Strange enough, I can't reproduce it either the way you describe.
Not even with my usual build flags that I used to build diffutils
which test suites fails and I saw that it uses gnulib that lead me
here. If you can try to actually build and check diffutils (3.3) maybe
you will be able to reproduce it as I have no idea if diffutils applies
some custom configuration that may lead to the failure but is
actually filtered somewhere in gnulib itself (which would be very
strange). I will try to build diffutils from latest git checkout which will
bootstrap gnulib to see how that goes.
But anyway, patch that uses #pragma attached. As I'm not
entirely sure how this will actually work the patch may not be good
enough - I do not know if it will filter "-Wformat-nonliteral" literally
from the build flags or the interpretation of it, for an example, of
what "-Wformat-security" is supposed to do. So, maybe additional
pragmas, e.g. for "-Wformat", may be needed which will actually
turn of all format warnings must be used (altough that may not be
the best thing to do).
If anyone can come up with better patch and fix the issue that would
be great.
Cheers!