npm / react / 0.0.0-experimental-098d2e87-20261015

react 0.0.0-experimental-098d2e87-20261015

Source

https://github.com/react/react

Commit scanned

098d2e87a1f7 (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

0972e23908b5 (0 signals introduced since)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-16 12:56

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 A console.error developer warning in React's lazy implementation, with the word 'import' split across concatenated strings so bundlers do not treat it as a dependency.

   Reasoning

   This is React's lazy() dev warning text. The string is split as 'imp' + 'ort()' with an explicit comment saying the split is to avoid the bundler parsing the text as a real dynamic import dependency. This is a legitimate, well-known pattern in React source; it is not obfuscation of malicious behavior.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Part of a React dev-warning example string where 'import' is split to keep bundlers from parsing it as a dependency.

   Reasoning

   Same React ReactLazy.js dev-warning pattern. The source comment explicitly explains the split is to avoid accidental dependency parsing of the example code in the message. Benign and intentional for developer-facing text.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Another React lazy() console.error warning with 'import' split across concatenated strings to avoid bundler dependency parsing.

   Reasoning

   Duplicate of the earlier React lazy() warning message in the same file, with the identical benign string split for the same documented reason.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.97 React dev-warning example text in which 'import' is split to prevent accidental dependency parsing.

   Reasoning

   Same React dev-warning example string with the explicit bundler-avoidance comment. The concatenation only builds a human-readable message and executes nothing sensitive.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout 098d2e87a1f7142947418d15f63f975b58c4685b
disclude scan --severity info --diff 0972e23908b573faa5beebc0eb1154f792c53b62 packages/react