pretty-format 30.5.1

Source: https://github.com/jestjs/jest
Tag scanned: v30.5.1
Directory: packages/pretty-format (only this part of the repository was scanned)
Compared with: v30.5.0 (0 signals introduced since)
Files: 24 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 4.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:28:17

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
])('%s', (_name, reactPackage, rendererPackage) => {
  const React = require(reactPackage) as typeof import('react');

  // The renderer reaches into React's shared internals, so it only works
```
likely benign LLM, confidence 0.95 Test helper that requires a React package whose name is supplied by a test.each parameter table.
Reasoning
The require() specifier comes from the test.each table parameters (reactPackage), which are fixed package names such as 'react' and 'react-test-renderer' in a test file. This is a standard parameterized test pattern for running the same suite against multiple React versions. No untrusted input or decoding is involved.
info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:37:34

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    jest.isolateModules(() => {
      jest.doMock('react', () => require(reactPackage));
      const isolatedReact = require(reactPackage) as typeof import('react');
      const TestRenderer = require(
```
likely benign LLM, confidence 0.95 Jest mock factory that requires the parameterized React package to isolate module instances per version.
Reasoning
Inside jest.isolateModules, the require(reactPackage) is used to mock 'react' with a version chosen from the test parameter table. It is test scaffolding for module isolation across React versions, not a runtime payload loader.
info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:38:29

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      jest.doMock('react', () => require(reactPackage));
      const isolatedReact = require(reactPackage) as typeof import('react');
      const TestRenderer = require(
        rendererPackage,
```
likely benign LLM, confidence 0.95 Loads isolated React and react-test-renderer packages chosen by test parameters.
Reasoning
The dynamic require of reactPackage and rendererPackage uses parameters from a fixed test table. The surrounding comment about the renderer reaching into React internals shows this is a legitimate compatibility test.
info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:39:28

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const isolatedReact = require(reactPackage) as typeof import('react');
      const TestRenderer = require(
        rendererPackage,
      ) as typeof import('react-test-renderer');
```
likely benign LLM, confidence 0.95 Requires the react-test-renderer package named by a test parameter.
Reasoning
The renderer require uses rendererPackage from the same fixed parameter table, typed as react-test-renderer. The ast dynamic-import flag fires only because the specifier is not a string literal, and the file is a test.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jestjs/jest jest && cd jest
git checkout v30.5.1
disclude scan --severity info --diff v30.5.0 packages/pretty-format