@vitest/mocker 5.0.5

Source: https://github.com/vitest-dev/vitest
Tag scanned: v5.0.5
Directory: packages/mocker (only this part of the repository was scanned)
Compared with: v5.0.4 (0 signals introduced since)
Files: 31 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 20:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:81:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    }${url.hash}`
    return this.wrapDynamicImport(() => import(/* @vite-ignore */ actualUrl)).then((mod) => {
      if (!resolved.optimized || typeof mod.default === 'undefined') {
        return mod
```
likely benign LLM, confidence 0.93 Dynamic import of a resolved module URL inside the browser mocker, annotated with @vite-ignore.
Reasoning
The import specifier is a resolved module URL built from the module graph (pathname, query, hash) and the file carries a /* @vite-ignore */ annotation, the standard way to silence Vite's warning for runtime-resolved module loading. This matches a test-runner module mocker loading modules it has already resolved. No shell, encoding, or remote-fetch behavior appears in the snippet.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:128:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const query = url.search ? `${url.search}&t=${now()}` : `?t=${now()}`
      const moduleObject = await import(
        /* @vite-ignore */ `${url.pathname}${query}&mock=${mock.type}${url.hash}`
      )
```
likely benign LLM, confidence 0.92 Dynamic import with a cache-busted, mock-tagged module path in the browser mocker.
Reasoning
The specifier is a template literal built from the URL pathname, a timestamp cache-buster query, and the mock type, all within a mocking utility. The @vite-ignore annotation and the structure indicate ordinary module-mock loading. Nothing in the snippet suggests decoding of hidden payloads or fetching untrusted code.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:134:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    return import(/* @vite-ignore */ mock.redirect)
  }
```
likely benign LLM, confidence 0.90 Dynamic import of a mock's configured redirect module, annotated with @vite-ignore.
Reasoning
The import targets mock.redirect, a configured redirect path for a mock, and is annotated @vite-ignore. This is a normal mechanism for redirecting a mocked module to an alternate implementation. The AST signal is only the non-literal specifier, which is expected for this design.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v5.0.5
disclude scan --severity info --diff v5.0.4 packages/mocker