier length 1.66 over 32 names (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/await_import_inside_try/entry.js:3:16

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	try {
		return await import(name)
	} catch {
	}
```
likely benign LLM, confidence 0.95 Test fixture with a dynamic import(name) inside a try block.
Reasoning
This is a bundler test fixture exercising await import inside try; a non-literal specifier is the test subject, not malicious.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/diff.md:5:3

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
console.log(
  import(
    /* before */
    foo
```
likely benign LLM, confidence 0.95 Snapshot of import() with comments in a bundler test doc.
Reasoning
Embedded JavaScript in a markdown test snapshot showing comment preservation around import(); it is test expectation text, not executed code.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/diff.md:9:3

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  ),
  import(
    /* before */
    "foo"
```
likely benign LLM, confidence 0.95 Snapshot of import() with comments in a bundler test doc.
Reasoning
Same comment-preservation snapshot in test docs; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/diff.md:13:3

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  ),
  import(
    foo
    /* after */
```
likely benign LLM, confidence 0.95 Snapshot of import() with comments in a bundler test doc.
Reasoning
Same comment-preservation snapshot in test docs; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/diff.md:61:3

[embedded javascript] `require` called with a non-literal specifier (ast pass, confidence 0.60)
```
console.log(
  require(
    /* before */
    foo
```
likely benign LLM, confidence 0.95 Snapshot of require() with comments in a bundler test doc.
Reasoning
Snapshot of require() with comments in test documentation; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/diff.md:65:3

[embedded javascript] `require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  ),
  require(
    /* before */
    "foo"
```
likely benign LLM, confidence 0.95 Snapshot of require() with comments in a bundler test doc.
Reasoning
Same require() comment snapshot; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/diff.md:69:3

[embedded javascript] `require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  ),
  require(
    foo
    /* after */
```
likely benign LLM, confidence 0.95 Snapshot of require() with comments in a bundler test doc.
Reasoning
Same require() comment snapshot; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/entry.js:2:2

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
console.log(
	import(/* before */ foo),
	import(/* before */ 'foo'),
	import(foo /* after */),
```
likely benign LLM, confidence 0.95 Test input with import() calls containing comments.
Reasoning
Bundler test input exercising comment placement in import(); non-literal argument is intentional test content.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/entry.js:3:2

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	import(/* before */ foo),
	import(/* before */ 'foo'),
	import(foo /* after */),
	import('foo' /* after */),
```
likely benign LLM, confidence 0.95 Test input with import() calls containing comments.
Reasoning
Same bundler comment-preservation test input; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/entry.js:4:2

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	import(/* before */ 'foo'),
	import(foo /* after */),
	import('foo' /* after */),
)
```
likely benign LLM, confidence 0.95 Test input with import() calls containing comments.
Reasoning
Same bundler comment-preservation test input; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/entry.js:20:2

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
console.log(
	require(/* before */ foo),
	require(/* before */ 'foo'),
	require(foo /* after */),
```
likely benign LLM, confidence 0.95 Test input with require() calls containing comments.
Reasoning
Test input for require() with comments in a bundler test suite; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/entry.js:21:2

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
	require(/* before */ foo),
	require(/* before */ 'foo'),
	require(foo /* after */),
	require('foo' /* after */),
```
likely benign LLM, confidence 0.95 Test input with require() calls containing comments.
Reasoning
Same require() comment test input; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/comment_preservation/entry.js:22:2

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
	require(/* before */ 'foo'),
	require(foo /* after */),
	require('foo' /* after */),
)
```
likely benign LLM, confidence 0.95 Test input with require() calls containing comments.
Reasoning
Same require() comment test input; benign.

info long-line crates/rolldown/tests/esbuild/default/comment_preservation_transform_jsx/diff.md:46:1

[embedded javascript] line length 779 characters (raw pass, confidence 0.50)

console.log(/* @__PURE__ */ React.createElement("div", { x }), /* @__PURE__ */ React.createElement("div", { x: "y" }), /* @__PURE__ */ React.createElement("div", { x: true }), /* @__PURE__ */ React.createElement("div", x), /* @__PURE__ */ React.createElement("div", null, x), /* @__PURE__ */ React.createElement(React.Fr

info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/conditional_import/a.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(x ? 'a' : y ? './import' : 'c')
```
likely benign LLM, confidence 0.90 Dynamic import with a conditional specifier in a bundler test fixture.
Reasoning
Bundler test fixture exercising conditional dynamic import specifiers; non-literal import is the feature under test, no malicious payload.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/conditional_import/b.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(x ? y ? 'a' : './import' : c)
```
dismissed LLM, confidence 0.93 A bundler test fixture containing a dynamic import with a conditional specifier.
Reasoning
This is a bundler test fixture for conditional dynamic import specifiers. The non-literal import is the thing the test exercises, and nothing in the snippet is hidden or executed maliciously.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/conditional_require/a.js:1:1

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
require(x ? 'a' : y ? './b' : 'c')
require(x ? y ? 'a' : './b' : c)
```
dismissed LLM, confidence 0.93 A bundler test fixture calling require with a conditional specifier.
Reasoning
This is a bundler test fixture for conditional require specifiers, a standard pattern for testing how the bundler handles non-static require calls. The snippet has no execution or obfuscation indicators.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/conditional_require/a.js:2:1

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
require(x ? 'a' : y ? './b' : 'c')
require(x ? y ? 'a' : './b' : c)
```
dismissed LLM, confidence 0.93 A bundler test fixture calling require with a nested conditional specifier.
Reasoning
Same conditional require test fixture as the line 1 finding, part of a bundler test case for non-literal specifiers.
info identifier-low-length crates/rolldown/tests/esbuild/default/define_optional_chain/entry.js:1:1

mean non-conventional identifier length 1.35 over 23 names (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/default/define_optional_chain_lowered/entry.js:1:1

mean non-conventional identifier length 1.35 over 23 names (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/default/define_optional_chain_panic_issue3551/dot-define.js:1:1

mean non-conventional identifier length 1.53 over 38 names (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/dynamic_import_with_expression_cjs/a.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import('foo')
import(foo())
```
dismissed LLM, confidence 0.93 A bundler test fixture with import(foo()) for expression-based dynamic imports.
Reasoning
This is a bundler test case for dynamic import with an expression argument, placed in a tests directory. The call is an ordinary test input, not an attack pattern.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/import_then_catch/entry.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(name).then(pass, fail)
import(name).then(pass).catch(fail)
import(name).catch(fail)
```
dismissed LLM, confidence 0.93 A bundler test fixture chaining then and catch on a dynamic import.
Reasoning
A bundler test fixture exercising chained then/catch on dynamic imports. The chaining is normal promise handling and is typical of test inputs.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/import_then_catch/entry.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(name).then(pass, fail)
import(name).then(pass).catch(fail)
import(name).catch(fail)
```
dismissed LLM, confidence 0.93 A bundler test fixture chaining then and catch on a dynamic import.
Reasoning
Same test fixture as the line 1 finding, showing a dynamic import with then and catch handlers, which is ordinary promise usage.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/import_then_catch/entry.js:3:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(name).then(pass).catch(fail)
import(name).catch(fail)
```
dismissed LLM, confidence 0.93 A bundler test fixture chaining catch on a dynamic import.
Reasoning
Same test fixture showing a dynamic import followed by catch. This is legitimate promise handling in a bundler test corpus.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/minified_dynamic_import_with_expression_cjs/a.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import('foo')
import(foo())
```
dismissed LLM, confidence 0.93 A minified bundler test fixture with import(foo()).
Reasoning
A minified variant of the dynamic import expression test fixture in a bundler test directory. Minification is expected for that test and does not indicate malicious obfuscation.
info whitespace-anomaly crates/rolldown/tests/esbuild/default/nested_common_js/entry.js:4:1

file mixes tab and space indentation (1 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
```
function nestedScope() {
	const fn = require('./foo')
  assert.equal(fn(), 123)
}
```
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:1:1

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
require(tag`./b`)
require(`./${b}`)
```
dismissed LLM, confidence 0.93 A bundler test fixture calling require with a tagged template specifier.
Reasoning
A bundler test fixture covering invalid template literal specifiers in require. The test targets parser edge cases, and the snippet contains no payload.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:2:1

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
require(tag`./b`)
require(`./${b}`)

try {
```
dismissed LLM, confidence 0.93 A bundler test fixture calling require with a template literal specifier.
Reasoning
Same invalid-template test fixture as the line 1 finding, exercising the bundler's handling of non-literal require specifiers.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:5:5

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
try {
    require(tag`./b`)
    require(`./${b}`)
} catch {
```
dismissed LLM, confidence 0.93 A bundler test fixture with a require call inside a try block.
Reasoning
Part of the invalid-template test fixture. The require call sits inside a try block, which is a normal test construct for exercising error handling.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:6:5

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
    require(tag`./b`)
    require(`./${b}`)
} catch {
}
```
dismissed LLM, confidence 0.93 A bundler test fixture with require calls inside a try block.
Reasoning
Same try-block test fixture, showing require calls with tagged and template specifiers. Nothing here is executed or hidden.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:11:5

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
(async () => {
    import(tag`./b`)
    import(`./${b}`)
    await import(tag`./b`)
```
dismissed LLM, confidence 0.93 A bundler test fixture with dynamic imports inside an async arrow function.
Reasoning
Part of the invalid-template fixture, with dynamic imports inside an async arrow function. This is standard test code for async dynamic import handling.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:12:5

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
    import(tag`./b`)
    import(`./${b}`)
    await import(tag`./b`)
    await import(`./${b}`)
```
dismissed LLM, confidence 0.93 A bundler test fixture with awaited and non-awaited dynamic imports.
Reasoning
Same async dynamic import test fixture, covering tagged and template specifiers. It is a parser test input, not an attack.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:13:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    import(`./${b}`)
    await import(tag`./b`)
    await import(`./${b}`)
```
dismissed LLM, confidence 0.93 A bundler test fixture with awaited dynamic imports using template specifiers.
Reasoning
Same async dynamic import test fixture, with template literal specifiers. This is an ordinary test case.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:14:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
    await import(tag`./b`)
    await import(`./${b}`)

    try {
```
dismissed LLM, confidence 0.93 A bundler test fixture with awaited template-literal dynamic imports.
Reasoning
Same async dynamic import test fixture, the final variant of the set. It is a bundler parser test with no malicious content.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:17:9

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    try {
        import(tag`./b`)
        import(`./${b}`)
        await import(tag`./b`)
```
dismissed LLM, confidence 0.93 Dynamic import with a tagged-template specifier inside a try block in a rolldown test fixture.
Reasoning
The file is a bundler test fixture named for invalid template specifiers. The dynamic import with a tagged template is a deliberate edge case for the bundler's parser, not an attack.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:18:9

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
        import(tag`./b`)
        import(`./${b}`)
        await import(tag`./b`)
        await import(`./${b}`)
```
dismissed LLM, confidence 0.93 Dynamic import with a template-literal specifier in a rolldown test fixture.
Reasoning
This is the same invalid-template test fixture. The non-literal import is the subject under test, and nothing here runs or exfiltrates anything.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:19:15

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
        import(`./${b}`)
        await import(tag`./b`)
        await import(`./${b}`)
    } catch {
```
dismissed LLM, confidence 0.93 Awaited dynamic import with a template-literal specifier in a rolldown test fixture.
Reasoning
Part of the same bundler test fixture exercising dynamic import forms. The finding reflects the expected non-literal specifier pattern.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_and_dynamic_import_invalid_template/entry.js:20:15

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
        await import(tag`./b`)
        await import(`./${b}`)
    } catch {
    }
```
dismissed LLM, confidence 0.93 Awaited dynamic import with a tagged-template specifier in a rolldown test fixture.
Reasoning
Same bundler test fixture. The awaited tagged-template import is a parser test case, not evidence of malicious loading.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_shim_substitution/entry.js:6:2

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
	require('./example.json', { type: 'json' }),
	require(window.SOME_PATH),
	module.require('./example.json'),
	module.require('./example.json', { type: 'json' }),
```
dismissed LLM, confidence 0.93 A require call with a non-literal argument in a rolldown shim-substitution test.
Reasoning
This is a bundler test for require shim substitution. The window.SOME_PATH argument is a placeholder that tests how the bundler rewrites require calls.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/default/require_shim_substitution/entry.js:13:2

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
	import('some-path'),
	import(window.SOME_PATH),
])
```
dismissed LLM, confidence 0.93 A dynamic import with a non-literal argument in a rolldown shim-substitution test.
Reasoning
Same shim-substitution test fixture. The dynamic import of window.SOME_PATH is a placeholder used to verify rewriting behaviour.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_bundle/entry.js:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
```
dismissed LLM, confidence 0.92 A require call built by concatenating a path with a variable in a rolldown glob test.
Reasoning
This is a glob-import test fixture. The string concatenation with a variable is the standard dynamic-path pattern that the glob feature is built to handle.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_bundle/entry.js:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
	template: {
```
dismissed LLM, confidence 0.92 A dynamic import built by concatenating a path with a variable in a rolldown glob test.
Reasoning
Same glob test fixture. The dynamic import with a concatenated path is the feature under test and carries no sign of obfuscation or malicious intent.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_bundle/entry.js:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
```
dismissed LLM, confidence 0.92 A require call with a template-literal path in a rolldown glob test.
Reasoning
Glob test fixture using a template literal path. This is ordinary test input for the glob feature.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_bundle/entry.js:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
})
```
dismissed LLM, confidence 0.92 A dynamic import with a template-literal path in a rolldown glob test.
Reasoning
Same glob test fixture. The template-literal dynamic import is expected test input for the glob feature.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_splitting/entry.js:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
```
dismissed LLM, confidence 0.92 A require call built by concatenating a path with a variable in a rolldown glob test.
Reasoning
Glob test fixture for the no-splitting configuration. The concatenated require path is the expected input shape for this test.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_splitting/entry.js:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
	template: {
```
dismissed LLM, confidence 0.92 A dynamic import built by concatenating a path with a variable in a rolldown glob test.
Reasoning
Same glob test fixture for the no-splitting configuration. The dynamic import is the intended test subject.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_splitting/entry.js:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
```
dismissed LLM, confidence 0.92 A require call with a template-literal path in a rolldown glob test.
Reasoning
Glob test fixture using a template-literal path. This is normal test input and not an obfuscation technique.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_no_splitting/entry.js:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
})
```
dismissed LLM, confidence 0.92 A dynamic import with a template-literal path in a rolldown glob test.
Reasoning
Same glob test fixture. The template-literal dynamic import is expected test input for the feature.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_splitting/entry.js:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
```
dismissed LLM, confidence 0.92 A require call built by concatenating a path with a variable in a rolldown glob test.
Reasoning
Glob test fixture for the splitting configuration. The concatenated require path is ordinary test input for the glob feature.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_splitting/entry.js:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
	template: {
```
dismissed LLM, confidence 0.92 A dynamic import built by concatenating a path with a variable in a rolldown glob test.
Reasoning
Same glob test fixture for the splitting configuration. The dynamic import is the intended test subject, with no sign of malicious loading.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_splitting/entry.js:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
```
likely benign LLM, confidence 0.93 Test fixture calling require with a template-literal path under ./src.
Reasoning
This is a bundler test fixture for glob-style dynamic import/require over a relative ./src path. The specifier is built from a local variable, which is the pattern under test. Nothing here executes attacker-controlled content or hides code.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_basic_splitting/entry.js:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
})
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a template-literal path under ./src.
Reasoning
Same bundler glob-import test fixture: a dynamic import() over a relative ./src template path. It is an expected construct for testing dynamic import handling and is not obfuscation.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_dir_does_not_exist/entry.js:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
```
likely benign LLM, confidence 0.93 Test fixture requiring a concatenated relative path to a nonexistent directory.
Reasoning
Bundler test for a glob whose directory does not exist. The require uses string concatenation on a relative path, which is the intended test input. No malicious indicators appear.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_dir_does_not_exist/entry.js:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
	template: {
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a concatenated relative path.
Reasoning
Bundler test fixture for a nonexistent glob directory, with a dynamic import() built by concatenation over a relative path. This is the expected test construct.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_dir_does_not_exist/entry.js:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
```
likely benign LLM, confidence 0.93 Test fixture requiring a template-literal relative path in the glob test set.
Reasoning
Same nonexistent-directory glob test, using a template-literal require on a relative path. It is a legitimate test input for the bundler.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_dir_does_not_exist/entry.js:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
})
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a template-literal relative path.
Reasoning
Dynamic import() with a template-literal relative path in a bundler glob test. This is expected behavior for the test and does not show obfuscation or malicious intent.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_no_matches/entry.js:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab + '.json'),
		import: import('./src/' + ab + '.json'),
	},
```
likely benign LLM, confidence 0.93 Test fixture requiring a concatenated relative .json path with no glob matches.
Reasoning
Bundler test for glob patterns with no matches. The require concatenates a relative path with a .json suffix, which is the intended test input.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_no_matches/entry.js:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab + '.json'),
		import: import('./src/' + ab + '.json'),
	},
	template: {
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a concatenated relative .json path.
Reasoning
Dynamic import() of a concatenated relative .json path in a glob no-match test. This is a standard test construct.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_no_matches/entry.js:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}.json`),
		import: import(`./src/${ab}.json`),
	},
```
likely benign LLM, confidence 0.93 Test fixture requiring a template-literal relative .json path.
Reasoning
Template-literal require of a relative .json path in a bundler no-match glob test. It is expected test input.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_no_matches/entry.js:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}.json`),
		import: import(`./src/${ab}.json`),
	},
})
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a template-literal relative .json path.
Reasoning
Dynamic import() of a template-literal relative .json path in a glob no-match test. This is a legitimate test construct with no malicious signal.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_no_slash/entry.js:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/file-' + ab + '.js'),
		import: import('./src/file-' + ab + '.js'),
	},
```
likely benign LLM, confidence 0.93 Test fixture requiring a concatenated file-*.js relative path.
Reasoning
Bundler wildcard test: require over a concatenated relative file-*.js path. This is the expected input for testing glob patterns without slashes.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_no_slash/entry.js:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/file-' + ab + '.js'),
		import: import('./src/file-' + ab + '.js'),
	},
	template: {
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a concatenated file-*.js relative path.
Reasoning
Dynamic import() of a concatenated file-*.js relative path in a wildcard glob test. It is a standard test construct.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_no_slash/entry.js:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/file-${ab}.js`),
		import: import(`./src/file-${ab}.js`),
	},
```
likely benign LLM, confidence 0.93 Test fixture requiring a template-literal file-*.js relative path.
Reasoning
Template-literal require of a relative file-*.js path in a bundler wildcard test. It is expected test input.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_no_slash/entry.js:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/file-${ab}.js`),
		import: import(`./src/file-${ab}.js`),
	},
})
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a template-literal file-*.js relative path.
Reasoning
Dynamic import() of a template-literal file-*.js relative path in a wildcard glob test. This is a legitimate test construct.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_slash/entry.js:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab + '.js'),
		import: import('./src/' + ab + '.js'),
	},
```
likely benign LLM, confidence 0.93 Test fixture requiring a concatenated relative ./src .js path.
Reasoning
Bundler wildcard-with-slash test: require over a concatenated relative ./src path ending in .js. This is the intended test input.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_slash/entry.js:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab + '.js'),
		import: import('./src/' + ab + '.js'),
	},
	template: {
```
likely benign LLM, confidence 0.93 Test fixture with a dynamic import() of a concatenated relative ./src .js path.
Reasoning
Dynamic import() of a concatenated relative ./src .js path in a wildcard-slash glob test. It is a standard test construct with no malicious signal.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_slash/entry.js:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}.js`),
		import: import(`./src/${ab}.js`),
	},
```
likely benign LLM, confidence 0.95 Test fixture for glob-pattern dynamic require in rolldown's esbuild test suite.
Reasoning
This is a bundler test fixture exercising glob-style dynamic require/import with template literals. Non-literal specifiers are the intended subject of the test, and the file is in a test tree.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/glob_wildcard_slash/entry.js:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}.js`),
		import: import(`./src/${ab}.js`),
	},
})
```
likely benign LLM, confidence 0.95 Test fixture dynamic import with a template-literal glob specifier.
Reasoning
Same bundler test fixture; dynamic import with a template specifier is the tested feature, not malicious behavior.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_no_splitting/entry.ts:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
```
likely benign LLM, confidence 0.95 Test fixture for string-concatenated dynamic require paths.
Reasoning
Bundler test for glob-style concatenated specifiers in a test directory; the non-literal require is the feature under test.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_no_splitting/entry.ts:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
	template: {
```
likely benign LLM, confidence 0.95 Test fixture for string-concatenated dynamic import paths.
Reasoning
Bundler test fixture exercising concatenated dynamic import; benign test input.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_no_splitting/entry.ts:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
```
likely benign LLM, confidence 0.95 Test fixture for template-literal dynamic require.
Reasoning
Template-literal dynamic require in a bundler test fixture; expected pattern for glob import testing.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_no_splitting/entry.ts:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
})
```
likely benign LLM, confidence 0.95 Test fixture for template-literal dynamic import.
Reasoning
Template-literal dynamic import in a bundler test fixture; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_splitting/entry.ts:4:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	concat: {
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
```
likely benign LLM, confidence 0.95 Test fixture for concatenated dynamic require with splitting enabled.
Reasoning
Bundler test fixture for code splitting with glob-style concatenated requires; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_splitting/entry.ts:5:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require('./src/' + ab),
		import: import('./src/' + ab),
	},
	template: {
```
likely benign LLM, confidence 0.95 Test fixture for concatenated dynamic import with splitting.
Reasoning
Bundler test fixture for concatenated dynamic import with splitting; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_splitting/entry.ts:8:12

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
	template: {
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
```
likely benign LLM, confidence 0.95 Test fixture for template-literal dynamic require with splitting.
Reasoning
Template-literal dynamic require in a bundler splitting test; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/glob/ts_glob_basic_splitting/entry.ts:9:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
		require: require(`./src/${ab}`),
		import: import(`./src/${ab}`),
	},
})
```
likely benign LLM, confidence 0.95 Test fixture for template-literal dynamic import with splitting.
Reasoning
Template-literal dynamic import in a bundler splitting test; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/loader/with_type_bytes_override_loader_glob/entry.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
import("./foo" + bar, { with: { type: 'bytes' } }).then(console.log)
```
likely benign LLM, confidence 0.93 Test fixture for bytes-type import attribute override with a concatenated path.
Reasoning
Loader test fixture using an import attribute with a concatenated specifier; the test checks loader overrides for globbed imports, not malicious code.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/loader/with_type_json_override_loader_glob/entry.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
import("./foo" + bar, { with: { type: 'json' } }).then(console.log)
```
likely benign LLM, confidence 0.93 Test fixture for json-type import attribute override.
Reasoning
Loader test fixture for json type override with a concatenated import specifier; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/esbuild/loader/with_type_text_override_loader_glob/entry.js:1:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
import("./foo" + bar, { with: { type: 'text' } }).then(console.log)
```
likely benign LLM, confidence 0.93 Test fixture for text-type import attribute override.
Reasoning
Loader test fixture for text type override; benign test input.
info identifier-low-length crates/rolldown/tests/esbuild/lower/lower_exponentiation_operator_no_bundle/entry.js:1:1

mean non-conventional identifier length 1.47 over 55 names (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/lower/lower_object_spread_no_bundle/entry.jsx:1:1

mean non-conventional identifier length 1.43 over 47 names (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/lower/lower_using/loops.js:1:1

40 of 98 non-conventional identifiers are single-character (41%) (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/lower/lower_using_hoisting/hoist-export-class-direct.js:1:1

12 of 30 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/lower/lower_using_hoisting/hoist-export-function-direct.js:1:1

12 of 30 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/lower/lower_using_unsupported_async/loops.js:1:1

20 of 43 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/lower/lower_using_unsupported_using_and_async/loops.js:1:1

20 of 43 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length crates/rolldown/tests/esbuild/ts/ts_sibling_enum/nested-propagation.ts:1:1

18 of 32 non-conventional identifiers are single-character (56%) (token pass, confidence 0.50)
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/cjs_compat/dynamic_import_in_cjs_non_static/main.js:2:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
// Non-static dynamic import with variable
import(moduleName).then(console.log);

// Static import with @vite-ignore (no import record)
```
likely benign LLM, confidence 0.94 Test fixture for a non-static dynamic import in CJS compatibility handling.
Reasoning
CJS compatibility test fixture; the variable-specifier import is deliberate and the file is a test case, with no sign of exfiltration or payload loading.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/cjs_compat/dynamic_import_in_cjs_non_static/main.js:5:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
// Static import with @vite-ignore (no import record)
import(/* @vite-ignore */ './ignored.js').then(console.log);
```
likely benign LLM, confidence 0.94 Test fixture for vite-ignore dynamic import handling.
Reasoning
Test fixture with an @vite-ignore comment on a dynamic import of a local file; benign.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/cjs_compat/dynamic_import_in_cjs_non_static_specifier_names/cjs-root.cjs:4:51

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
var Object = process.env.TEST_IMPORT_PATH || 'node:path';
module.exports = { specifier: Object, load: () => import(Object) };
```
likely benign LLM, confidence 0.92 Test fixture exporting a dynamic import whose specifier is read from an environment variable.
Reasoning
Test fixture where the specifier comes from an env variable defaulting to node:path. This is a test of specifier naming in CJS; the env lookup is configurable and loads a built-in by default, so it is low risk in a test tree.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/cjs_compat/dynamic_import_in_cjs_non_static_specifier_names/main.js:8:32

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
// The import binding `aliased` is printed as `target`.
export const viaImport = () => import(aliased);

// The lowered `import()` prints `Object`, so the parameter `Object` can get a new name.
```
dismissed LLM, confidence 0.90 A bundler CJS compatibility test with import(aliased) and comments about identifier renaming.
Reasoning
A bundler CJS compatibility test in which the snippet's comments describe identifier renaming. The import(aliased) call is a deliberate test input for non-static specifier name handling.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/cjs_compat/dynamic_import_in_cjs_non_static_specifier_names/main.js:12:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function viaParam(Object) {
  return import(Object);
}
```
likely benign LLM, confidence 0.85 Test fixture where dynamic import takes a non-literal specifier from a parameter.
Reasoning
A bundler test fixture exercising dynamic import with a parameter-named specifier; a standard pattern for testing module resolution in a bundler's test suite.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/cjs_compat/top_level_this_is_initial_exports/_test.mjs:19:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
for (const [name, value] of Object.entries(all)) {
  assert.deepEqual(value, require(`./${name}.cjs`), name);
}
```
likely benign LLM, confidence 0.85 Test loop requiring CommonJS fixture files by template-literal name.
Reasoning
Test harness requiring generated CJS fixtures by name from a fixed directory listing; normal test code, not malicious.
info ~~warn~~ → info by review dynamic-import crates/rolldown/tests/rolldown/function/experimental/strict_execution_order/cross_chunk_dynamic_importer_uses_call_site_trigger/_test.mjs:11:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
const { bTargetPromise } = await import(new URL('./dist/b.js', import.meta.url));
const nsFromB = await bTargetPromise;
assert.strictEqual(nsFromB.value, 1);
```
likely benign LLM, confidence 0.88 Test importing a built local chunk via a URL constructed from import.meta.url.
Reasoning
Imports a locally built bundle chunk via import.meta.url relative URL in a test; benign.
info ~~critical~~ → info by review dynamic-execution crates/rolldown/tests/rolldown/issues/9375/_test.mjs:19:1

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
// to `pinia$1` and the call resolves to the mock above.
new Function(bundle)();

// Reaching this line means the bundle ran without throwing → no shadowing.
```
likely benign LLM, confidence 0.85 Test executes a generated bundle via new Function to verify no symbol shadowing.
Reasoning
Bundle output is executed with new Function in a test to check for shadowing; the bundle is locally generated test output, so this is test harness behavior, not an attack.

info long-line crates/rolldown/tests/rolldown/misc/preserve_entry_signature/basic/readme.md:1:1

line length 1133 characters (raw pass, confidence 0.50)

[rollup playground](https://rollupjs.org/repl/?version=4.41.1&shareable=JTdCJTIyZXhhbXBsZSUyMiUzQW51bGwlMkMlMjJtb2R1bGVzJTIyJTNBJTVCJTdCJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMCU3QiUyMHZhbHVlJTIwYXMlMjBzaGFyZWQlMjAlN0QlMjBmcm9tJTIwJy4lMkZsaWIuanMnJTNCJTVDbmltcG9ydCgnLiUyRmR5bmFtaWMuanMnKSUzQiU1Q24lNUNuY29uc29sZS5sb2coJTYwc2hh

info long-line crates/rolldown/tests/rolldown/misc/preserve_entry_signature/exports-only/readme.md:1:1

line length 1769 characters (raw pass, confidence 0.50)

[rollup playground](https://rollupjs.org/repl/?version=4.41.1&shareable=JTdCJTIyZXhhbXBsZSUyMiUzQW51bGwlMkMlMjJtb2R1bGVzJTIyJTNBJTVCJTdCJTIyY29kZSUyMiUzQSUyMmltcG9ydCUyMCU3QiUyMHZhbHVlJTIwYXMlMjBzaGFyZWQlMjAlN0QlMjBmcm9tJTIwJy4lMkZsaWIuanMnJTNCJTVDbmltcG9ydCgnLiUyRmR5bmFtaWMuanMnKSUzQiU1Q24lNUNuY29uc29sZS5sb2coJTYwc2hh

info ~~critical~~ → info by review dynamic-execution crates/rolldown/tests/rolldown/topics/deconflict/cjs_wrapper_params_shadowing_top_level_binding/_test.mjs:5:7

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
  globalThis.__configName === 'iife'
    ? new Function(
        fs.readFileSync(new URL('./dist/main.js', import.meta.url), 'utf8') + '; return lib;',
      )()
```
likely benign LLM, confidence 0.85 Test evaluates generated IIFE bundle through new Function.
Reasoning
Test evaluates a locally produced bundle file with new Function in a conditional; standard test harness for IIFE output.
info ~~critical~~ → info by review dynamic-execution crates/rolldown/tests/rolldown/topics/deconflict/top_level_binding_shadowing_symbol_to_string_tag/_test.mjs:6:7

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
  globalThis.__configName === 'iife'
    ? new Function(code + '; return lib;')()
    : (() => {
        const module = { exports: {} };
```
likely benign LLM, confidence 0.85 Test runs bundled code through new Function for IIFE format checks.
Reasoning
Test runs bundled code via new Function for IIFE format; benign test scaffolding.
info identifier-low-length crates/rolldown/tests/rollup/jsx/react-jsx-declarations-with-key-attribute/main.js:1:1

20 of 46 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)
info whitespace-anomaly crates/rolldown/tests/rollup/jsx/transpiles-react-jsx/jsx.js:67:1

file mixes tab and space indentation (1 tab-indented and 15 space-indented lines) (raw pass, confidence 0.40)
```
console.log(
  <div>
    Hello
        World
```
info whitespace-anomaly crates/rolldown/tests/rollup/preserve-for-of-iterable/loops.js:2:1

file mixes tab and space indentation (5 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)
```
export const awaitable = async (iterable) => {
	for await (const value of iterable) {
	}
}
```
info unicode-mixed-script crates/rolldown_binding/src/classic_bundler.rs:292:8

identifier `unKnown` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
      "UNKNOWN-SESSION",
      "unKnown-session",
      "unknown-ſession",
      "unknown-seßion",
```

info unicode-mixed-script crates/rolldown_utils/src/ecmascript.rs:162:32

identifier `π你` mixes scripts: Greek + Han (in string/comment) (raw pass, confidence 0.40)

fn test_escape_non_ascii() {
  assert_eq!(escape_non_ascii("π你😀", false), "π你😀");
  assert_eq!(escape_non_ascii("π你😀", true), "\\u03C0\\u4F60\\u{1F600}");
  assert_eq!(to_ecma_string_literal("外部", true), "\"\\u5916\\u90E8\"");

info unicode-mixed-script crates/rolldown_utils/src/ecmascript.rs:162:53

identifier `π你` mixes scripts: Greek + Han (in string/comment) (raw pass, confidence 0.40)

fn test_escape_non_ascii() {
  assert_eq!(escape_non_ascii("π你😀", false), "π你😀");
  assert_eq!(escape_non_ascii("π你😀", true), "\\u03C0\\u4F60\\u{1F600}");
  assert_eq!(to_ecma_string_literal("外部", true), "\"\\u5916\\u90E8\"");

info unicode-mixed-script crates/rolldown_utils/src/ecmascript.rs:163:32

identifier `π你` mixes scripts: Greek + Han (in string/comment) (raw pass, confidence 0.40)

  assert_eq!(escape_non_ascii("π你😀", false), "π你😀");
  assert_eq!(escape_non_ascii("π你😀", true), "\\u03C0\\u4F60\\u{1F600}");
  assert_eq!(to_ecma_string_literal("外部", true), "\"\\u5916\\u90E8\"");
}

info long-line docs/apis/plugin-api.md:167:1

line length 598 characters (raw pass, confidence 0.50)

The first hook of the output generation phase is [`renderStart`](/reference/Interface.Plugin#renderstart), the last one is either [`generateBundle`](/reference/Interface.Plugin#generatebundle) if the output was successfully generated via [`bundle.generate(...)`](/reference/Interface.RolldownBuild#generate), [`writeBund

info long-line docs/apis/plugin-api/inter-plugin-communication.md:43:1

line length 596 characters (raw pass, confidence 0.50)

Plugins can annotate modules with custom meta-data which can be set by themselves and other plugins via the [`resolveId`](/reference/Interface.Plugin#resolveid), [`load`](/reference/Interface.Plugin#load), and [`transform`](/reference/Interface.Plugin#transform) hooks and accessed via [`this.getModuleInfo`](/reference/

info ~~critical~~ → info by review dynamic-execution packages/rolldown/src/options/docs/checks-eval.md:6:1

[embedded javascript] `eval` called with a non-literal expression (ast pass, confidence 0.75)
```
const code = 'console.log("Hello")';
eval(code); // This triggers the warning
```
likely benign LLM, confidence 0.80 Docs example showing eval that triggers a rolldown warning.
Reasoning
Documentation example demonstrating a warning for eval; the code is a harmless console.log.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/arbitrary-import-names.test.ts:92:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      if (chunk.type !== 'chunk') return;
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect({ ...namespace }).toEqual(values);
    } finally {
```
likely benign LLM, confidence 0.85 Test loads bundled chunk output via a data: URI import to check exports.
Reasoning
Test imports the bundler's own output as a data URI to check exported names; benign test verification of generated code.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/mangle-properties.test.ts:120:11

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
  try {
    await import(`data:text/javascript,${encodeURIComponent(chunk!.code)}`);
    expect(testGlobal.rolldownManglePropsResult).toBe(15);
  } finally {
```
likely benign LLM, confidence 0.85 Test imports mangled bundle output via data URI and checks a global.
Reasoning
Test imports generated chunk code via data URI to verify property mangling results; benign test harness.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/preserve-entry-signatures.test.ts:136:24

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    expect(chunks[0].exports).toEqual(['POST']);
    const main = await import(`data:text/javascript,${encodeURIComponent(chunks[0].code)}`);
    expect(Object.keys(main)).toEqual(['POST']);
    expect(await main.POST()).toBe(true);
```
likely benign LLM, confidence 0.85 Test imports generated entry chunk via data URI and checks exports.
Reasoning
Test imports generated chunk via data URI to verify entry exports; standard bundler test pattern.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:39:19

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        format === 'es'
          ? await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`)
          : (() => {
              const context = { exports: {} };
```
likely benign LLM, confidence 0.85 Test loads bundler ES output via data URI to verify shimmed exports.
Reasoning
Test loads bundled ES output via data URI for format verification; benign test code.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:75:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(() => namespace.update('y')).toThrow(TypeError);
```
likely benign LLM, confidence 0.95 Test that imports bundler-generated ESM output via a data: URI to check missing-export shim behavior.
Reasoning
This is a test in the rolldown bundler repo. It bundles code in-memory, then dynamically imports the generated output as a data: URI to verify runtime export shim behavior. The data URI contains the test's own bundle output, not attacker-supplied payload, and nothing touches supply chain or disk-based malware patterns.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:121:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.ns.x).toBe(2);
      expect(namespace.x).toBeUndefined();
```
likely benign LLM, confidence 0.95 Test importing bundled chunk code as a data: URI module to check namespace exports.
Reasoning
Same test pattern: the data: URI wraps the freshly generated chunk code so the test can inspect the namespace object. This is a legitimate way to evaluate ESM output in a unit test.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:143:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings.map((warning) => warning.code).sort((a, b) => a!.localeCompare(b!))).toEqual([
```
likely benign LLM, confidence 0.95 Test importing generated chunk via data: URI to assert keys and warnings.
Reasoning
Identical test construct; the encoded content is the bundler's own output produced earlier in the same test, consistent with testing shim behavior.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:219:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.95 Test evaluating generated bundle output as a data: URI module.
Reasoning
Same pattern of evaluating bundler output through a data: URI inside a test; no external or attacker-controlled payload is introduced.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:238:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings).toEqual([expect.objectContaining({ code: 'IMPORT_IS_UNDEFINED' })]);
```
likely benign LLM, confidence 0.95 Test importing generated code via data URI to check IMPORT_IS_UNDEFINED warning.
Reasoning
Same test-harness pattern; the data URI encodes the bundler's own generated code for assertion on warnings.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:255:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect({ ...namespace.ns }).toEqual({ x: 42, y: undefined });
    expect({ ...namespace.cycle }).toEqual({ x: 42, y: undefined });
```
likely benign LLM, confidence 0.95 Test checking namespace contents of re-imported generated chunk.
Reasoning
Standard test usage: generated chunk is re-imported as a data URI to verify namespace shape. Not malicious.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:288:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([['missing'], ['missing']]);
    expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.95 Test importing generated cyclic-export chunk via data URI.
Reasoning
Same harness; the data URI wraps bundler output produced in the test itself.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:303:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.value).toBe(42);
    expect(namespace.missing).toBeUndefined();
```
likely benign LLM, confidence 0.95 Test evaluating generated module namespace via data URI.
Reasoning
Same pattern; generated bundle code is evaluated as a data URI module within the test to assert export values.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:39:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        if (format === 'es') {
          namespace = await import(`data:text/javascript,${encodeURIComponent(dep.code)}`);
        } else {
          const context = { exports: {} };
```
likely benign LLM, confidence 0.93 Test helper importing bundled dependency output as data URI for namespace checks.
Reasoning
Test helper evaluates ES-format output (dep.code produced by the bundler) through a data URI when format is 'es', with a CJS branch for other formats. This is a standard way to execute bundle output in tests.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:99:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
          if (format === 'es') {
            namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
          } else {
            const context = { exports: {} };
```
likely benign LLM, confidence 0.93 Test evaluating generated chunk as ES module via data URI in multi-format harness.
Reasoning
Same helper pattern in a sibling test; the encoded code is the bundler's generated chunk, and the CJS path shows it is a multi-format test harness.
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/restore-query-extension/_config.ts:38:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.split('?')[0], 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/transform/_config.ts:35:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.slice(0, -7), 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:460:37

orphaned low surrogate \uDD37 (no preceding high surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(2) === '\uDD37b'
    assert.strictEqual(s.slice(2), '\uDD37b');
    // slice(0, 2) ends at low surrogate — returns 'a' + lone high surrogate
    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:463:41

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'
    assert.strictEqual(s.slice(0, 2), 'a\uD83E');
    // slice(3) is 'b'
    assert.strictEqual(s.slice(3), 'b');

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:484:46

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)
```
    assert.strictEqual(s.toString(), 'abIJefgh🤷kl');
    assert.strictEqual(s.slice(-3, 3), 'Jefgh\uD83E');
  });
});
```
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file0.js:1:1

547 of 1183 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info whitespace-anomaly packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:2:1

file mixes tab and space indentation (1 tab-indented and 37484 space-indented lines) (raw pass, confidence 0.40)
```
import {
  AcceleratedAnimation,
  addPointerEvent,
  addPointerInfo,
```

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:35328:8

compression ratio 0.845 is >2σ above file mean 0.631 (raw pass, confidence 0.50)

      // System fonts - Taken from https://furbo.org/stuff/systemfonts-new.html - "All Platforms" section
      'system-ui|-apple-system|BlinkMacSystemFont|Segoe UI|Roboto|Oxygen|Ubuntu|Cantarell|Fira Sans|Droid Sans|Helvetica Neue|sans-serif'
    );
    const fontFamily = {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file10.js:1:1

72 of 137 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file28.js:1:1

3890 of 8197 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file29.js:1:1

23 of 40 non-conventional identifiers are single-character (58%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file30.js:1:1

25 of 42 non-conventional identifiers are single-character (60%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:1:1

69 of 162 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:105:10

compression ratio 0.832 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Co-Founder of UIE asks, “What was the most important thing you learned yesterday, and how will it impact what you do in the future?”',
    }),
    /*#__PURE__*/ e('p', {

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:132:10

compression ratio 0.815 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        "People don't always know what they want, even if they think the do. As Joe Leech, a UX psychologist says, \"People want more choices, but can't deal with them.”",
    }),
    /*#__PURE__*/ e('p', {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file34.js:1:1

392 of 725 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:1:1

55 of 136 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:111:10

compression ratio 0.873 is >2σ above file mean 0.679 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Wsp\xf3łzałożyciel UIE pyta: „Co było najważniejszą rzeczą, jaką wczoraj się nauczyłeś, i w jaki spos\xf3b to wpłynie na to, co robisz w przyszłości?”',
    }),
    /*#__PURE__*/ e('p', {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file46.js:1:1

35 of 87 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file5.js:1:1

19 of 41 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info unicode-mixed-script packages/rolldown/tests/validate-option.test.ts:138:6

identifier `unKnown` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
    'UNKNOWN-SESSION',
    'unKnown-session',
    'unknown-ſession',
    'unknown-seßion',
```
info whitespace-anomaly packages/rollup-tests/test/form/found-tree-shaking-not-align.js:7:1

file mixes tab and space indentation (7 tab-indented and 13 space-indented lines) (raw pass, confidence 0.40)
```
const {
	runTestSuiteWithSamples,
} = require('../utils.js');
const {
```
info whitespace-anomaly packages/rollup-tests/test/form/index.js:12:1

file mixes tab and space indentation (135 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
```
const {
	compareLogs,
	normaliseOutput: normalizeOutput,
	runTestSuiteWithSamples,
```
info ~~critical~~ → info by review dynamic-execution packages/rollup-tests/test/function/index.js:22:21

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
	try {
		const function_ = new Function(contextKeys, code);
		function_.apply({}, contextValues);
	} catch (error) {
```
likely benign LLM, confidence 0.90 Test runner that builds a Function from bundled code and applies it with context values.
Reasoning
This is Rollup's test harness, which wraps bundled code in a Function constructor to execute it and check results. The body comes from test fixtures, not untrusted input, and the call sits in a try/catch used for test assertions.
info ~~critical~~ → info by review dynamic-execution packages/rollup-tests/test/misc/iife.js:9:20

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
	const globalKeys = Object.keys(globalsWithAssert);
	const function_ = new Function(globalKeys, code);
	function_.apply(
		globals,
```
likely benign LLM, confidence 0.90 Test that evaluates generated IIFE output via new Function with supplied globals.
Reasoning
Rollup's IIFE test evaluates the generated bundle through the Function constructor with a set of globals. This is standard test-harness behavior in a bundler repository, with no external input involved.
info ~~critical~~ → info by review dynamic-execution packages/rollup-tests/test/misc/umd.js:11:21

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
  const globalKeys = Object.keys(globalsWithAssert);
  const function_ = new Function(globalKeys, code);
  function_.apply(
    thisValue,
```
likely benign LLM, confidence 0.90 Test that runs generated UMD output via new Function with global keys and a this value.
Reasoning
Rollup's UMD test runs the generated bundle through new Function with a set of globals to check the output. It matches the other harness files and has no sign of malicious intent.
info whitespace-anomaly packages/rollup-tests/test/sourcemaps/index.js:15:1

file mixes tab and space indentation (52 tab-indented and 5 space-indented lines) (raw pass, confidence 0.40)
```
runTestSuiteWithSamples(
	'sourcemaps',
	path.resolve(__dirname, '../../../../rollup/test/sourcemaps/samples'),
	/**
```
info whitespace-anomaly packages/rollup-tests/test/utils.js:11:1

file mixes tab and space indentation (329 tab-indented and 4 space-indented lines) (raw pass, confidence 0.40)
```
const {
	closeSync,
	fsyncSync,
	openSync,
```
info whitespace-anomaly scripts/src/esbuild-tests/gen-tests.ts:17:1

file mixes tab and space indentation (1 tab-indented and 384 space-indented lines) (raw pass, confidence 0.40)
```
const TREE_SITTER_WASM_GO_FILENAME = path.resolve(
  import.meta.dirname,
  '../../tmp/tree-sitter-go.wasm',
);
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/rolldown/rolldown rolldown && cd rolldown
git checkout v1.2.15
disclude scan --severity info --diff v1.2.14 .