npm / react-dom / 19.3.0-canary-098d2e87-20261015

react-dom 19.3.0-canary-098d2e87-20261015

Source: https://github.com/react/react
Commit scanned: 098d2e87a1f7 (recorded by npm)
Directory: packages/react-dom (only this part of the repository was scanned)
Compared with: 0972e23908b5 (0 signals introduced since)
Files: 227 scanned, 0 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 7.0 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 01:11

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution packages/react-dom/src/__tests__/ReactDOMForm-test.js:963:20

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
          // eslint-disable-next-line no-new-func
          result = Function(action.slice(11))();
        }
      } catch (x) {
```
likely benign LLM, confidence 0.85 A test helper in React's DOM form tests evaluates the body of a javascript: action string using Function(...), with the lint rule explicitly disabled.
Reasoning
This is a test file in React's own test suite. The Function(...) call sits in a try block and is preceded by an eslint-disable for no-new-func, which means the call was written on purpose. It evaluates the body of a javascript: URL-style action string, which mirrors how the browser treats such URLs in the form-action tests. The body comes from test fixtures, not from external input at runtime, and the test runs in a test environment. The critical severity is an artifact of the AST rule matching any non-literal Function call, not evidence of a dropper or hidden payload.
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:159:38

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
        'keypress',
        {which: keyCode('X'), char: '\uD83D\uDE0A'},
      ],
    },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:164:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
      eventSimulator: simulateEvent,
      eventSimulatorArgs: ['textInput', {data: '\uD83D\uDE0A'}],
    },
    {
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:293:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:414:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:541:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:676:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info ~~warn~~ → info by review dynamic-import packages/react-dom/src/test-utils/FizzTestUtils.js:99:7

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      // $FlowFixMe[unsupported-syntax]
      require(scriptSrc);
    } catch (x) {
      const event = new window.ErrorEvent('error', {error: x});
```
likely benign LLM, confidence 0.85 A test utility in React's Fizz test helpers calls require on a script source path and reports load errors through a window ErrorEvent.
Reasoning
This is React's Fizz test utility. It loads a script by source path with require(scriptSrc) inside a try block, and on failure it dispatches an ErrorEvent on the window. The Flow suppression comment shows the dynamic require was intentional. Its purpose is to execute test-fixture scripts in a jsdom-style environment. It is not reaching untrusted input or fetching remote code, and the warn severity matches a dynamic require in test tooling.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout 098d2e87a1f7142947418d15f63f975b58c4685b
disclude scan --severity info --diff 0972e23908b573faa5beebc0eb1154f792c53b62 packages/react-dom