cppcheck warns about the pointer to local variable in list initialization

I think the rule was for before C++11:

{/*..*/} was only use for aggregate initialization before C++11, so T{ data.data(), data.size() } could only store the future dangling pointer thus the diagnostic.

With T(data.data(), data.size() ), it is a regular constructor call, so it actually depends of T constructor, so no diagnostic can be safely be done without inspecting T constructor (and I doubt than cppcheck does inspect) (and BTW it is safe for std::string).

So indeed, it is a false positive.

It's a false-positive as the string ctor makes a copy of the passed char* string.