rolldown 1.2.15

Source: https://github.com/rolldown/rolldown
Tag scanned: v1.2.15
Directory: packages/rolldown (only this part of the repository was scanned)
Compared with: v1.2.14 (3 signals introduced since)
Files: 1742 scanned, 78 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 89 info
Scan time: 59.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 68 of 68 warn and critical signals; 68 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 01:59

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/builtin-plugin/vite-resolve.test.ts:152:51 new in this release

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
  const { output } = await bundle.generate({ format: 'esm' });
  const { read }: { read: () => unknown } = await import(
    `data:text/javascript,${encodeURIComponent(output[0].code)}`
  );
```
likely benign LLM, confidence 0.90 Test that executes bundler-generated ESM via a data: URI import to read exported values.
Reasoning
The test generates ESM from a bundle and loads it through a data: URI to check its exports. The payload is the test's own build output, so this is a normal test technique rather than a hidden dropper.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/build-import-analysis/await-in-import-argument/main.js:6:16 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export async function load() {
  return await import(await resolveSpecifier());
}
```
dismissed LLM, confidence 0.93 Fixture function performing import(await resolveSpecifier()) to test bundler handling.
Reasoning
This fixture exists to test bundler analysis of awaited import arguments. The specifier comes from a local fixture helper, and nothing here is malicious.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/build-import-analysis/await-in-import-argument/main.js:10:16 new in this release

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export async function loadThen() {
  return await import(await resolveSpecifier()).then((m) => m.foo);
}
```
dismissed LLM, confidence 0.93 Fixture function using import(await ...).then to test bundler handling of dynamic imports.
Reasoning
Same fixture pattern, here with a .then chain, testing bundler import analysis. Nothing suspicious.
info ~~warn~~ → info by review dynamic-import packages/rolldown/build.ts:254:41

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
async function buildRuntimeEntry() {
  const helperNames = Object.keys(await import(pathToFileURL(runtimeBaseInputFile).href));
  await build({
    input: { 'experimental-runtime': commonRuntimeInputFile },
```
likely benign LLM, confidence 0.80 Build script performs a dynamic import of a locally computed runtime file URL.
Reasoning
A build script imports a runtime base file path computed from the build configuration to read helper names. Non-literal imports are routine in build tooling, and nothing here reaches outside the project.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/binding.cjs:69:31

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    try {
      const overrideBinding = require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH)
      // The override may be a generated WASI loader, which already reports its
      // own flavor. Adopt it: `module.exports` aliases this object, so claiming
```
likely benign LLM, confidence 0.80 Native binding loader honors an environment-variable override path for require.
Reasoning
The require path comes from NAPI_RS_NATIVE_LIBRARY_PATH, a documented override for loading a native binding. The surrounding comments describe a WASI loader adoption flow, which is ordinary binding-loader logic.
info ~~critical~~ → info by review dynamic-execution packages/rolldown/src/options/docs/checks-eval.md:6:1

[embedded javascript] `eval` called with a non-literal expression (ast pass, confidence 0.75)
```
const code = 'console.log("Hello")';
eval(code); // This triggers the warning
```
dismissed LLM, confidence 0.92 Documentation snippet demonstrating a warning triggered by eval.
Reasoning
This is a markdown documentation example, with a comment saying the eval triggers a warning. It is illustrative text in docs, not executable code in the package.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/parallel-plugin-worker.ts:15:36

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      pluginInfos.map(async (pluginInfo) => {
        const pluginModule = await import(pluginInfo.fileUrl);
        const definePluginImpl = pluginModule.default as ReturnType<
          typeof defineParallelPluginImplementation
```
likely benign LLM, confidence 0.80 Parallel plugin worker dynamically imports user-configured plugin modules.
Reasoning
The worker imports a plugin module from a fileUrl supplied by the plugin configuration, then checks the default export against the expected definePlugin shape. This is the expected plugin-loading mechanism for a bundler.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:81:19

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  try {
    return (await import(pathToFileURL(file).href)).default;
  } finally {
    fs.unlink(file, () => {}); // Ignore errors
```
likely benign LLM, confidence 0.80 Config loader imports a temporary compiled config file and deletes it.
Reasoning
The config loader writes a temporary compiled config file, imports it by URL, and removes it afterward. This is the common bundler config-loading pattern, and the import target is the tool's own temp file.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:152:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // Runtimes without Module-hook support (e.g. Bun/Deno)
  const mod = await import(url + '?t=' + Date.now());
  return mod.default;
}
```
likely benign LLM, confidence 0.85 Config loader re-imports a config URL with a timestamp to bypass module caching.
Reasoning
The timestamp query string is a cache-busting technique for reloading config modules. It is a typical bundler config-reload pattern, and the import target is the configured file.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/utils/load-config.ts:182:21

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    ) {
      return (await import(pathToFileURL(configPath).href)).default;
    } else if (SUPPORTED_TS_CONFIG_FORMATS.includes(ext)) {
      const rawConfigPath = path.resolve(configPath);
```
likely benign LLM, confidence 0.85 Config loader imports the resolved user config file by file URL.
Reasoning
This branch imports the resolved config file path, the normal way a bundler loads a user config file. The path is derived from the project's own configuration.
info ~~warn~~ → info by review dynamic-import packages/rolldown/src/webcontainer-fallback.cjs:21:18

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
module.exports = require(bindingEntry);
```
likely benign LLM, confidence 0.80 Fallback module re-exports a binding loaded from a computed path.
Reasoning
This fallback module re-exports a binding loaded from a computed entry path. That is a standard pattern for choosing between native and WASI bindings.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/arbitrary-import-names.test.ts:92:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      if (chunk.type !== 'chunk') return;
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect({ ...namespace }).toEqual(values);
    } finally {
```
likely benign LLM, confidence 0.85 Test imports generated chunk code through a data URI to check export names.
Reasoning
The test imports bundler output as a data URI to verify exported names. The code comes from the build under test and runs only inside the test harness, which is a legitimate testing technique.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/behaviors/dependency-path-escaping.test.ts:70:72

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
            const define = (ids: string[], factory: (...args: unknown[]) => void) => {
              factory(...ids.map((id) => (id === 'exports' ? exports : require(id))));
            };
            define.amd = true;
```
likely benign LLM, confidence 0.85 Test-only AMD define shim resolves fixture dependency ids via require.
Reasoning
This test shim implements AMD define and resolves dependency ids with require inside a test fixture. The ids are fixture-controlled, so the call is benign test scaffolding.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/behaviors/inline-common-chunks/run-root.mjs:44:29

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  try {
    const namespace = await import(pathToFileURL(file).href);
    await globalThis.__chain;
    root.exports = Object.fromEntries(
```
likely benign LLM, confidence 0.85 Test harness dynamically imports a built fixture file to inspect its exports.
Reasoning
The test harness imports a file path from its own fixture output and reads the exports. This is ordinary test code for verifying chunk output.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/mangle-properties.test.ts:120:11

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
  try {
    await import(`data:text/javascript,${encodeURIComponent(chunk!.code)}`);
    expect(testGlobal.rolldownManglePropsResult).toBe(15);
  } finally {
```
likely benign LLM, confidence 0.85 Test executes mangled bundle output through a data URI and checks the result.
Reasoning
The test imports generated chunk code as a data URI, then asserts a global result from the mangled-property build. The code under test is the project's own build output, and the usage is confined to a test.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/preserve-entry-signatures.test.ts:136:24

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    expect(chunks[0].exports).toEqual(['POST']);
    const main = await import(`data:text/javascript,${encodeURIComponent(chunks[0].code)}`);
    expect(Object.keys(main)).toEqual(['POST']);
    expect(await main.POST()).toBe(true);
```
likely benign LLM, confidence 0.85 Test imports generated entry chunk via data URI to validate exported signatures.
Reasoning
The test loads a generated chunk through a data URI to verify the POST export signature. This is a standard way to test bundler output in place, with no sign of malicious intent.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:39:19

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        format === 'es'
          ? await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`)
          : (() => {
              const context = { exports: {} };
```
likely benign LLM, confidence 0.93 Test helper that dynamically imports bundler-generated ES module code via a data URI to verify shimmed exports.
Reasoning
The data: URI import evaluates chunk.code, which the test itself generated with Rollup's bundler from a fixture. It is a test harness loading bundler output as an ES module to check export shimming. No payload, network access, or obfuscation is present.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:75:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(() => namespace.update('y')).toThrow(TypeError);
```
likely benign LLM, confidence 0.93 Dynamic import of bundled chunk code as a data URI, followed by assertions on the module namespace.
Reasoning
Same pattern: the data URI wraps code produced by bundle.generate in the same test. The assertions check namespace keys and thrown TypeErrors, which fits a test of export-shim behavior.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:121:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.ns.x).toBe(2);
      expect(namespace.x).toBeUndefined();
```
likely benign LLM, confidence 0.93 Test imports generated chunk through a data URI and asserts on exported values.
Reasoning
The imported code is the output of the bundler under test, and the assertions check namespace values. It is a legitimate way to evaluate ES module output inside a test.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:143:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings.map((warning) => warning.code).sort((a, b) => a!.localeCompare(b!))).toEqual([
```
likely benign LLM, confidence 0.93 Test loads generated bundle code via data URI and checks warning codes.
Reasoning
The data URI carries bundler output produced earlier in the same test. Assertions on warning codes show this is verifying diagnostics, not running untrusted code.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:219:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
      const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
      const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
      expect(namespace.keys).toEqual(['x']);
      expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.93 Generated bundle is imported as a data URI module for export-shim assertions.
Reasoning
The imported code is generated by the bundler in the test and then checked for keys and warnings. This is ordinary behavior testing for a bundler.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:238:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([]);
    expect(warnings).toEqual([expect.objectContaining({ code: 'IMPORT_IS_UNDEFINED' })]);
```
likely benign LLM, confidence 0.93 Test evaluates bundler output as a data-URI module and asserts an IMPORT_IS_UNDEFINED warning.
Reasoning
The generated module code is evaluated through a data URI and its warnings are asserted. This is a standard way to test module output in a bundler test suite.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:255:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect({ ...namespace.ns }).toEqual({ x: 42, y: undefined });
    expect({ ...namespace.cycle }).toEqual({ x: 42, y: undefined });
```
likely benign LLM, confidence 0.93 Test imports generated code as a data URI and verifies namespace spread values.
Reasoning
The data URI wraps generated bundle output, and the test checks spread results of namespace objects. Nothing suggests an attack or hidden payload.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:288:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.keys).toEqual([['missing'], ['missing']]);
    expect(warnings).toEqual([]);
```
likely benign LLM, confidence 0.93 Test evaluates generated bundle code for missing-export key expectations.
Reasoning
The data URI contains the bundler's own output from the test, and the assertions check missing-export key lists. This is expected test behavior.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-interface.test.ts:303:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
    const [chunk] = getOutputChunk(await bundle.generate({ format: 'es' }));
    const namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
    expect(namespace.value).toBe(42);
    expect(namespace.missing).toBeUndefined();
```
likely benign LLM, confidence 0.93 Test imports generated module for value and missing-export assertions.
Reasoning
The data URI carries bundler output generated in the same test, and the test asserts on a value and an undefined missing export. No malicious indicators are present.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:39:29

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
        if (format === 'es') {
          namespace = await import(`data:text/javascript,${encodeURIComponent(dep.code)}`);
        } else {
          const context = { exports: {} };
```
likely benign LLM, confidence 0.92 Test helper imports dependency bundle code through a data URI for ES-format output.
Reasoning
The data URI wraps dep.code, which is generated bundler output in a test fixture, and the import is in a format-specific branch for ES output. The pattern is a standard test harness for module evaluation.
info ~~critical~~ → info by review data-uri-import packages/rolldown/tests/behaviors/shim-missing-export-names.test.ts:99:31

`import(...)` specifier is a `data:` URI — executes arbitrary code without touching disk (ast pass, confidence 0.95)
```
          if (format === 'es') {
            namespace = await import(`data:text/javascript,${encodeURIComponent(chunk.code)}`);
          } else {
            const context = { exports: {} };
```
likely benign LLM, confidence 0.90 Test helper that imports a data: URI built from the bundle's generated chunk code.
Reasoning
The data: URI import evaluates the bundler's own generated output inside a test. This is a standard way to check ESM output of a bundler, and the code comes from the build under test, not from an external source.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-lazy-compile.test.ts:582:34

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const { DevRuntime } = await import(import.meta.resolve('rolldown/experimental/runtime'));
    const runtime = new DevRuntime('require-unused-client');
    runtime.hooks = {
```
dismissed LLM, confidence 0.93 Dynamic import of the rolldown runtime entry resolved via import.meta.resolve in a test.
Reasoning
The specifier is resolved with import.meta.resolve for a fixed package subpath (rolldown/experimental/runtime). The import target is not attacker-controlled, and this is a routine test setup.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:12:53

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  const runtimeUrl = import.meta.resolve('rolldown/experimental/runtime');
  const { DevRuntime, MissingFactoryError } = await import(runtimeUrl);
  return { runtime: new DevRuntime('test-client') as any, MissingFactoryError };
}
```
dismissed LLM, confidence 0.93 Test helper that dynamically imports the rolldown dev runtime module.
Reasoning
The import specifier comes from import.meta.resolve of a fixed internal package path. It is a standard test helper for loading the dev runtime.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/dev/dev-runtime.test.ts:31:31

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
test('the runtime entry exports only the runtime classes', async () => {
  const runtimeModule = await import(import.meta.resolve('rolldown/experimental/runtime'));
  expect(Object.keys(runtimeModule).sort()).toStrictEqual(['DevRuntime', 'MissingFactoryError']);
});
```
dismissed LLM, confidence 0.93 Test asserting the runtime entry's export list via a dynamic import.
Reasoning
Same fixed import.meta.resolve target as the other runtime tests. The test only checks the module's export keys.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function singleDir(name) {
  return import(`./dir/a/${name}.js`);
}
```
dismissed LLM, confidence 0.95 Fixture that dynamically imports a relative module path built from a template literal.
Reasoning
A template-literal dynamic import of a relative local path is the standard dynamic-import-vars test case. It is a bundler fixture, not an attack.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function multiDirs(dir, name) {
  return import(`./dir/${dir}/${name}.js`);
}
```
dismissed LLM, confidence 0.95 Fixture importing a relative path with two variable segments for bundler testing.
Reasoning
Multi-segment relative template import in a bundler test fixture. Expected for the dynamic-import-vars feature.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function noFile(name) {
  return import(/* hello */ `./dir/c/${name}.js`);
}
```
dismissed LLM, confidence 0.95 Fixture dynamic import with an inline comment, testing bundler parsing.
Reasoning
Fixture with a comment inside the import call and a relative template path. It tests comment handling in dynamic import analysis and is benign.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withAlias(name) {
  return import(/** @vite-ignore */ `@/${name}.js`);
}
```
dismissed LLM, confidence 0.95 Fixture dynamic import marked @vite-ignore, testing bundler handling of ignored specifiers.
Reasoning
Uses a @vite-ignore tag and an alias-style template path. This is a documented bundler test case for ignored dynamic imports.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/basic/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withIgnoreTag(name) {
  return import(/* @vite-ignore */ `./dir/a/${name}.js`);
}
```
dismissed LLM, confidence 0.95 Fixture dynamic import with @vite-ignore tag for bundler testing.
Reasoning
Same @vite-ignore test pattern with a relative template path. Benign fixture code.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/filter/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function dynamicImport(name) {
  return import(`./mod/${name}.js`);
}
```
dismissed LLM, confidence 0.95 Fixture dynamic import of a relative module path used to test filtering of dynamic imports.
Reasoning
A relative template-literal import in a filter-option fixture. This is a standard bundler test for dynamic import variables.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-after-paren.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
export function withCommentAfterParen(name) {
  return import(/* comment */ `./dir/${name}.js`);
}
```
dismissed LLM, confidence 0.95 Fixture dynamic import with a comment after the paren, testing bundler parsing.
Reasoning
A fixture testing a comment placed after the opening parenthesis of a dynamic import. The relative template path is benign and only exercises parsing.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/import-with-comment/with-comment-before-paren.js:3:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // oxfmt-ignore
  return import /* comment */ (`./dir/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import whose template-literal specifier includes a comment.
Reasoning
This is a bundler test fixture exercising dynamic import with a comment before the parenthesis. The specifier is a template built from a parameter, which is the expected input for testing dynamic-import variable handling. Nothing indicates malicious intent.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:2:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function basic(base) {
  return import(`./mods/${base}.js`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import with a relative template specifier.
Reasoning
Vite-style dynamic import fixture with a relative template path built from a function argument. It is a test case for bundler import-glob handling, and the path stays within the fixture directory.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:6:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPath(base) {
  return import(`@/${base}.js`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import using an alias path prefix.
Reasoning
A test fixture for an alias-style dynamic import path (@/). The specifier is a local module alias resolved by the bundler under test, not a remote or attacker-controlled load.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:10:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function aliasPathWithMultiParentDir(base) {
  return import(`#/${base}.js`);
}
```
likely benign LLM, confidence 0.92 Test fixture for a dynamic import with a multi-level alias specifier.
Reasoning
Fixture testing a multi-level alias path with a template variable. This is part of a bundler's dynamic import test suite and has no execution or exfiltration behaviour.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:14:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQuery(base) {
  return import(`./mods/${base}.js?foo=bar`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import with a ?foo=bar query suffix.
Reasoning
Fixture for a dynamic import with a query string suffix, a standard bundler feature being tested. The query is a static suffix and not a payload.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:18:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryRaw(base) {
  return import(`./mods/${base}.js?raw`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import with a ?raw suffix.
Reasoning
Fixture exercising the Vite ?raw import suffix on a dynamic import. This is a normal bundler asset-loading feature under test.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:22:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withQueryUrl(base) {
  return import(`./mods/${base}.js?url`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import with a ?url suffix.
Reasoning
Fixture exercising the Vite ?url import suffix on a dynamic import. This is a standard bundler feature test with no malicious indicators.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:26:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function wildcardInVariables(base) {
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
likely benign LLM, confidence 0.92 Test fixture for a dynamic import with a wildcard expression in its specifier.
Reasoning
Fixture with a nullish-coalescing expression inside the template specifier, testing wildcard handling in bundler variable analysis. The identifier 'foo' is undefined, but this is test syntax, not an exploit.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:32:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mods/${base ?? foo}.js?raw`);
}
```
likely benign LLM, confidence 0.92 Test fixture for a dynamic import with a ?raw suffix and a Windows-compatibility comment.
Reasoning
The adjacent comment notes that '?' cannot be used in Windows filenames, which marks this as a bundler edge-case test. The import is a local relative path with a ?raw suffix.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:38:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
  // (`?` cannot be used as a filename on windows)
  return import(`./mo?ds/${base ?? foo}.js?worker`);
}
```
likely benign LLM, confidence 0.91 Test fixture for a dynamic import with a ?worker suffix and an unusual path.
Reasoning
Another bundler edge-case fixture for query-suffix handling with a worker import. The comment shows it is intentional test input, and the path is local.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:42:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withParentDirAndItself(name) {
  return import(`../dynamicImportVar/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import with a parent-directory relative specifier.
Reasoning
Fixture importing a sibling directory via a parent-relative template path. This is a standard test of path resolution across directories within the project.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/dynamic-import-vars/vite/main.js:46:10

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
```
export function withMultiParentDirAndItself(name) {
  return import(`../../plugins/dynamicImportVar/${name}.js`);
}
```
likely benign LLM, confidence 0.93 Test fixture for a dynamic import with a multi-level parent-directory specifier.
Reasoning
Fixture importing via a multi-level parent-relative template path inside the plugin's own test tree. This is path-resolution test input with no malicious behaviour.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:17:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  async afterTest() {
    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);
```
likely benign LLM, confidence 0.91 Test config dynamically importing a local producer module to check module-exports behaviour.
Reasoning
Test config in a bundler plugin test suite that imports a local built file (./callable-producer.js) and asserts on its exports. The 'as string' cast is a typing trick to stop the bundler resolving the import at build time, and the target is a local file.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/builtin-plugin/esm-external-require-plugin/module-exports/_config.ts:18:28

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const producer = await import('./callable-producer.js' as string);
    const consumer = await import('./dist/main.js' as string);

    expect(Object.hasOwn(producer, 'module.exports')).toBe(true);
```
likely benign LLM, confidence 0.91 Test config dynamically importing a local dist module for interop assertions.
Reasoning
Same test config, importing a local built dist file to check interop with the producer module. The assertions confirm a test harness, not a payload loader.
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/restore-query-extension/_config.ts:38:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.split('?')[0], 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```
info dynamic-execution packages/rolldown/tests/fixtures/builtin-plugin/import-glob/vite/transform/_config.ts:35:53

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
            const res = fs.readFileSync(id.slice(0, -7), 'utf-8');
            return `export default ${JSON.stringify(btoa(res))}`;
          }
        },
```
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rolldown-file-url/_config.ts:36:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(
```
likely benign LLM, confidence 0.91 Test config dynamically importing a local built entry to verify file-URL asset resolution.
Reasoning
Rolldown test config that dynamically imports a local built entry (./dist/entries/main.mjs) and checks the resulting file URL path. The import is a local test artifact, and the surrounding code only asserts on path output.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:30:24

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const main = await import('./dist/main.js' as string);
    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);
```
likely benign LLM, confidence 0.93 Test config imports a built main chunk and then a dependency URL derived from it.
Reasoning
The first import targets a fixed local build file (./dist/main.js). The second imports a URL derived from the first module's default export, which is a test assertion of chunk resolution inside a test fixture.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url-chunk/_config.ts:32:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    const depUrl = new URL(main.default, new URL('./dist/main.js', import.meta.url)).href;
    const dep = await import(depUrl);
    expect(dep.default).toBe('dep.js');
  },
```
likely benign LLM, confidence 0.93 Test config imports a bundled dependency chunk and asserts its default export.
Reasoning
This is the same dependency import as the previous finding, with the surrounding assertion on dep.default. It is a test checking that a bundled chunk loads, with no hostile behavior visible.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/misc/rollup-file-url/_config.ts:38:23

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
  afterTest: async () => {
    const mod = await import('./dist/entries/main.mjs' as string);
    const assetPath = fileURLToPath(mod.default);
    expect(path.relative(import.meta.dirname, assetPath).replace(/\\/g, '/')).toBe(
```
likely benign LLM, confidence 0.93 Test config dynamically imports a locally built entry module.
Reasoning
The import specifier is a literal string cast to string, so the path is fixed to a local build output. This is a test harness loading its own bundle to check file URL handling, not dynamic code loading.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/common-chunks/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.94 Test requires generated output chunks to check their module format flags.
Reasoning
A test iterates over the bundler's own output chunks and requires each one to check __esModule. The specifier is built from the output file name inside ./dist, which is expected in a bundler test suite.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/false/_config.ts:24:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.94 Test requires built output chunks to assert the absence of __esModule.
Reasoning
Same pattern as the other es-module tests: the test requires its own built chunks in ./dist and asserts on __esModule. Nothing suggests malicious use.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-false/_config.ts:26:28

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => !require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.94 Test requires generated chunks to verify a nested __esModule property.
Reasoning
The test requires its own generated ./dist chunks and checks a nested property. The template-literal path is limited to the build directory, which is normal for test fixtures.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/if-default-prop-true/_config.ts:26:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).bundle.nested.__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.94 Test requires generated chunks to verify a nested __esModule property.
Reasoning
Same test pattern: requiring built output chunks from ./dist to assert an export shape. It is a legitimate bundler test assertion.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/es-module/true/_config.ts:24:27

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
        )
        .every((chunk) => require(`./dist/${chunk.fileName}`).__esModule),
    ).toBe(true);
  },
```
likely benign LLM, confidence 0.94 Test requires built output chunks to verify __esModule is set.
Reasoning
The test requires its own generated ./dist chunks and checks __esModule, which is standard for testing a bundler's module output format.
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/fixtures/output/minify/dce-only/main.js:3:1

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
import(/* @vite-ignore annotation comment is kept */ 'node:module');

export function foo() {
```
likely benign LLM, confidence 0.90 Fixture output keeps a dynamic import of node:module with a vite-ignore annotation.
Reasoning
This is a minifier/DCE expected-output fixture. It dynamically imports the built-in node:module, and the @vite-ignore comment shows the import is intentional and was preserved in the output.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:18:52

base64-like blob (188 bytes, compression ratio 0.90) (raw pass, confidence 0.60)
```
    expect(output.output[0].map!.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbi5qcyIsIm5hbWVzIjpbXSwic291cmNlcyI6WyIuLi9tYWluLmpzIl0sInNvdXJjZXNDb250ZW50IjpbImNvbnNvbGUubG9nKGZvbyk7XG4iXSwibWFwcGluZ3MiOiI7QUFBQSxRQUFRLElBQUksR0FBRyJ9"`,
    );
```
likely benign LLM, confidence 0.95 Inline snapshot containing a base64-encoded source map data URL.
Reasoning
The base64 blob is a standard inline source map data URL asserted in an inline snapshot, decoding to a small version-3 JSON map. Raw-pass base64 findings are common false positives in tests like this.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/fixtures/output/sourcemap/methods/_config.ts:26:52

base64-like blob (192 bytes, compression ratio 0.89) (raw pass, confidence 0.60)
```
    expect(map.toUrl()).toMatchInlineSnapshot(
      `"data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbjIuanMiLCJuYW1lcyI6W10sInNvdXJjZXMiOlsiLi4vbWFpbi5qcyJdLCJzb3VyY2VzQ29udGVudCI6WyJjb25zb2xlLmxvZyhmb28pO1xuIl0sIm1hcHBpbmdzIjoiO0FBQUEsUUFBUSxJQUFJLEdBQUcifQ=="`,
    );
  },
```
likely benign LLM, confidence 0.95 Inline snapshot containing a base64-encoded source map data URL.
Reasoning
This is another inline source map data URL in a snapshot assertion, a short base64 JSON map with no executable payload.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:233:53

base64-like blob (192 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsQ0FBQyxDQUFDLENBQU8sQ0FBQyxDQUFDIn0=',
      );
```
likely benign LLM, confidence 0.95 Test expects a base64-encoded source map data URL from toUrl().
Reasoning
The string is a source map data URL in a test expectation for magic-string's toUrl output. It is expected data in a unit test, not a hidden payload.
info ~~warn~~ → info by review encoding-base64 packages/rolldown/tests/magic-string/MagicString.test.ts:319:53

base64-like blob (180 bytes, compression ratio 0.91) (raw pass, confidence 0.60)
```
        map.toUrl(),
        'data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0cHV0Lm1kIiwic291cmNlcyI6WyJpbnB1dC5tZCJdLCJzb3VyY2VzQ29udGVudCI6WyJhYmNkZWZnaGlqa2wiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsR0FBRyxHQUFNLENBQUMifQ==',
      );
```
likely benign LLM, confidence 0.95 Test expects a base64-encoded source map data URL from toUrl().
Reasoning
Same as the previous finding: a source map data URL asserted in a magic-string unit test, with no execution or decoding behavior.

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:460:37

orphaned low surrogate \uDD37 (no preceding high surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(2) === '\uDD37b'
    assert.strictEqual(s.slice(2), '\uDD37b');
    // slice(0, 2) ends at low surrogate — returns 'a' + lone high surrogate
    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:463:41

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)

    // matching JS behavior: 'a🤷b'.slice(0, 2) === 'a\uD83E'
    assert.strictEqual(s.slice(0, 2), 'a\uD83E');
    // slice(3) is 'b'
    assert.strictEqual(s.slice(3), 'b');

info unicode-surrogate packages/rolldown/tests/magic-string/rolldown-magic-string.test.ts:484:46

orphaned high surrogate \uD83E (no matching low surrogate) (token pass, confidence 0.65)
```
    assert.strictEqual(s.toString(), 'abIJefgh🤷kl');
    assert.strictEqual(s.slice(-3, 3), 'Jefgh\uD83E');
  });
});
```
info ~~warn~~ → info by review dynamic-import packages/rolldown/tests/src/load-binding.ts:17:10

`require` called with a non-literal specifier (ast pass, confidence 0.80)
```
  }
  return require(`../../dist/${bindingFile}`);
}
```
likely benign LLM, confidence 0.85 Test helper that requires a native binding file from the local dist directory using a templated filename.
Reasoning
A require with a template literal path built from a variable is a common pattern for loading native bindings from a dist directory in a test helper. The path is relative to the repo's own dist folder, not attacker-controlled input in this snippet, and the file is under tests/. Dynamic require is worth noting but not malicious here.
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file0.js:1:1

547 of 1183 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info whitespace-anomaly packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:2:1

file mixes tab and space indentation (1 tab-indented and 37484 space-indented lines) (raw pass, confidence 0.40)
```
import {
  AcceleratedAnimation,
  addPointerEvent,
  addPointerInfo,
```
info ~~warn~~ → info by review long-line packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:11670:1

line length 4052 characters (raw pass, confidence 0.65)
```
  /^(?:children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|
```
dismissed LLM, confidence 0.90 Long regex listing HTML and React attribute names, typical of a bundled or generated library file in a stability test fixture.
Reasoning
A very long line consisting of a regex alternation of React/HTML attribute names is a generated or bundled artifact (e.g. a whitelist of valid DOM attributes). It is a raw pass long-line signal with no obfuscation or malicious behavior, and it sits in a stability test fixture.

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file1.js:35328:8

compression ratio 0.845 is >2σ above file mean 0.631 (raw pass, confidence 0.50)

      // System fonts - Taken from https://furbo.org/stuff/systemfonts-new.html - "All Platforms" section
      'system-ui|-apple-system|BlinkMacSystemFont|Segoe UI|Roboto|Oxygen|Ubuntu|Cantarell|Fira Sans|Droid Sans|Helvetica Neue|sans-serif'
    );
    const fontFamily = {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file10.js:1:1

72 of 137 non-conventional identifiers are single-character (53%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file28.js:1:1

3890 of 8197 non-conventional identifiers are single-character (47%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file29.js:1:1

23 of 40 non-conventional identifiers are single-character (58%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file30.js:1:1

25 of 42 non-conventional identifiers are single-character (60%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:1:1

69 of 162 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:105:10

compression ratio 0.832 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Co-Founder of UIE asks, “What was the most important thing you learned yesterday, and how will it impact what you do in the future?”',
    }),
    /*#__PURE__*/ e('p', {

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file31.js:132:10

compression ratio 0.815 is >2σ above file mean 0.629 (raw pass, confidence 0.50)

      children:
        "People don't always know what they want, even if they think the do. As Joe Leech, a UX psychologist says, \"People want more choices, but can't deal with them.”",
    }),
    /*#__PURE__*/ e('p', {

info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file34.js:1:1

392 of 725 non-conventional identifiers are single-character (54%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:1:1

55 of 136 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)

info high-complexity packages/rolldown/tests/stability/issue-3453/src/lib/file36.js:111:10

compression ratio 0.873 is >2σ above file mean 0.679 (raw pass, confidence 0.50)

      children:
        'Jared Spool, Wsp\xf3łzałożyciel UIE pyta: „Co było najważniejszą rzeczą, jaką wczoraj się nauczyłeś, i w jaki spos\xf3b to wpłynie na to, co robisz w przyszłości?”',
    }),
    /*#__PURE__*/ e('p', {

info ~~warn~~ → info by review long-line packages/rolldown/tests/stability/issue-3453/src/lib/file37.js:37:1

line length 3972 characters (raw pass, confidence 0.65)
```
      /^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|ce
```
dismissed LLM, confidence 0.90 Long regex of DOM attribute names in a stability test fixture, consistent with generated library code.
Reasoning
Same pattern as the sibling file: a long regex alternation of DOM/React attribute names in a stability test fixture. Long-line on minified or generated code is expected and not evidence of obfuscation.
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file46.js:1:1

35 of 87 non-conventional identifiers are single-character (40%) (token pass, confidence 0.50)
info identifier-low-length packages/rolldown/tests/stability/issue-3453/src/lib/file5.js:1:1

19 of 41 non-conventional identifiers are single-character (46%) (token pass, confidence 0.50)
info unicode-mixed-script packages/rolldown/tests/validate-option.test.ts:138:6

identifier `unKnown` mixes scripts: Latin + Other (in string/comment) (raw pass, confidence 0.40)
```
    'UNKNOWN-SESSION',
    'unKnown-session',
    'unknown-ſession',
    'unknown-seßion',
```

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/rolldown/rolldown rolldown && cd rolldown
git checkout v1.2.15
disclude scan --severity info --diff v1.2.14 packages/rolldown