npm / react / 0.0.0-experimental-a6792708-20261019

react 0.0.0-experimental-a6792708-20261019

Source

https://github.com/react/react

Commit scanned

a679270829ac (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

nothing (first release scanned in full)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.0 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-21 16:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 React lazy() dev-mode console error message with the word 'import' split across a string concatenation to keep bundlers from treating it as a dependency.

   Reasoning

   This is React's lazy() error message string, split as 'imp' + 'ort()' with an explicit comment saying the split is to avoid the bundler parsing the text as a real import. It is a legitimate, well-known pattern in the React codebase. The token pass flags the reconstruction of the keyword, but the output is only a console message, not executed code.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Example code text in a React dev warning, with 'import' split to avoid bundler dependency parsing.

   Reasoning

   The concatenation builds a documentation string example containing `import('./MyComponent')`, with a comment explaining the split prevents accidental dependency parsing. It is inert text inside a warning message, not an execution path.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Second React lazy() dev-mode error message using the same split 'import' string for bundler safety.

   Reasoning

   Same React lazy() dev error message as the earlier finding, with the same split of 'import' for the purpose of a console.error string. No execution or encoded payload is involved.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.97 Example code string in a React lazy() dev error, with 'import' split to avoid bundler parsing.

   Reasoning

   Inert example text in a React dev error object, with an explicit comment about avoiding dependency parsing. The string is only displayed, and this is a standard practice in React's source.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout a679270829ac5786fe7cd3b65acd289d5338dbc7
disclude scan --severity info packages/react