rolldown 1.2.14

Source: https://github.com/rolldown/rolldown
Tag scanned: v1.2.14
Directory: packages/rolldown (only this part of the repository was scanned)
Compared with: v1.2.13 (11 signals introduced since)
Files: 1736 scanned, 78 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 86 info
Scan time: 57.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 65 of 65 warn and critical signals; 65 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 05:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/preserve-entry-signatures.test.ts:136:24 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    expect(chunks[0].exports).toEqual(['POST']);
    const main = await import(`data:text/javascript,${encodeURIComponent(chunks[0].code)}`);
    expect(Object.keys(main)).toEqual(['POST']);
    expect(await main.POST()).toBe(true);
```
likely benign LLM, confidence 0.80 Test imports bundled entry chunk via a data URI to verify exported signatures.
Reasoning
The test imports bundled entry code via a data URI to check its exports and the POST function. This matches the other behavior tests and runs only the project's own output.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:39:19 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        format === 'es'
          ? await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`)
          : (() => {
              const context = { exports: {} };
```
likely benign LLM, confidence 0.93 Test helper that dynamically imports the bundled ESM output as a data: URI to check its runtime export behavior.
Reasoning
The import of a data: URI wraps the bundler's own generated output and runs it as an ES module inside a test. The payload is the chunk.code produced by bundle.generate in the same test, so it is not attacker-controlled. This is a common way to test ESM output without writing files.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:75:31 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(() => namespace.update('y')).toThrow(TypeError);
```
likely benign LLM, confidence 0.93 Test that evaluates generated bundle code via a data: URI import and asserts on its exported namespace.
Reasoning
The data: URI imports chunk.code generated by the bundler in the same test. The module is then checked with expect assertions, which fits a test of shimmed missing exports.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:121:31 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.ns.x).toBe(2);
      expect(namespace.x).toBeUndefined();
```
likely benign LLM, confidence 0.93 Test importing generated bundle output as a data: URI module to assert namespace shape.
Reasoning
The same pattern: the data: URI import runs only the bundler's own generated output inside a test, with assertions on the namespace. No external input or network source is involved.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:143:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings.map((warning) => warning.code).sort((a, b) => a!.localeCompare(b!))).toEqual([
```
likely benign LLM, confidence 0.93 Test that loads generated bundle code through a data: URI import and checks keys and warnings.
Reasoning
This is a test that generates ESM output and checks namespace keys and warning codes. The data: URI import only evaluates the bundler's own output, which is standard test technique.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:219:31 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.93 Test evaluating generated bundle code via data: URI and asserting exports and warnings.
Reasoning
The data: URI import evaluates bundler-generated code from the same test, and the assertions verify export behavior. No malicious input path exists.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:238:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings).toEqual([expect.objectContaining({ code: 'IMPORT_IS_UNDEFINED' })]);
```
likely benign LLM, confidence 0.93 Test loading generated module code via data: URI to verify IMPORT_IS_UNDEFINED warnings.
Reasoning
Same pattern as the other tests in this file: the data: URI carries the test's own generated output and checks warning codes. This is a legitimate testing approach.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:255:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect({ ...namespace.ns }).toEqual({ x: 42, y: undefined });
    expect({ ...namespace.cycle }).toEqual({ x: 42, y: undefined });
```
likely benign LLM, confidence 0.93 Test importing generated bundle code as a data: URI to assert cyclic namespace exports.
Reasoning
The data: URI import runs bundler output produced in the test to check cyclic and namespace export values. This is consistent with testing a bundler, not with an attack.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:288:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([['missing'], ['missing']]);
    expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.93 Test evaluating generated module code via data: URI and checking namespace keys.
Reasoning
The data: URI evaluates only the bundler's generated output in a test, with assertions on namespace keys and warnings. No external or attacker-controlled data is loaded.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:303:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.value).toBe(42);
    expect(namespace.missing).toBeUndefined();
```
likely benign LLM, confidence 0.93 Test importing generated bundle code as a data: URI to check exported value and missing export.
Reasoning
The data: URI carries the bundler's output generated in the test, and the assertions check the export values. This is a standard in-process test pattern.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:39:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        if (format === 'es') {
          namespace = await import(`data:text/javascript,${encodeURIComponent(dep.code)}`);
        } else {
          const context = { exports: {} };
```
likely benign LLM, confidence 0.92 Test helper that loads generated dependency code through a data: URI import for the es format.
Reasoning
The data: URI import evaluates dep.code, which is bundler output produced by the test's own generation step, in the es branch of a test helper. The else branch uses a context object for other formats, which is also test scaffolding. No untrusted input reaches this path.
info ~~warn~~ → info by review dynamic-import packages/rolldown/build.ts:254:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
async function buildRuntimeEntry() {
  const helperNames = Object.keys(await import(pathToFileURL(runtimeBaseInputFile).href));
  await build({
    input: { 'experimental-runtime': commonRuntimeInputFile },
```
likely benign LLM, confidence 0.85 Build script dynamically imports the runtime base input file to list its exported helper names.
Reasoning
A build script imports a locally generated runtime base file to read its export names. The specifier comes from the build's own input path, not untrusted input, so this is a normal build-time pattern.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/binding.cjs:69:31

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    try {
      const overrideBinding = require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH)
      // The override may be a generated WASI loader, which already reports its
      // own flavor. Adopt it: `module.exports` aliases this object, so claiming
```
likely benign LLM, confidence 0.70 Loads an optional native binding override from an environment-variable path.
Reasoning
The require path comes from the NAPI_RS_NATIVE_LIBRARY_PATH environment variable, which is a documented napi-rs override for loading a native binding. The comment shows it is an intentional override, though env-controlled code loading deserves a note.
info ~~critical~~ → info by review dynamic-execution packages/rolldown/src/options/docs/checks-eval.md:6:1

[embedded javascript] `eval` called with a non-literal expression (ast pass, confidence 0.75)
```
const code = 'console.log("Hello")';
eval(code); // This triggers the warning
```
dismissed LLM, confidence 0.90 Markdown docs example showing a call to eval that triggers the scanner warning.
Reasoning
This is a documentation example in a markdown file, illustrating the eval warning itself. It is not executed code in the package.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/parallel-plugin-worker.ts:15:36

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      pluginInfos.map(async (pluginInfo) => {
        const pluginModule = await import(pluginInfo.fileUrl);
        const definePluginImpl = pluginModule.default as ReturnType<
          typeof defineParallelPluginImplementation
```
likely benign LLM, confidence 0.85 Worker imports each configured plugin module by its file URL to get its plugin definition.
Reasoning
A bundler's parallel worker imports plugin modules from configured file URLs. Loading user-configured plugins is the core purpose of this code path.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:81:19

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  try {
    return (await import(pathToFileURL(file).href)).default;
  } finally {
    fs.unlink(file, () => {}); // Ignore errors
```
likely benign LLM, confidence 0.85 Imports a transpiled temporary config file and removes it afterward.
Reasoning
The code imports a temporary file it just compiled from a config, then deletes it in finally. This is the standard way to load a TypeScript or ESM config and is not obfuscation.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:152:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // Runtimes without Module-hook support (e.g. Bun/Deno)
  const mod = await import(url + '?t=' + Date.now());
  return mod.default;
}
```
likely benign LLM, confidence 0.90 Re-imports a config URL with a timestamp query to bypass the module cache.
Reasoning
The query-string timestamp is a cache-busting technique so config changes reload on each import. It is a common, legitimate pattern for config hot reload.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:182:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    ) {
      return (await import(pathToFileURL(configPath).href)).default;
    } else if (SUPPORTED_TS_CONFIG_FORMATS.includes(ext)) {
      const rawConfigPath = path.resolve(configPath);
```
likely benign LLM, confidence 0.90 Imports the user's config file by its resolved file URL.
Reasoning
The import target is a config file path the user supplied, resolved to a file URL. Loading the config module is the expected behavior.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/webcontainer-fallback.cjs:21:18

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
module.exports = require(bindingEntry);
```
likely benign LLM, confidence 0.70 Fallback module re-exports a binding loaded from a computed entry path.
Reasoning
This is a fallback that re-exports a binding module via require of a computed entry path. The surrounding fallback logic suggests a platform loader, but the bindingEntry source is not shown, so a little uncertainty remains.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/arbitrary-import-names.test.ts:92:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      if (chunk.type !== 'chunk') return;
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect({ ...namespace }).toEqual(values);
    } finally {
```
likely benign LLM, confidence 0.80 Test imports bundled chunk code via a data URI to verify export names.
Reasoning
A test encodes bundler output as a data: URI to check exported names. The data import runs only the test's own build output and does not touch disk or untrusted input.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/behaviors/dependency-path-escaping.test.ts:70:72

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
            const define = (ids: string[], factory: (...args: unknown[]) => void) => {
              factory(...ids.map((id) => (id === 'exports' ? exports : require(id))));
            };
            define.amd = true;
```
likely benign LLM, confidence 0.85 Test AMD define shim resolving fixture dependency ids with require.
Reasoning
This is a test shim that emulates AMD define and resolves dependency ids via require. The ids come from test fixtures, which is expected for testing path escaping.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/behaviors/inline-common-chunks/run-root.mjs:44:29

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  try {
    const namespace = await import(pathToFileURL(file).href);
    await globalThis.__chain;
    root.exports = Object.fromEntries(
```
likely benign LLM, confidence 0.90 Test harness imports a generated output file by file URL.
Reasoning
A test runner imports a generated chunk file by its file URL to check the inlined output. This is an expected test-harness pattern.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/mangle-properties.test.ts:120:11

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
  try {
    await import(`data:text/javascript,${encodeURIComponent(chunk!.code)}`);
    expect(testGlobal.rolldownManglePropsResult).toBe(15);
  } finally {
```
likely benign LLM, confidence 0.80 Test executes bundled chunk code via a data URI and checks a global result.
Reasoning
The test runs freshly bundled chunk code via a data URI and asserts a global result. The code under test is the project's own build output, so this is a self-contained test.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:99:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
          if (format === 'es') {
            namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
          } else {
            const context = { exports: {} };
```
likely benign LLM, confidence 0.85 Test helper that evaluates bundled ES module output by importing it through a data: URI.
Reasoning
The data: URI import is built from chunk.code produced by the bundler under test, inside a test file for a shim/export-names behavior. It is a standard technique for evaluating generated ES modules in-process; no external payload or malicious source is shown. Still flagged as critical by design, but the context is a test harness evaluating its own build output.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-lazy-compile.test.ts:582:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const { DevRuntime } = await import(import.meta.resolve('rolldown/experimental/runtime'));
    const runtime = new DevRuntime('require-unused-client');
    runtime.hooks = {
```
likely benign LLM, confidence 0.90 Test imports the rolldown dev runtime entry via import.meta.resolve.
Reasoning
Dynamic import of a module path resolved via import.meta.resolve for a package's own experimental runtime. Fixed package path, test file, no untrusted input.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:12:53

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  const runtimeUrl = import.meta.resolve('rolldown/experimental/runtime');
  const { DevRuntime, MissingFactoryError } = await import(runtimeUrl);
  return { runtime: new DevRuntime('test-client') as any, MissingFactoryError };
}
```
likely benign LLM, confidence 0.90 Test helper loads the rolldown runtime module dynamically.
Reasoning
Same pattern: import.meta.resolve of a fixed internal package specifier in a test helper.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:31:31

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
test('the runtime entry exports only the runtime classes', async () => {
  const runtimeModule = await import(import.meta.resolve('rolldown/experimental/runtime'));
  expect(Object.keys(runtimeModule).sort()).toStrictEqual(['DevRuntime', 'MissingFactoryError']);
});
```
likely benign LLM, confidence 0.90 Test checks the runtime entry's exported names.
Reasoning
Dynamic import of the fixed runtime specifier to check its export list. Benign test code.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function singleDir(name) {
  return import(`./dir/a/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture function performing a template-literal dynamic import.
Reasoning
Fixture for testing bundler dynamic-import-vars transformation; the non-literal specifier is the intended test subject.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function multiDirs(dir, name) {
  return import(`./dir/${dir}/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture function with multi-variable dynamic import path.
Reasoning
Bundler test fixture exercising multi-segment dynamic import patterns; intentional and harmless.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function noFile(name) {
  return import(/* hello */ `./dir/c/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture dynamic import with a comment before the template literal.
Reasoning
Fixture covering comment placement inside import(); intentional syntax test.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withAlias(name) {
  return import(/** @vite-ignore */ `@/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture dynamic import with an @vite-ignore comment and alias path.
Reasoning
Fixture for vite-ignore alias handling in the bundler test suite. Benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withIgnoreTag(name) {
  return import(/* @vite-ignore */ `./dir/a/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture dynamic import with a @vite-ignore comment.
Reasoning
Fixture for vite-ignore comment handling. Benign test input.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/filter/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function dynamicImport(name) {
  return import(`./mod/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture dynamic import with a template-literal path.
Reasoning
Bundler fixture for filter behavior on dynamic imports. Benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-after-paren.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withCommentAfterParen(name) {
  return import(/* comment */ `./dir/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture dynamic import with a comment after the opening paren.
Reasoning
Fixture testing comment placement in dynamic import; benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-before-paren.js:3:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // oxfmt-ignore
  return import /* comment */ (`./dir/${name}.js`);
}
```
likely benign LLM, confidence 0.92 Fixture dynamic import with a comment before the parenthesis.
Reasoning
Fixture testing comment between import and paren; benign syntax test.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function basic(base) {
  return import(`./mods/${base}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture dynamic import with a base-variable template path.
Reasoning
Vite-compatibility fixture for dynamic-import-vars. Benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPath(base) {
  return import(`@/${base}.js`);
}
```
likely benign LLM, confidence 0.93 Fixture dynamic import using an alias template path.
Reasoning
Vite-compatibility fixture for alias paths. Benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPathWithMultiParentDir(base) {
  return import(`#/${base}.js`);
}
```
likely benign LLM, confidence 0.90 Template-literal dynamic import with an alias-style path inside a bundler test fixture.
Reasoning
This is a test fixture for Vite dynamic-import variable handling. The template-literal import is the subject under test, and the path is built from a function argument in a test module, not from untrusted input.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQuery(base) {
  return import(`./mods/${base}.js?foo=bar`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a query-string suffix in a bundler test fixture.
Reasoning
A fixture exercising import specifiers with query strings, which is a documented bundler feature being tested. The specifier stays within local relative paths.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryRaw(base) {
  return import(`./mods/${base}.js?raw`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a `?raw` suffix in a bundler test fixture.
Reasoning
Fixture for the Vite `?raw` import suffix. The non-literal specifier is the feature under test, and the target is a local module.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:22:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryUrl(base) {
  return import(`./mods/${base}.js?url`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a `?url` suffix in a bundler test fixture.
Reasoning
Fixture for the Vite `?url` suffix, testing how the bundler resolves variable-driven imports. No external or attacker-controlled resolution is present.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:26:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function wildcardInVariables(base) {
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a nullish-coalescing expression inside the specifier, in a test fixture.
Reasoning
The `??` wildcard pattern is deliberate test input for bundler glob or variable import handling. It is a local module path in a fixture.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:32:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a `?raw` suffix and a comment about Windows filename limits.
Reasoning
The surrounding comment explains the fixture's intent, noting that `?` is invalid in Windows filenames. This is a documented edge case in the bundler's test suite.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:38:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mo?ds/${base ?? foo}.js?worker`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a `?` in the path and a `?worker` suffix, in a test fixture.
Reasoning
A fixture using a `?` inside a directory name to test the bundler's path parsing. The comment in the snippet confirms the test intent, and the target is local.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:42:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withParentDirAndItself(name) {
  return import(`../dynamicImportVar/${name}.js`);
}
```
likely benign LLM, confidence 0.90 Dynamic import via a parent-directory relative path in a test fixture.
Reasoning
Relative parent-directory import used to test bundler path resolution. It is a local fixture with no network or shell behavior.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:46:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withMultiParentDirAndItself(name) {
  return import(`../../plugins/dynamicImportVar/${name}.js`);
}
```
likely benign LLM, confidence 0.90 Dynamic import via a multi-level parent-directory path in a test fixture.
Reasoning
Multi-level parent-directory import in a bundler test fixture, exercising path resolution. The target is a sibling fixture module.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:17:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  async afterTest() {
    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);
```
likely benign LLM, confidence 0.90 Test-harness dynamic import of a local built module in a plugin test config.
Reasoning
This is a test config (`afterTest`) that loads locally built outputs using `as string` casts. The import targets are fixed relative paths in the test project, not attacker-controlled input.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:18:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);

    expect(Object.hasOwn(producer, 'module.exports')).toBe(true);
```
likely benign LLM, confidence 0.90 Test-harness dynamic import of a local dist module for export assertions.
Reasoning
Same test harness pattern as the adjacent import, loading a local dist module to assert on its exports. Nothing here is executed from an external source.
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/restore-query-extension/_config.ts:38:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.split('?')[0], 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/transform/_config.ts:35:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.slice(0, -7), 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rolldown-file-url/_config.ts:36:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(
```
likely benign LLM, confidence 0.90 Test hook dynamically importing a local built entry to verify file URL resolution.
Reasoning
A post-build test hook that imports a local bundle output and checks the file URL it resolves to. The `as string` cast only defeats static analysis in the test; the path is fixed.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:30:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const main = await import('./dist/main.js' as string);
    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);
```
likely benign LLM, confidence 0.85 Test hook chaining a local module import through a computed URL to check chunk resolution.
Reasoning
The test imports a local dist module, builds a URL from its default export, and imports that URL. The chain is more involved than the others, but it is still a closed test loop over local build artifacts with no external fetch.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:32:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);
    expect(dep.default).toBe('dep.js');
  },
```
likely benign LLM, confidence 0.85 Test config dynamically imports a dependency chunk via a computed file URL.
Reasoning
The dynamic import specifier is built from a URL resolved relative to import.meta.url inside a rollup test config. This is a test assertion loading a known build output, not hidden execution.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url/_config.ts:38:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(
```
likely benign LLM, confidence 0.90 Test hook dynamically importing a local built entry to check asset path resolution.
Reasoning
Mirrors the rolldown fixture: a test hook imports a local built entry and asserts on the resolved asset path. It is test-harness code with a fixed local target.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/common-chunks/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test checks each emitted chunk by requiring it from dist.
Reasoning
The require uses a template over chunk.fileName from the build output directory inside a test assertion checking __esModule. Standard test-harness behaviour with no obfuscation.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/false/_config.ts:24:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test requires emitted chunks to verify the __esModule flag.
Reasoning
Same pattern as sibling fixtures: a test loads emitted build chunks by name to assert export shape. Benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-false/_config.ts:26:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test requires generated chunks to check nested export properties.
Reasoning
Test harness requiring generated chunk files from dist to assert properties. Dynamic path is confined to the build output directory.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-true/_config.ts:26:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test requires generated chunks to check nested export properties.
Reasoning
Same benign test-harness pattern loading build output chunks by fileName.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/true/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test requires emitted chunks to verify the __esModule flag.
Reasoning
Standard test assertion requiring emitted dist chunks. No malicious indicators.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/minify/dce-only/main.js:3:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(/* @vite-ignore annotation comment is kept */ 'node:module');

export function foo() {
```
likely benign LLM, confidence 0.90 Minified fixture contains a dynamic import of the node:module builtin with a bundler annotation.
Reasoning
This is minifier output fixture. The specifier is the literal 'node:module' with a vite-ignore comment, so the import is static in intent. The flag is a false positive on a comment-bearing literal import.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:18:52

base64-like blob (188 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
    expect(output.output[0].map!.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbi5qcyIsIm5hbWVzIjpbXSwic291cmNlcyI6WyIuLi9tYWluLmpzIl0sInNvdXJjZXNDb250ZW50IjpbImNvbnNvbGUubG9nKGZvbyk7XG4iXSwibWFwcGluZ3MiOiI7QUFBQSxRQUFRLElBQUksR0FBRyJ9"`,
    );
```
likely benign LLM, confidence 0.92 Inline base64 sourcemap data URL in a snapshot test.
Reasoning
The base64 blob is an inline source map data URL with a JSON payload of version, sources and mappings, asserted in an inline snapshot. It is an ordinary sourcemap encoding, and raw-pass base64 hits are noisy.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:26:52

base64-like blob (192 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
```
    expect(map.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbjIuanMiLCJuYW1lcyI6W10sInNvdXJjZXMiOlsiLi4vbWFpbi5qcyJdLCJzb3VyY2VzQ29udGVudCI6WyJjb25zb2xlLmxvZyhmb28pO1xuIl0sIm1hcHBpbmdzIjoiO0FBQUEsUUFBUSxJQUFJLEdBQUcifQ=="`,
    );
  },
```
likely benign LLM, confidence 0.92 Inline base64 sourcemap data URL in a snapshot test.
Reasoning
Another inline sourcemap data URL in a test snapshot, decoding to ordinary sourcemap JSON. Legitimate.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:233:53

base64-like blob (192 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsQ0FBQyxDQUFDLENBQU8sQ0FBQyxDQUFDIn0=',
      );
```
likely benign LLM, confidence 0.92 Expected sourcemap data URL string in MagicString unit test.
Reasoning
The blob is a standard base64 sourcemap data URL used as an expected value in magic-string tests. It decodes to a normal source map.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:319:53

base64-like blob (180 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsR0FBRyxHQUFNLENBQUMifQ==',
      );
```
likely benign LLM, confidence 0.92 Expected sourcemap data URL string in MagicString unit test.
Reasoning
Expected sourcemap data URL in a unit test assertion, a normal encoding of a source map.

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:460:37

orphaned low surrogate \uDD37 (no preceding high surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(2) === '\uDD37b'
    assert.strictEqual(s.slice(2), '\uDD37b');
    // slice(0, 2) ends at low surrogate — returns 'a' + lone high surrogate
    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:463:41

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'
    assert.strictEqual(s.slice(0, 2), 'a\uD83E');
    // slice(3) is 'b'
    assert.strictEqual(s.slice(3), 'b');

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:484:46

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)
```
    assert.strictEqual(s.toString(), 'abIJefgh🤷kl');
    assert.strictEqual(s.slice(-3, 3), 'Jefgh\uD83E');
  });
});
```
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/src/load-binding.ts:17:10

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
  }
  return require(`../../dist/${bindingFile}`);
}
```
likely benign LLM, confidence 0.85 Test helper requires a native binding from the dist directory by computed name.
Reasoning
This helper loads a native binding from the local dist directory by filename, a standard loader pattern in a test helper. The variable is a local binding name, not attacker-controlled input.
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file0.js:1:1

547 of 1183 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info whitespace-anomaly packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:2:1

file mixes tab and space indentation (1 tab-indented and 37484 space-indented lines) (raw pass, confidence 0.40)
```
import {
  AcceleratedAnimation,
  addPointerEvent,
  addPointerInfo,
```
info ~~warn~~ → info by review long-line packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:11670:1

line length 4052 characters (raw pass, confidence 0.65)
```
  /^(?:children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|
```
dismissed LLM, confidence 0.90 Very long regex of HTML/React attribute names in a vendored bundle in a stability test.
Reasoning
A 4000+ character regex alternation of React DOM attribute names inside a bundled stability-test library. Long generated lines are common in vendored bundles and carry no obfuscation intent.

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:35328:8

compression ratio 0.845 is >2σ above file mean 0.631 (raw pass, confidence 0.50)

      // System fonts - Taken from https://furbo.org/stuff/systemfonts-new.html - "All Platforms" section
      'system-ui|-apple-system|BlinkMacSystemFont|Segoe UI|Roboto|Oxygen|Ubuntu|Cantarell|Fira Sans|Droid Sans|Helvetica Neue|sans-serif'
    );
    const fontFamily = {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file10.js:1:1

72 of 137 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file28.js:1:1

3890 of 8197 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file29.js:1:1

23 of 40 non-conventional identifiers are single-character (58%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file30.js:1:1

25 of 42 non-conventional identifiers are single-character (60%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:1:1

69 of 162 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:105:10

compression ratio 0.832 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Co-Founder of UIE asks, “What was the most important thing you learned yesterday, and how will it impact what you do in the future?”',
    }),
    /*#__PURE__*/ e('p', {

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:132:10

compression ratio 0.815 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        "People don't always know what they want, even if they think the do. As Joe Leech, a UX psychologist says, \"People want more choices, but can't deal with them.”",
    }),
    /*#__PURE__*/ e('p', {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file34.js:1:1

392 of 725 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:1:1

55 of 136 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:111:10

compression ratio 0.873 is >2σ above file mean 0.679 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Wsp\xf3łzałożyciel UIE pyta: „Co było najważniejszą rzeczą, jaką wczoraj się nauczyłeś, i w jaki spos\xf3b to wpłynie na to, co robisz w przyszłości?”',
    }),
    /*#__PURE__*/ e('p', {

info ~~warn~~ → info by review long-line packages/rolldown/tests/stability/issue-3453/src/lib/file37.js:37:1

line length 3972 characters (raw pass, confidence 0.65)
```
      /^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|ce
```
likely benign LLM, confidence 0.95 A very long regex literal enumerating React/HTML attribute names inside a test fixture file.
Reasoning
The raw pass flagged a single long line of 3972 characters. The visible snippet is a long regex alternation listing React DOM attribute names (children, dangerouslySetInnerHTML, key, ref, autoFocus, etc.), which is a standard prop-name whitelist used by React-related libraries. The file is in a test fixture directory for a stability issue, so this is a generated or verbose legitimate pattern, not obfuscation. The long-line signal is a low-value style warning here.
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file46.js:1:1

35 of 87 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file5.js:1:1

19 of 41 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info unicode-mixed-script packages/rolldown/tests/validate-option.test.ts:138:6

identifier `unKnown` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
    'UNKNOWN-SESSION',
    'unKnown-session',
    'unknown-ſession',
    'unknown-seßion',
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/rolldown/rolldown rolldown && cd rolldown
git checkout v1.2.14
disclude scan --severity info --diff v1.2.13 packages/rolldown