npm / vitest / 5.1.0-beta.1

vitest 5.1.0-beta.1

Source

https://github.com/vitest-dev/vitest

Tag scanned

v5.1.0-beta.1

Directory

packages/vitest (only this part of the repository was scanned)

Compared with

v5.0.5 (0 signals introduced since)

Files

287 scanned, 1 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 67 info

Scan time

6.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 20:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-import packages/vitest/src/integrations/env/loader.ts:71:11

   dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

       'vitest.runtime.environment.import',
       () => import(packageId) as Promise<{ default: Environment }>,
     )
     return resolveEnvironmentFromModule(name, packageId, pkg)

   likely benign LLM, confidence 0.90 Dynamic import of a configured vitest environment package.

   Reasoning

   Dynamic import of a package id for vitest environment loading is the expected plugin mechanism in a test runner; the specifier comes from configuration, not untrusted input.

2. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:56

   orphaned high surrogate \uD83F (no matching low surrogate) (token pass, confidence 0.65)

       regex = new RegExp(
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

3. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:64

   orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

       regex = new RegExp(
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

4. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:71

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

       regex = new RegExp(
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

5. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:194:83

   orphaned high surrogate \uD87F (no matching low surrogate) (token pass, confidence 0.65)

       regex = new RegExp(
         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

6. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:13

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

7. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:23

   orphaned high surrogate \uD8BF (no matching low surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

8. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:31

   orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

9. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:38

   orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

         '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
           'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
           'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

10. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:47

    orphaned high surrogate \uD8FF (no matching low surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

11. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:55

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

12. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:62

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

13. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:74

    orphaned high surrogate \uD93F (no matching low surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

14. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:195:82

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

          '([\\x7F-\\x84]|[\\x86-\\x9F]|[\\uFDD0-\\uFDEF]|\\uD83F[\\uDFFE\\uDFFF]|(?:\\uD87F[\\uDF' +
            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +

15. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:17

    orphaned high surrogate \uD97F (no matching low surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

16. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:25

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

17. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:32

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

18. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:41

    orphaned high surrogate \uD9BF (no matching low surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

19. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:49

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

20. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:56

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

21. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:65

    orphaned high surrogate \uD9FF (no matching low surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

22. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:73

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

23. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:196:80

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'FE\\uDFFF])|\\uD8BF[\\uDFFE\\uDFFF]|\\uD8FF[\\uDFFE\\uDFFF]|(?:\\uD93F[\\uDFFE\\uD' +
            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +

24. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:12

    orphaned high surrogate \uDA3F (no matching low surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

25. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:20

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

26. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:27

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

27. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:36

    orphaned high surrogate \uDA7F (no matching low surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

28. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:44

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

29. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:51

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

30. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:60

    orphaned high surrogate \uDABF (no matching low surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

31. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:68

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

32. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:197:75

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'FFF])|\\uD97F[\\uDFFE\\uDFFF]|\\uD9BF[\\uDFFE\\uDFFF]|\\uD9FF[\\uDFFE\\uDFFF]' +
            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +

33. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:17

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

34. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:24

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

35. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:34

    orphaned high surrogate \uDB3F (no matching low surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

36. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:42

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

37. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:49

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

38. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:58

    orphaned high surrogate \uDB7F (no matching low surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

39. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:66

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

40. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:73

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

41. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:198:85

    orphaned high surrogate \uDBBF (no matching low surrogate) (token pass, confidence 0.65)

            '|\\uDA3F[\\uDFFE\\uDFFF]|\\uDA7F[\\uDFFE\\uDFFF]|\\uDABF[\\uDFFE\\uDFFF]|(?:\\' +
            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +

42. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:12

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

43. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:19

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

44. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:29

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

45. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:37

    orphaned low surrogate \uDFFE (no preceding high surrogate) (token pass, confidence 0.65)

            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

46. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:199:44

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'uDAFF[\\uDFFE\\uDFFF])|\\uDB3F[\\uDFFE\\uDFFF]|\\uDB7F[\\uDFFE\\uDFFF]|(?:\\uDBBF' +
            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +

47. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:27

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

48. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:35

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

49. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:44

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

50. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:52

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

51. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:62

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

52. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:70

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

53. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:82

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

54. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:200:90

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            '[\\uDFFE\\uDFFF])|\\uDBFF[\\uDFFE\\uDFFF](?:[\\0-\\t\\v\\f\\x0E-\\u2027\\u202A-\\uD7FF\\' +
            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',

55. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:16

    orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
        )

56. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:24

    orphaned high surrogate \uDBFF (no matching low surrogate) (token pass, confidence 0.65)

            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
        )

57. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:36

    orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
        )

58. info unicode-surrogate packages/vitest/src/node/reporters/junit.ts:201:44

    orphaned low surrogate \uDFFF (no preceding high surrogate) (token pass, confidence 0.65)

            'uE000-\\uFFFF]|[\\uD800-\\uDBFF][\\uDC00-\\uDFFF]|[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|' +
            '(?:[^\\uD800-\\uDBFF]|^)[\\uDC00-\\uDFFF]))',
          'g',
        )

59. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/moduleEvaluator.ts:155:73

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

            },
            () => (this.vm ? this.vm.externalModulesExecutor.import(file) : import(file)),
          )
          .finally(() => {

    likely benign LLM, confidence 0.90 Dynamic import of a test file path inside a module evaluator.

    Reasoning

    Module evaluator imports the test file path it was asked to run, a core function of a module runner; no obfuscation or hidden payload.

60. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:234:12

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        url.searchParams.set('mock', 'actual')
        return import(url.toString())
      }

    likely benign LLM, confidence 0.90 Dynamic import of a mock-tagged module URL.

    Reasoning

    Builds a URL with a mock query parameter and imports it; standard mocking machinery in a test framework.

61. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:241:14

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        if (resolvedId.includes('mock=')) {
          return import(resolvedId)
        }

    likely benign LLM, confidence 0.90 Dynamic import of a resolved mock module id.

    Reasoning

    Re-imports a resolved mock id; expected for a module mocker and not an evasion technique.

62. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:250:14

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        if (redirect) {
          return import(pathToFileURL(redirect).toString())
        }

    likely benign LLM, confidence 0.90 Dynamic import of a redirected mock file.

    Reasoning

    Imports a redirect target for module mocking via pathToFileURL; ordinary test-tooling behavior.

63. info warn → info by review dynamic-import packages/vitest/src/runtime/moduleRunner/nativeModuleMocker.ts:255:12

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

        url.searchParams.set('mock', 'automock')
        return import(url.toString())
      }
    }

    likely benign LLM, confidence 0.90 Dynamic import of an automock-tagged module URL.

    Reasoning

    Same automock pattern adding a query parameter then importing; consistent with a legitimate mocker.

64. info warn → info by review dynamic-import packages/vitest/src/runtime/vm/commonjs-executor.ts:182:16

    `require` called with a non-literal specifier (ast pass, confidence 0.60)

            const require = Module.createRequire(parent?.filename ?? request)
            return require(request)
          }

    likely benign LLM, confidence 0.85 createRequire-based require of a module request.

    Reasoning

    Creates a require bound to the parent filename and calls it with the request; standard CommonJS resolution in a VM executor.

65. info warn → info by review dynamic-import packages/vitest/src/utils/coverage.ts:72:15

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

          ? await loader.import(builtInModule)
          : await import(/* @vite-ignore */ builtInModule)
    
        if (!coverageModule) {

    likely benign LLM, confidence 0.90 Dynamic import of a built-in coverage module.

    Reasoning

    Loads a built-in coverage provider module with a vite-ignore comment, a common and explicit dynamic import pattern.

66. info warn → info by review dynamic-import packages/vitest/src/utils/nativeModuleRunner.ts:45:12

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

    
        return import(pathToFileURL(path + queryParams).toString())
      }
    }

    likely benign LLM, confidence 0.90 Dynamic import of a file URL with query parameters.

    Reasoning

    Imports a file path converted to a file URL with query params; normal native module loading in a runner.

67. info warn → info by review dynamic-import packages/vitest/src/utils/traces.ts:72:27

    dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)

          const sdkInit = (
            options.sdkPath ? import(/* @vite-ignore */ options.sdkPath!) : Promise.resolve()
          ).catch((cause) => {
            throw new Error(

    likely benign LLM, confidence 0.85 Optional dynamic import of a configured tracing SDK path.

    Reasoning

    Optionally imports a user-configured SDK path for tracing, guarded by a catch; a configuration-driven plugin load rather than hidden execution.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/vitest-dev/vitest vitest && cd vitest
git checkout v5.1.0-beta.1
disclude scan --severity info --diff v5.0.5 packages/vitest