rolldown 1.2.14

Source: https://github.com/rolldown/rolldown
Tag scanned: v1.2.14
Directory: packages/rolldown (only this part of the repository was scanned)
Compared with: v1.2.13 (11 signals introduced since)
Files: 1736 scanned, 78 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 86 info
Scan time: 51.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 65 of 65 warn and critical signals; 65 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 21:04

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/preserve-entry-signatures.test.ts:136:24 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    expect(chunks[0].exports).toEqual(['POST']);
    const main = await import(`data:text/javascript,${encodeURIComponent(chunks[0].code)}`);
    expect(Object.keys(main)).toEqual(['POST']);
    expect(await main.POST()).toBe(true);
```
likely benign LLM, confidence 0.90 Test imports generated chunk via data URI to check entry signature preservation.
Reasoning
Test imports the bundler's generated chunk as a data URI to verify entry exports; the code under test is produced by the build in the same test.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:39:19 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        format === 'es'
          ? await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`)
          : (() => {
              const context = { exports: {} };
```
likely benign LLM, confidence 0.92 Test helper dynamically imports a data: URI containing bundler-generated ES module code.
Reasoning
The data: URI import evaluates bundler output generated in the same test. The code comes from bundle.generate() inside a test fixture, not from an external or attacker-controlled source, and the pattern is a standard way to load ES module output in a test harness.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:75:31 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(() => namespace.update('y')).toThrow(TypeError);
```
likely benign LLM, confidence 0.92 Test loads generated ES module chunk via data: URI to check namespace exports.
Reasoning
Same pattern: chunk.code from a local rollup-style bundle is loaded via a data: URI so the test can assert on its exports. The snippet shows assertions on the namespace, consistent with testing module shim behavior.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:121:31 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.ns.x).toBe(2);
      expect(namespace.x).toBeUndefined();
```
likely benign LLM, confidence 0.92 Test imports bundled output as data URI and asserts on namespace properties.
Reasoning
The import evaluates bundler output produced in the test itself, and the following expectations check namespace shape. No sign of hidden payload or external fetch.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:143:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings.map((warning) => warning.code).sort((a, b) => a!.localeCompare(b!))).toEqual([
```
likely benign LLM, confidence 0.92 Test evaluates generated module code via data: URI and checks warning codes.
Reasoning
The data: URI carries code generated by bundle.generate in the same test file. The surrounding assertions verify warnings and keys, which is typical of bundler test suites.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:219:31 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.92 Test dynamically imports generated chunk to verify export keys and warnings.
Reasoning
Dynamic import of locally generated bundle code in a test, followed by assertions on keys and warnings. This is expected test scaffolding.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:238:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings).toEqual([expect.objectContaining({ code: 'IMPORT_IS_UNDEFINED' })]);
```
likely benign LLM, confidence 0.92 Test evaluates generated module via data: URI to assert a warning code.
Reasoning
Same test-harness pattern: generated module code is evaluated through a data: URI to check that an IMPORT_IS_UNDEFINED warning is produced.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:255:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect({ ...namespace.ns }).toEqual({ x: 42, y: undefined });
    expect({ ...namespace.cycle }).toEqual({ x: 42, y: undefined });
```
likely benign LLM, confidence 0.92 Test loads generated module via data: URI and compares namespace spreads.
Reasoning
The import evaluates bundler output built in the test. The assertions compare spread namespace objects, which is ordinary test verification of export shims.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:288:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([['missing'], ['missing']]);
    expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.92 Test imports generated bundle via data: URI and checks keys and warnings.
Reasoning
Dynamic import of locally built bundle code within a behavior test. Expectations check keys and warnings only, with no external data or execution side effects.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:303:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.value).toBe(42);
    expect(namespace.missing).toBeUndefined();
```
likely benign LLM, confidence 0.92 Test loads generated module via data: URI and asserts exported values.
Reasoning
The data: URI wraps code produced by the test's own bundle.generate call. The assertions check exported values, consistent with normal testing of a bundler plugin.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:39:29 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        if (format === 'es') {
          namespace = await import(`data:text/javascript,${encodeURIComponent(dep.code)}`);
        } else {
          const context = { exports: {} };
```
likely benign LLM, confidence 0.92 Test imports generated dependency code via data: URI in an ES-format branch.
Reasoning
Same harness pattern in a sibling test file: dep.code from a local bundle is imported as a data: URI in an ES-format branch, with a CommonJS-style fallback. This is a test for export-name shimming, not a dropper.
info ~~warn~~ → info by review dynamic-import packages/rolldown/build.ts:254:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
async function buildRuntimeEntry() {
  const helperNames = Object.keys(await import(pathToFileURL(runtimeBaseInputFile).href));
  await build({
    input: { 'experimental-runtime': commonRuntimeInputFile },
```
likely benign LLM, confidence 0.85 Build script dynamically imports a runtime base file to enumerate helper names.
Reasoning
Dynamic import of a path derived from a build-time base input file via pathToFileURL in a build script; this is a bundler config helper loading its own runtime entry, a common legitimate pattern.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/binding.cjs:69:31

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    try {
      const overrideBinding = require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH)
      // The override may be a generated WASI loader, which already reports its
      // own flavor. Adopt it: `module.exports` aliases this object, so claiming
```
likely benign LLM, confidence 0.80 NAPI binding loader requires an override library path from an environment variable.
Reasoning
require of an environment-variable path (NAPI_RS_NATIVE_LIBRARY_PATH) is a documented override for native binding loading; env-controlled but a standard developer knob, with comments explaining intent.
info ~~critical~~ → info by review dynamic-execution packages/rolldown/src/options/docs/checks-eval.md:6:1

[embedded javascript] `eval` called with a non-literal expression (ast pass, confidence 0.75)
```
const code = 'console.log("Hello")';
eval(code); // This triggers the warning
```
dismissed LLM, confidence 0.90 Documentation snippet showing an eval call that the scanner warns about.
Reasoning
This is a markdown documentation example demonstrating what the eval check flags; the code is illustrative and inert, not executable project code.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/parallel-plugin-worker.ts:15:36

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      pluginInfos.map(async (pluginInfo) => {
        const pluginModule = await import(pluginInfo.fileUrl);
        const definePluginImpl = pluginModule.default as ReturnType<
          typeof defineParallelPluginImplementation
```
likely benign LLM, confidence 0.80 Parallel plugin worker imports plugin modules from configured file URLs.
Reasoning
Loads plugin modules from a configured fileUrl in a bundler's parallel plugin worker; plugin loading by design imports user-specified modules, so this is expected behavior.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:81:19

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  try {
    return (await import(pathToFileURL(file).href)).default;
  } finally {
    fs.unlink(file, () => {}); // Ignore errors
```
likely benign LLM, confidence 0.90 Config loader dynamically imports a transpiled config file and cleans it up.
Reasoning
Config loader imports a temporary transpiled config file via file URL and then deletes it; standard config-loading pattern.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:152:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // Runtimes without Module-hook support (e.g. Bun/Deno)
  const mod = await import(url + '?t=' + Date.now());
  return mod.default;
}
```
likely benign LLM, confidence 0.85 Config loader imports config via URL with timestamp cache-busting.
Reasoning
Imports a config URL with a cache-busting timestamp query for runtimes lacking module hooks; a legitimate config reload technique.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:182:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    ) {
      return (await import(pathToFileURL(configPath).href)).default;
    } else if (SUPPORTED_TS_CONFIG_FORMATS.includes(ext)) {
      const rawConfigPath = path.resolve(configPath);
```
likely benign LLM, confidence 0.90 Config loader dynamically imports a resolved config file path.
Reasoning
Imports the resolved config file path for a supported config extension; expected behavior for a bundler loading its own config.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/webcontainer-fallback.cjs:21:18

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
module.exports = require(bindingEntry);
```
likely benign LLM, confidence 0.80 WebContainer fallback re-exports a binding loaded via a variable path.
Reasoning
Fallback module re-exports a binding resolved from a bindingEntry variable, a typical native binding fallback in a package; the variable is internal, though the path origin is not shown.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/arbitrary-import-names.test.ts:92:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      if (chunk.type !== 'chunk') return;
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect({ ...namespace }).toEqual(values);
    } finally {
```
likely benign LLM, confidence 0.90 Test imports generated chunk code via a data URI to check export names.
Reasoning
Test harness imports bundler output as a data URI to verify export names; the data URI contains the build's own generated chunk code, not attacker payload.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/behaviors/dependency-path-escaping.test.ts:70:72

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
            const define = (ids: string[], factory: (...args: unknown[]) => void) => {
              factory(...ids.map((id) => (id === 'exports' ? exports : require(id))));
            };
            define.amd = true;
```
likely benign LLM, confidence 0.85 Test AMD define shim requires dependency ids.
Reasoning
AMD define shim in a test resolves ids with require for a path-escaping behavior test; a test fixture mimicking AMD loaders, not malicious.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/behaviors/inline-common-chunks/run-root.mjs:44:29

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  try {
    const namespace = await import(pathToFileURL(file).href);
    await globalThis.__chain;
    root.exports = Object.fromEntries(
```
likely benign LLM, confidence 0.90 Test runner dynamically imports a generated bundle file.
Reasoning
Test runner imports a file it generated from a known path to check inlined chunk exports; ordinary test harness behavior.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/mangle-properties.test.ts:120:11

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
  try {
    await import(`data:text/javascript,${encodeURIComponent(chunk!.code)}`);
    expect(testGlobal.rolldownManglePropsResult).toBe(15);
  } finally {
```
likely benign LLM, confidence 0.90 Test executes generated chunk code via data URI to verify mangling.
Reasoning
Test imports the bundler's own generated chunk as a data URI to verify property mangling results; test scaffolding, not an attack.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:99:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
          if (format === 'es') {
            namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
          } else {
            const context = { exports: {} };
```
likely benign LLM, confidence 0.80 Test helper that loads rolled-up ES chunk code via a data: URI dynamic import.
Reasoning
The data: URI import is used to evaluate bundler output chunk code in a test harness for ES format shim behavior. It is test-only code evaluating generated bundle output, so the flagged dynamic execution is a legitimate testing technique, though it does execute code from a string.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-lazy-compile.test.ts:582:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const { DevRuntime } = await import(import.meta.resolve('rolldown/experimental/runtime'));
    const runtime = new DevRuntime('require-unused-client');
    runtime.hooks = {
```
likely benign LLM, confidence 0.90 Test loads the rolldown dev runtime module via import.meta.resolve.
Reasoning
Dynamic import of a runtime entry resolved via import.meta.resolve in a rolldown test file; the specifier is a fixed internal package path, not attacker-controlled.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:12:53

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  const runtimeUrl = import.meta.resolve('rolldown/experimental/runtime');
  const { DevRuntime, MissingFactoryError } = await import(runtimeUrl);
  return { runtime: new DevRuntime('test-client') as any, MissingFactoryError };
}
```
likely benign LLM, confidence 0.90 Test helper dynamically imports the rolldown runtime entry.
Reasoning
Resolved internal runtime path from import.meta.resolve in a test helper; standard test pattern with no untrusted input.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:31:31

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
test('the runtime entry exports only the runtime classes', async () => {
  const runtimeModule = await import(import.meta.resolve('rolldown/experimental/runtime'));
  expect(Object.keys(runtimeModule).sort()).toStrictEqual(['DevRuntime', 'MissingFactoryError']);
});
```
likely benign LLM, confidence 0.90 Test checks the runtime entry's exports via dynamic import.
Reasoning
Same pattern: dynamic import of a fixed runtime module resolved by import.meta.resolve, used to check its export list.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function singleDir(name) {
  return import(`./dir/a/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture function with templated dynamic import of local directory module.
Reasoning
Fixture for bundler dynamic-import-vars feature; template-literal specifiers are the intended test subject.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function multiDirs(dir, name) {
  return import(`./dir/${dir}/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture with multi-variable templated dynamic import.
Reasoning
Bundler test fixture exercising multi-segment dynamic import patterns; not malicious.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function noFile(name) {
  return import(/* hello */ `./dir/c/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture dynamic import with an inline comment before the template.
Reasoning
Bundler fixture with a comment inside import(); tests parser handling of comments, benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withAlias(name) {
  return import(/** @vite-ignore */ `@/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture dynamic import with @vite-ignore annotation.
Reasoning
Bundler fixture using a vite-ignore annotation with an alias path; benign test case.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withIgnoreTag(name) {
  return import(/* @vite-ignore */ `./dir/a/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture dynamic import with @vite-ignore tag.
Reasoning
Bundler fixture for the vite-ignore tag; benign test code.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/filter/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function dynamicImport(name) {
  return import(`./mod/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture with templated dynamic import for filter testing.
Reasoning
Fixture for filtering dynamic imports in the bundler test suite; benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-after-paren.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withCommentAfterParen(name) {
  return import(/* comment */ `./dir/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture dynamic import with comment after the opening paren.
Reasoning
Parser test fixture for comments placed after the paren in import(); benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-before-paren.js:3:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // oxfmt-ignore
  return import /* comment */ (`./dir/${name}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture dynamic import with comment before the paren.
Reasoning
Parser test fixture for comments before the paren in import(); benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function basic(base) {
  return import(`./mods/${base}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture templated dynamic import mirroring Vite conventions.
Reasoning
Vite-compatibility fixture for dynamic import variables; benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPath(base) {
  return import(`@/${base}.js`);
}
```
likely benign LLM, confidence 0.95 Fixture dynamic import using an alias prefix.
Reasoning
Vite-compatibility fixture with alias path import; benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPathWithMultiParentDir(base) {
  return import(`#/${base}.js`);
}
```
likely benign LLM, confidence 0.90 Dynamic import of a local module path built from a template literal in a test fixture.
Reasoning
Test fixture for Vite dynamic import variable handling. The template-literal specifier builds a path from a function argument, but it only resolves local module paths (aliased, relative) inside a test directory. No execution of attacker-controlled data or network fetch is shown.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQuery(base) {
  return import(`./mods/${base}.js?foo=bar`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a query suffix in a test fixture exercising bundler import-variable behavior.
Reasoning
Same fixture file. The specifier is a relative path with a query string (?foo=bar), which is a bundler-semantics test case for dynamic import variables, not a payload loader.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryRaw(base) {
  return import(`./mods/${base}.js?raw`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a ?raw suffix in a bundler test fixture.
Reasoning
Test fixture for the ?raw import suffix handled by bundlers. The import targets a relative local module within the fixture directory.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:22:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryUrl(base) {
  return import(`./mods/${base}.js?url`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a ?url suffix in a bundler test fixture.
Reasoning
Test fixture for the ?url suffix. The specifier is a relative local path in a test directory, with no sign of remote loading or decoding.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:26:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function wildcardInVariables(base) {
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
likely benign LLM, confidence 0.90 Dynamic import whose template includes a nullish-coalescing expression, in a bundler edge-case fixture.
Reasoning
Test fixture for wildcard variables in import specifiers. The expression `base ?? foo` is an intentional edge case for the bundler's import-glob analysis, and the target is a local relative module.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:32:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a ?raw suffix in a fixture, with a comment explaining the Windows filename constraint.
Reasoning
The comment notes that `?` cannot be used in Windows filenames, which marks this as a deliberate bundler test case. The import is a local relative path inside a fixture.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:38:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mo?ds/${base ?? foo}.js?worker`);
}
```
likely benign LLM, confidence 0.90 Dynamic import with a ?worker suffix in a fixture testing unusual path characters.
Reasoning
Fixture testing a `?` in a directory name for the ?worker suffix, with a comment about Windows limitations. The import is a relative local path with no payload-loading behavior.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:42:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withParentDirAndItself(name) {
  return import(`../dynamicImportVar/${name}.js`);
}
```
likely benign LLM, confidence 0.90 Dynamic import of a parent-directory relative module path in a bundler test fixture.
Reasoning
Relative parent-directory import in a test fixture, used to check that the bundler resolves dynamic import paths that climb directories. The target is within the repo's test tree.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:46:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withMultiParentDirAndItself(name) {
  return import(`../../plugins/dynamicImportVar/${name}.js`);
}
```
likely benign LLM, confidence 0.90 Dynamic import of a multi-level parent-directory module path in a bundler test fixture.
Reasoning
Multi-level parent-directory relative import in a test fixture for bundler path resolution. It targets another fixture module and performs no network or decode step.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:17:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  async afterTest() {
    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);
```
likely benign LLM, confidence 0.88 Dynamic import of a local built module in a test config, cast to string to defeat static analysis.
Reasoning
Test config in a fixtures directory. The `as string` cast on a literal relative path is a TypeScript idiom that keeps the bundler from statically resolving the import during the test. The target is a local built file.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:18:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);

    expect(Object.hasOwn(producer, 'module.exports')).toBe(true);
```
likely benign LLM, confidence 0.88 Dynamic import of a local dist entry in a test config to verify module exports.
Reasoning
Same test config. It imports a local built entry file (./dist/main.js) to check module.exports interop, and the string cast is a test-harness pattern.
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/restore-query-extension/_config.ts:38:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.split('?')[0], 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/transform/_config.ts:35:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.slice(0, -7), 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rolldown-file-url/_config.ts:36:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(
```
likely benign LLM, confidence 0.88 Dynamic import of a local built entry in a rolldown file-URL test to validate asset paths.
Reasoning
Test afterTest hook in a fixture. It imports a local built output (./dist/entries/main.mjs) and checks the resolved file URL path. The string cast is a test-harness idiom.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:30:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const main = await import('./dist/main.js' as string);
    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);
```
likely benign LLM, confidence 0.88 Dynamic import of a local built chunk and a derived file URL in a rollup test fixture.
Reasoning
Test hook imports a local built main.js, then builds a URL from its default export and imports it. This is a test of chunked file URL resolution. The target is a local build artifact within the fixture.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:32:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);
    expect(dep.default).toBe('dep.js');
  },
```
likely benign LLM, confidence 0.85 Test fixture that dynamically imports a chunk by computed file URL.
Reasoning
The dynamic import specifier is built from a URL resolved relative to import.meta.url, inside a test fixture that checks Rollup's file-URL chunk handling. The pattern is normal for bundler tests and nothing in the snippet is hidden or malicious.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url/_config.ts:38:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(
```
likely benign LLM, confidence 0.88 Dynamic import of a local built entry in a rollup file-URL test to validate asset paths.
Reasoning
Same pattern as the rolldown fixture: a test hook imports a local dist entry and checks the file URL resolution. Nothing suggests remote fetch or hidden execution.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/common-chunks/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test assertion that requires each emitted chunk by template path.
Reasoning
A template-literal require over the build output directory inside a test assertion that checks emitted chunk module shape. This is a routine test harness pattern.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/false/_config.ts:24:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test assertion that requires emitted chunks to check the __esModule flag.
Reasoning
Same test-harness pattern as the sibling fixtures: requiring generated chunks from ./dist to check the __esModule flag. No obfuscation or malicious behavior is visible.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-false/_config.ts:26:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test assertion that requires a generated bundle and checks a nested export property.
Reasoning
Test fixture that requires generated bundles from the dist directory and checks a nested property. Benign test scaffolding.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-true/_config.ts:26:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test assertion that requires a generated bundle and checks a nested export property.
Reasoning
Same test scaffolding pattern as the other es-module fixtures, requiring build output in a test assertion. Nothing suspicious.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/true/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.85 Test assertion that requires emitted chunks to verify ES module output.
Reasoning
Routine test harness requiring generated chunks from the dist folder to verify module output. Benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/minify/dce-only/main.js:3:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(/* @vite-ignore annotation comment is kept */ 'node:module');

export function foo() {
```
likely benign LLM, confidence 0.90 Minifier fixture with a dynamic import of the node:module built-in.
Reasoning
The import specifier is the literal 'node:module' with a vite-ignore comment. The AST pass flagged it only because of the comment placement, and it is a static built-in import.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:18:52

base64-like blob (188 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
    expect(output.output[0].map!.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbi5qcyIsIm5hbWVzIjpbXSwic291cmNlcyI6WyIuLi9tYWluLmpzIl0sInNvdXJjZXNDb250ZW50IjpbImNvbnNvbGUubG9nKGZvbyk7XG4iXSwibWFwcGluZ3MiOiI7QUFBQSxRQUFRLElBQUksR0FBRyJ9"`,
    );
```
likely benign LLM, confidence 0.90 Inline base64 source map data URL inside a sourcemap test snapshot.
Reasoning
The base64 is a standard inline source map data URL in an inline snapshot assertion. It decodes to ordinary sourcemap JSON, so this is expected test output, not a payload.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:26:52

base64-like blob (192 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
```
    expect(map.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbjIuanMiLCJuYW1lcyI6W10sInNvdXJjZXMiOlsiLi4vbWFpbi5qcyJdLCJzb3VyY2VzQ29udGVudCI6WyJjb25zb2xlLmxvZyhmb28pO1xuIl0sIm1hcHBpbmdzIjoiO0FBQUEsUUFBUSxJQUFJLEdBQUcifQ=="`,
    );
  },
```
likely benign LLM, confidence 0.90 Inline base64 source map data URL in a second sourcemap test snapshot.
Reasoning
Another inline sourcemap data URL expected in a snapshot assertion. It is a normal artifact of testing source map generation.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:233:53

base64-like blob (192 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsQ0FBQyxDQUFDLENBQU8sQ0FBQyxDQUFDIn0=',
      );
```
likely benign LLM, confidence 0.90 Base64 sourcemap data URL used as an expected value in a MagicString test.
Reasoning
The blob is a base64 source map data URL passed as an expected value to a MagicString test. It is standard test data with no execution path.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:319:53

base64-like blob (180 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsR0FBRyxHQUFNLENBQUMifQ==',
      );
```
likely benign LLM, confidence 0.90 Base64 sourcemap data URL expected value in a MagicString test.
Reasoning
Same as the other MagicString test: a base64-encoded source map literal compared against generated output. Benign test data.

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:460:37

orphaned low surrogate \uDD37 (no preceding high surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(2) === '\uDD37b'
    assert.strictEqual(s.slice(2), '\uDD37b');
    // slice(0, 2) ends at low surrogate — returns 'a' + lone high surrogate
    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:463:41

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'
    assert.strictEqual(s.slice(0, 2), 'a\uD83E');
    // slice(3) is 'b'
    assert.strictEqual(s.slice(3), 'b');

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:484:46

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)
```
    assert.strictEqual(s.toString(), 'abIJefgh🤷kl');
    assert.strictEqual(s.slice(-3, 3), 'Jefgh\uD83E');
  });
});
```
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/src/load-binding.ts:17:10

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
  }
  return require(`../../dist/${bindingFile}`);
}
```
likely benign LLM, confidence 0.80 Test helper that loads a built native binding by computed file name.
Reasoning
A small test helper that requires a native binding from the dist directory by a computed filename. The path is local and built by the project, so this is a plausible loader, though the dynamic path is worth a glance.
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file0.js:1:1

547 of 1183 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info whitespace-anomaly packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:2:1

file mixes tab and space indentation (1 tab-indented and 37484 space-indented lines) (raw pass, confidence 0.40)
```
import {
  AcceleratedAnimation,
  addPointerEvent,
  addPointerInfo,
```
info ~~warn~~ → info by review long-line packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:11670:1

line length 4052 characters (raw pass, confidence 0.65)
```
  /^(?:children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|
```
likely benign LLM, confidence 0.90 Long regex listing HTML and React attribute names in a vendored library file.
Reasoning
A very long regex alternation of React DOM attribute names inside a vendored library file. Long lines are typical of minified or generated library code, and the content is a plain attribute whitelist.

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:35328:8

compression ratio 0.845 is >2σ above file mean 0.631 (raw pass, confidence 0.50)

      // System fonts - Taken from https://furbo.org/stuff/systemfonts-new.html - "All Platforms" section
      'system-ui|-apple-system|BlinkMacSystemFont|Segoe UI|Roboto|Oxygen|Ubuntu|Cantarell|Fira Sans|Droid Sans|Helvetica Neue|sans-serif'
    );
    const fontFamily = {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file10.js:1:1

72 of 137 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file28.js:1:1

3890 of 8197 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file29.js:1:1

23 of 40 non-conventional identifiers are single-character (58%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file30.js:1:1

25 of 42 non-conventional identifiers are single-character (60%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:1:1

69 of 162 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:105:10

compression ratio 0.832 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Co-Founder of UIE asks, “What was the most important thing you learned yesterday, and how will it impact what you do in the future?”',
    }),
    /*#__PURE__*/ e('p', {

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:132:10

compression ratio 0.815 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        "People don't always know what they want, even if they think the do. As Joe Leech, a UX psychologist says, \"People want more choices, but can't deal with them.”",
    }),
    /*#__PURE__*/ e('p', {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file34.js:1:1

392 of 725 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:1:1

55 of 136 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:111:10

compression ratio 0.873 is >2σ above file mean 0.679 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Wsp\xf3łzałożyciel UIE pyta: „Co było najważniejszą rzeczą, jaką wczoraj się nauczyłeś, i w jaki spos\xf3b to wpłynie na to, co robisz w przyszłości?”',
    }),
    /*#__PURE__*/ e('p', {

info ~~warn~~ → info by review long-line packages/rolldown/tests/stability/issue-3453/src/lib/file37.js:37:1

line length 3972 characters (raw pass, confidence 0.65)
```
      /^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|ce
```
likely benign LLM, confidence 0.93 A very long regex literal containing an alphabetical list of React/HTML attribute names, inside a test fixture file.
Reasoning
The raw pass flagged a long line only by length (3972 characters). The visible snippet is a regular expression built from a long alternation of React DOM attribute names (children, dangerouslySetInnerHTML, autoFocus, etc.), which is a typical generated or prop-whitelist pattern. It is in a test fixture for a stability issue, and nothing in the snippet suggests encoding, execution, or concealment. The long-line signal is a known high-false-positive raw heuristic.
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file46.js:1:1

35 of 87 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file5.js:1:1

19 of 41 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info unicode-mixed-script packages/rolldown/tests/validate-option.test.ts:138:6

identifier `unKnown` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
    'UNKNOWN-SESSION',
    'unKnown-session',
    'unknown-ſession',
    'unknown-seßion',
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/rolldown/rolldown rolldown && cd rolldown
git checkout v1.2.14
disclude scan --severity info --diff v1.2.13 packages/rolldown