react-dom 19.3.0

Source: https://github.com/react/react
Tag scanned: v19.3.0
Directory: packages/react-dom (only this part of the repository was scanned)
Compared with: v19.2.9 (0 signals introduced since)
Files: 226 scanned, 0 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 8 info
Scan time: 5.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 20:01

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution packages/react-dom/src/__tests__/ReactDOMForm-test.js:963:20

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
          // eslint-disable-next-line no-new-func
          result = Function(action.slice(11))();
        }
      } catch (x) {
```
likely benign LLM, confidence 0.85 Test code that evaluates the body of a javascript: form action string via Function() to simulate browser behavior.
Reasoning
The snippet is inside a test file, carries an explicit eslint-disable for no-new-func, and sits in a catch block. The Function() call evaluates the body of a 'javascript:' action string (action.slice(11) strips the 'javascript:' prefix), which fits a test simulating how a browser would run a javascript: form action. The risk is that real code paths evaluate untrusted strings this way, but nothing in the snippet shows that. The critical severity reflects the AST rule, not the context here.
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:159:38

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
        'keypress',
        {which: keyCode('X'), char: '\uD83D\uDE0A'},
      ],
    },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:164:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
      eventSimulator: simulateEvent,
      eventSimulatorArgs: ['textInput', {data: '\uD83D\uDE0A'}],
    },
    {
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:293:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:414:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:541:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info unicode-surrogate packages/react-dom/src/events/plugins/__tests__/BeforeInputEventPlugin-test.js:676:49

surrogate pair \uD83D\uDE0A (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
            expect(beforeInputEvent.type).toBe('beforeinput');
            expect(beforeInputEvent.data).toBe('\uD83D\uDE0A');
          },
        },
```
info ~~warn~~ → info by review dynamic-import packages/react-dom/src/test-utils/FizzTestUtils.js:99:7

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
      // $FlowFixMe[unsupported-syntax]
      require(scriptSrc);
    } catch (x) {
      const event = new window.ErrorEvent('error', {error: x});
```
likely benign LLM, confidence 0.80 Test helper that requires a script from a test-supplied path and reports load errors as ErrorEvents.
Reasoning
This is a React test utility that calls require() on a scriptSrc variable, most likely a fixture or bundle path supplied by the test, inside a try/catch that reports errors through an ErrorEvent. The FlowFixMe comment shows it was written deliberately. Dynamic require of a test-controlled path is common and not obfuscation. The snippet does not show where scriptSrc comes from, so a small doubt remains.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout v19.3.0
disclude scan --severity info --diff v19.2.9 packages/react-dom