vitest 5.0.5

Source: https://github.com/vitest-dev/vitest
Tag scanned: v5.0.5
Directory: packages/vitest (only this part of the repository was scanned)
Compared with: v5.0.4 (0 signals introduced since)
Files: 285 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 67 info
Scan time: 8.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 10:26

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import packages/vitest/src/integrations/env/loader.ts:71:11

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    'vitest.runtime.environment.import',
    () => import(packageId) as Promise<{ default: Environment }>,
  )
  return resolveEnvironmentFromModule(name, packageId, pkg)
```
likely benign LLM, confidence 0.92 Dynamic import of a configured test environment package by its resolved id.
Reasoning
The import specifier is a package id resolved from the project's configured environment package, inside a loader that resolves and then uses environment modules. This is the normal plugin-loading pattern for a test runner, not hidden or encoded code.

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:56

orphaned high surrogate \uD83F (no matching low surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:64

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:71

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:83

orphaned high surrogate \uD87F (no matching low surrogate) (token pass, confidence 0.65)

    regex = new RegExp(
      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:13

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:23

orphaned high surrogate \uD8BF (no matching low surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:31

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:38

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:47

orphaned high surrogate \uD8FF (no matching low surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:55

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:62

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:74

orphaned high surrogate \uD93F (no matching low surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:82

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

      '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:17

orphaned high surrogate \uD97F (no matching low surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:25

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:32

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:41

orphaned high surrogate \uD9BF (no matching low surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:49

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:56

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:65

orphaned high surrogate \uD9FF (no matching low surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:73

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:80

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:12

orphaned high surrogate \uDA3F (no matching low surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:20

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:27

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:36

orphaned high surrogate \uDA7F (no matching low surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:44

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:51

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:60

orphaned high surrogate \uDABF (no matching low surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:68

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:75

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:17

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:24

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:34

orphaned high surrogate \uDB3F (no matching low surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:42

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:49

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:58

orphaned high surrogate \uDB7F (no matching low surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:66

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:73

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:85

orphaned high surrogate \uDBBF (no matching low surrogate) (token pass, confidence 0.65)

        '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:12

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:19

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:29

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:37

orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:44

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:27

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:35

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:44

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:52

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:62

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:70

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:82

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:90

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:16

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:24

orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:36

orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:44

orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

        'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
        '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
      'g',
    )

info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/moduleEvaluator.ts:155:73

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
        },
        () => (this.vm ? this.vm.externalModulesExecutor.import(file) : import(file)),
      )
      .finally(() => {
```
likely benign LLM, confidence 0.92 Dynamic import of a test module file in the module evaluator, with a VM fallback.
Reasoning
The import loads a user test file path through the module runner, delegating to a VM executor when one is in use. This is the expected behavior of a module evaluator that runs test modules, and the path is not obfuscated or constructed to hide intent.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:234:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    url.searchParams.set('mock', 'actual')
    return import(url.toString())
  }
```
likely benign LLM, confidence 0.92 Re-import of an actual module via a file URL with a mock query parameter.
Reasoning
The specifier is a file URL built from a resolved module path with a query parameter for mocking. This is standard native module mocking that re-imports a module with a cache-busting or mock marker.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:241:14

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    if (resolvedId.includes('mock=')) {
      return import(resolvedId)
    }
```
likely benign LLM, confidence 0.92 Import of a resolved mock module id.
Reasoning
The import re-loads an already resolved id that contains a mock marker. This is ordinary mock-module resolution logic with no encoding or concealment.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:250:14

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    if (redirect) {
      return import(pathToFileURL(redirect).toString())
    }
```
likely benign LLM, confidence 0.92 Import of a redirected mock module converted to a file URL.
Reasoning
The import converts a redirect file path to a file URL and loads it, which is how mock redirects are implemented. It is ordinary module resolution.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:255:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    url.searchParams.set('mock', 'automock')
    return import(url.toString())
  }
}
```
likely benign LLM, confidence 0.92 Import of a module with an automock query parameter.
Reasoning
The import re-loads a module with an automock query parameter, the normal mechanism for automatic mocking. Nothing in the snippet indicates malicious intent.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/runtime/vm/commonjs-executor.ts:182:16

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        const require = Module.createRequire(parent?.filename ?? request)
        return require(request)
      }
```
likely benign LLM, confidence 0.90 Dynamic CommonJS require created with createRequire for a module request.
Reasoning
The require is created via Module.createRequire from the parent filename, which is the standard way to load CommonJS modules inside a VM-based executor. The specifier is the module request being evaluated, which is expected in this context.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/utils/coverage.ts:72:15

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      ? await loader.import(builtInModule)
      : await import(/* @vite-ignore */ builtInModule)

    if (!coverageModule) {
```
likely benign LLM, confidence 0.92 Dynamic import of a built-in coverage provider module.
Reasoning
The code loads a built-in coverage provider module, using a loader when available and otherwise a dynamic import with a vite-ignore hint. This is a standard optional-dependency pattern.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/utils/nativeModuleRunner.ts:45:12

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    return import(pathToFileURL(path + queryParams).toString())
  }
}
```
likely benign LLM, confidence 0.92 Import of a module by file URL with optional query parameters.
Reasoning
The import converts a path plus query parameters to a file URL and loads it, a routine native module runner operation with no obfuscation.
info ~~warn~~ → info by review dynamic-import packages/vitest/src/utils/traces.ts:72:27

dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
      const sdkInit = (
        options.sdkPath ? import(/* @vite-ignore */ options.sdkPath!) : Promise.resolve()
      ).catch((cause) => {
        throw new Error(
```
likely benign LLM, confidence 0.90 Optional dynamic import of a user-configured tracing SDK path.
Reasoning
The import loads an SDK path supplied through the user's own options, guarded by a catch that rethrows a descriptive error. This is an intentional, configurable plugin loader, not an attack pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v5.0.5
disclude scan --severity info --diff v5.0.4 packages/vitest