@vitest/mocker 5.1.0-beta.1

Source: https://github.com/vitest-dev/vitest
Tag scanned: v5.1.0-beta.1
Directory: packages/mocker (only this part of the repository was scanned)
Compared with: v5.0.5 (0 signals introduced since)
Files: 32 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 3.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 01:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:81:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    }${url.hash}`
    return this.wrapDynamicImport(() => import(/* @vite-ignore */ actualUrl)).then((mod) => {
      if (!resolved.optimized || typeof mod.default === 'undefined') {
        return mod
```
likely benign LLM, confidence 0.90 Runtime dynamic import of a resolved module URL inside a browser test mocker.
Reasoning
This is a Vite-style module mocker in a test framework. The dynamic import uses a computed URL derived from the module resolution path and is wrapped in a helper, with the @vite-ignore annotation signaling intentional bundler-opt-out. This is standard for runtime module loading in browser test tooling, not obfuscation or malicious execution.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:128:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const query = url.search ? `${url.search}&t=${now()}` : `?t=${now()}`
      const moduleObject = await import(
        /* @vite-ignore */ `${url.pathname}${query}&mock=${mock.type}${url.hash}`
      )
```
likely benign LLM, confidence 0.90 Dynamic import of a cache-busted, mock-tagged module path in a browser mocker.
Reasoning
The specifier is built from the module pathname, a timestamp query for cache busting, and the mock type. This is a plain template literal for loading mocked modules in a test harness, with the @vite-ignore annotation. No encoding or obfuscation is present, and the input is local module paths.
info ~~warn~~ → info by review dynamic-import packages/mocker/src/browser/mocker.ts:134:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    return import(/* @vite-ignore */ mock.redirect)
  }
```
likely benign LLM, confidence 0.85 Dynamic import of a configured mock redirect module path.
Reasoning
This imports mock.redirect, a configured redirect target for mocking a module. It is a plain dynamic import of a developer-configured path in test tooling. The only risk is that the redirect value is not validated, but it originates from the mocker's own configuration, not untrusted input.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v5.1.0-beta.1
disclude scan --severity info --diff v5.0.5 packages/mocker