react 19.0.9

Source: https://github.com/react/react
Tag scanned: v19.0.9
Directory: packages/react (only this part of the repository was scanned)
Compared with: v19.0.8 (0 signals introduced since)
Files: 82 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 3.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 12:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:99:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
likely benign LLM, confidence 0.97 A console.error diagnostic in React's lazy implementation that splits the word 'import' inside an error message string.
Reasoning
This is React's own lazy() error message, split across string literals with a comment explaining the split is to avoid bundlers and parsers treating the text as a real import dependency. The concatenation is cosmetic, not obfuscation of a payload, and the surrounding code is ordinary React runtime diagnostics.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:103:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))\n\n" +
            'Did you accidentally put curly braces around the import?',
```
likely benign LLM, confidence 0.97 A developer-facing warning message containing example lazy-import code, with the word 'import' split across concatenated literals.
Reasoning
The split string is an example code snippet inside a developer warning, and the source comment explicitly says the break avoids accidental dependency parsing. It is documentation text in a legitimate library, not executable code being hidden.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:113:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
likely benign LLM, confidence 0.97 Another React lazy() console.error message with 'import' split across string literals.
Reasoning
Same React lazy() error message as the earlier finding, split only to keep the text from being parsed as an import. Benign diagnostic string in a known framework file.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:117:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))",
          moduleObject,
```
likely benign LLM, confidence 0.97 A React warning string showing example lazy-import usage, with the 'import' keyword split across literals.
Reasoning
This is an example-code string in a React developer warning, split with an explicit comment about avoiding dependency parsing. It is not used to construct a runtime call or payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout v19.0.9
disclude scan --severity info --diff v19.0.8 packages/react