npm / react / 0.0.0-experimental-ba39b32a-20261019

react 0.0.0-experimental-ba39b32a-20261019

Source

https://github.com/react/react

Commit scanned

ba39b32a467e (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

nothing (first release scanned in full)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-20 15:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 React lazy error message string split to avoid parsing 'import' as a dependency.

   Reasoning

   This is React's lazy() implementation. The string is split to avoid the bundler/parser treating the literal 'import(' inside an error message as a real dynamic import dependency, as the adjacent comment states. Legitimate, benign pattern.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Documentation string in React lazy error message split across concatenation.

   Reasoning

   Same React lazy error-message text, with 'import' split across concatenation purely so the example code in the message is not parsed as a real import. Benign developer-facing string.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Second React lazy error message with split 'import' keyword.

   Reasoning

   Duplicate of the lazy() error message in the React source, with the same benign reason for splitting the word 'import' in a console error string.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.97 React lazy error example code string split across concatenation.

   Reasoning

   Error-message example code in React's lazy implementation split to keep the bundler from treating it as a dependency. No execution or hidden payload; benign.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout ba39b32a467ea462ffb06db242da2bfc09e23af8
disclude scan --severity info packages/react