npm / react / 0.0.0-experimental-99c106c4-20261014

react 0.0.0-experimental-99c106c4-20261014

Source

https://github.com/react/react

Commit scanned

99c106c43439 (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

997f52fbb30e (0 signals introduced since)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.5 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-15 12:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Error message string in React's lazy implementation split across concatenation to keep the word 'import' from being parsed as a dependency.

   Reasoning

   This is React's lazy() module splitting a string literal to avoid bundlers parsing a literal 'import(' inside an error message. The comment in the adjacent finding confirms the intent. Benign.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Example code string in a React developer warning split across concatenation to avoid bundler dependency parsing.

   Reasoning

   Same pattern: developer-facing error text containing example code, split so bundlers do not treat the example import as a real dependency. The source comment states this explicitly. No execution or hidden payload.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Second copy of the lazy() dynamic import error message split across concatenation.

   Reasoning

   Duplicate of the error message in the earlier block of the same React lazy module, with the same benign purpose of a readable warning string.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.97 Example code in a console error message split across concatenation in React's lazy module.

   Reasoning

   Same benign pattern as the other findings: an example snippet in a console error, split to avoid bundler import parsing, with an explanatory comment. Token-pass string-concat signals on literal text are a known false-positive class.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout 99c106c43439ad7af05d42f66582d8d05190e9ff
disclude scan --severity info --diff 997f52fbb30ec4b777b66edcdd75f594d9fe0c55 packages/react