npm / vitest / 4.1.12

vitest 4.1.12

Source

https://github.com/vitest-dev/vitest

Tag scanned

v4.1.12

Directory

packages/vitest (only this part of the repository was scanned)

Compared with

v4.1.11 (0 signals introduced since)

Files

262 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 67 info

Scan time

8.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-16 10:26

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import packages/vitest/src/integrations/env/loader.ts:67:11

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

       'vitest.runtime.environment.import',
       () => import(packageId) as Promise<{ default: Environment }>,
     )
     return resolveEnvironmentFromModule(name, packageId, pkg)

   likely benign LLM, confidence 0.90 Dynamically imports a user-configured Vitest environment package.

   Reasoning

   The non-literal import resolves a test environment package named by the user's Vitest configuration. This is the expected plugin-loading mechanism in a test runner, not obfuscation or a hidden payload.

2. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:76:56

   orphaned high surrogate \uD83F (no matching low surrogate) (token pass, confidence 0.65)

         /* eslint-disable regexp/prefer-character-class, regexp/no-obscure-range, regexp/no-useless-non-capturing-group */
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'

3. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:76:64

   orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

         /* eslint-disable regexp/prefer-character-class, regexp/no-obscure-range, regexp/no-useless-non-capturing-group */
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'

4. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:76:71

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

         /* eslint-disable regexp/prefer-character-class, regexp/no-obscure-range, regexp/no-useless-non-capturing-group */
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'

5. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:76:83

   orphaned high surrogate \uD87F (no matching low surrogate) (token pass, confidence 0.65)

         /* eslint-disable regexp/prefer-character-class, regexp/no-obscure-range, regexp/no-useless-non-capturing-group */
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'

6. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:13

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
         + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

7. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:23

   orphaned high surrogate \uD8BF (no matching low surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
         + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

8. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:31

   orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
         + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

9. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:38

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
         + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
         + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

10. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:47

    orphaned high surrogate \uD8FF (no matching low surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

11. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:55

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

12. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:62

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

13. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:74

    orphaned high surrogate \uD93F (no matching low surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

14. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:77:82

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF'
          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'

15. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:17

    orphaned high surrogate \uD97F (no matching low surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

16. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:25

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

17. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:32

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

18. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:41

    orphaned high surrogate \uD9BF (no matching low surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

19. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:49

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

20. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:56

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

21. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:65

    orphaned high surrogate \uD9FF (no matching low surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

22. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:73

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

23. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:78:80

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD'
          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'

24. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:12

    orphaned high surrogate \uDA3F (no matching low surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

25. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:20

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

26. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:27

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

27. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:36

    orphaned high surrogate \uDA7F (no matching low surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

28. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:44

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

29. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:51

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

30. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:60

    orphaned high surrogate \uDABF (no matching low surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

31. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:68

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

32. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:79:75

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]'
          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'

33. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:17

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

34. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:24

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

35. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:34

    orphaned high surrogate \uDB3F (no matching low surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

36. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:42

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

37. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:49

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

38. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:58

    orphaned high surrogate \uDB7F (no matching low surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

39. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:66

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

40. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:73

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

41. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:80:85

    orphaned high surrogate \uDBBF (no matching low surrogate) (token pass, confidence 0.65)

          + '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\'
          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'

42. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:81:12

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'

43. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:81:19

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'

44. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:81:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'

45. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:81:37

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'

46. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:81:44

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + 'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF'
          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'

47. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:27

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

48. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:35

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

49. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:44

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

50. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:52

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

51. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:62

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

52. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:70

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

53. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:82

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

54. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:82:90

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          + '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\'
          + 'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|'
          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',

55. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:84:16

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
          /* eslint-enable */

56. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:84:24

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
          /* eslint-enable */

57. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:84:36

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
          /* eslint-enable */

58. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:84:44

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          // eslint-disable-next-line regexp/no-useless-assertions
          + '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
          /* eslint-enable */

59. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/moduleEvaluator.ts:127:11

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

            ? this.vm.externalModulesExecutor.import(file)
            : import(file),
        ).finally(() => {
          this.options.moduleExecutionInfo?.set(filename, finishModuleExecutionInfo())

    likely benign LLM, confidence 0.90 Imports a test module file within Vitest's module evaluation runtime.

    Reasoning

    The import loads a module file being executed by Vitest's module runner, either through an external executor or natively. This is core functionality of a module evaluator and the specifier is a project file path.

60. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:228:12

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        url.searchParams.set('mock', 'actual')
        return import(url.toString())
      }

    likely benign LLM, confidence 0.90 Re-imports a module with a mock=actual query to bypass mocks.

    Reasoning

    The import appends a query parameter to a file URL to load the actual (unmocked) module. This is the standard mocking mechanism and does not hide intent.

61. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:235:14

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        if (resolvedId.includes('mock=')) {
          return import(resolvedId)
        }

    likely benign LLM, confidence 0.90 Imports a resolved mock module id.

    Reasoning

    The specifier is a resolved module id containing a mock marker, which is the expected form for loading mocked modules in a test framework.

62. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:245:14

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        if (redirect) {
          return import(pathToFileURL(redirect).toString())
        }

    likely benign LLM, confidence 0.90 Imports a redirected mock module via pathToFileURL.

    Reasoning

    The specifier is a file URL derived from a redirect path that the mocker resolved. This is ordinary module redirection for mocking.

63. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:250:12

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        url.searchParams.set('mock', 'automock')
        return import(url.toString())
      }
    }

    likely benign LLM, confidence 0.90 Re-imports a module with an automock query parameter.

    Reasoning

    The import appends mock=automock to a file URL to load an automocked module. This is standard test-mocking behavior with no sign of concealment.

64. info warn → info by review dynamic-import packages/vitest/src/runtime/vm/commonjs-executor.ts:137:16

    `require` called with a non-literal specifier (ast pass, confidence 0.60)

            const require = Module.createRequire(parent?.filename ?? request)
            return require(request)
          }

    likely benign LLM, confidence 0.88 Requires a CommonJS module through createRequire in the VM executor.

    Reasoning

    A require created via Module.createRequire resolves the requested CommonJS module relative to the parent file. This is the normal way a VM executor loads CJS dependencies.

65. info warn → info by review dynamic-import packages/vitest/src/utils/coverage.ts:56:17

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

            ? await loader.import(builtInModule)
            : await import(/* @vite-ignore */ builtInModule)
    
        if (!coverageModule) {

    likely benign LLM, confidence 0.90 Dynamically imports a built-in coverage provider module.

    Reasoning

    The @vite-ignore comment marks an intentional runtime import of a built-in coverage provider module chosen by configuration. This is a common and documented bundler-compatibility pattern.

66. info warn → info by review dynamic-import packages/vitest/src/utils/nativeModuleRunner.ts:43:12

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

    
        return import(pathToFileURL(path + queryParams).toString())
      }
    }

    likely benign LLM, confidence 0.90 Imports a module from a file path using a file URL.

    Reasoning

    The import converts a file path plus query parameters to a file URL to load a module natively. This is the expected runtime loader behavior for a test runner.

67. info warn → info by review dynamic-import packages/vitest/src/utils/traces.ts:67:42

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

          })
          const sdkInit = (options.sdkPath ? import(/* @vite-ignore */ options.sdkPath!) : Promise.resolve()).catch((cause) => {
            throw new Error(`Failed to import custom OpenTelemetry SDK script (${options.sdkPath}): ${cause.message}`)
          })

    likely benign LLM, confidence 0.85 Dynamically imports a user-configured OpenTelemetry SDK script.

    Reasoning

    The import loads a custom OpenTelemetry SDK script whose path comes from the developer's own options (sdkPath). The developer deliberately configures this, so it is a documented extension point rather than an attack, though a user-supplied path is still code execution.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v4.1.12
disclude scan --severity info --diff v4.1.11 packages/vitest