pretty-format 30.5.1

Source: https://github.com/jestjs/jest
Tag scanned: v30.5.1
Directory: packages/pretty-format (only this part of the repository was scanned)
Compared with: v30.5.0 (0 signals introduced since)
Files: 24 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 3.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 14:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:28:17

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
])('%s', (_name, reactPackage, rendererPackage) => {
  const React = require(reactPackage) as typeof import('react');

  // The renderer reaches into React's shared internals, so it only works
```
likely benign LLM, confidence 0.93 Test-suite require of a React package name chosen from a parameterized test table.
Reasoning
The require call takes its specifier from a parameterized test table (reactPackage) of React package names and versions, inside a Jest test file. This is a standard pattern for testing against multiple React versions and is not obfuscation or malicious execution.
info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:37:34

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    jest.isolateModules(() => {
      jest.doMock('react', () => require(reactPackage));
      const isolatedReact = require(reactPackage) as typeof import('react');
      const TestRenderer = require(
```
likely benign LLM, confidence 0.93 Jest doMock factory requiring the parameterized React package under test.
Reasoning
Inside jest.isolateModules and jest.doMock, the non-literal require(reactPackage) loads the React version under test from the test table. This is ordinary Jest module mocking for version-matrix testing with no decoding or hidden execution.
info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:38:29

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      jest.doMock('react', () => require(reactPackage));
      const isolatedReact = require(reactPackage) as typeof import('react');
      const TestRenderer = require(
        rendererPackage,
```
likely benign LLM, confidence 0.93 Test code loading React and react-test-renderer packages via parameterized specifiers.
Reasoning
The require calls load the React and renderer packages named in the test parameters, with type casts to typeof import. This is consistent with a React renderer compatibility test and carries no obfuscation signal beyond the dynamic specifier.
info ~~warn~~ → info by review dynamic-import packages/pretty-format/src/__tests__/ReactVersions.test.ts:39:28

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      const isolatedReact = require(reactPackage) as typeof import('react');
      const TestRenderer = require(
        rendererPackage,
      ) as typeof import('react-test-renderer');
```
likely benign LLM, confidence 0.93 Test-suite require of the react-test-renderer package chosen by test parameter.
Reasoning
The renderer require uses a test-table parameter to select the react-test-renderer version. The dynamic specifier is confined to a test file and matches the legitimate multi-version testing pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/jestjs/jest jest && cd jest
git checkout v30.5.1
disclude scan --severity info --diff v30.5.0 packages/pretty-format