npm / react / 19.1.10

react 19.1.10

Source

https://github.com/react/react

Tag scanned

v19.1.10

Directory

packages/react (only this part of the repository was scanned)

Compared with

v19.1.9 (0 signals introduced since)

Files

85 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

3.8 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-15 12:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:99:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 A console.error message in React's lazy implementation that splits the word 'import' across string literals to avoid being parsed as a dependency.

   Reasoning

   This is React's lazy.js error message. The string is split as 'imp' + 'ort()' with an explicit comment saying the break-up avoids the bundler parsing the text as a real dependency. It is a deliberate, benign workaround inside an error string, not obfuscation of malicious behavior.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:103:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Example code inside a React error message, with 'import' split to keep bundlers from treating it as a real import.

   Reasoning

   The concatenation splits 'import' in an example code string in the error text, and the code comment explicitly explains the purpose. It is a documentation string, not executable payload.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:113:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Second console.error warning in React's lazy implementation that splits 'import' across string literals.

   Reasoning

   Same React lazy.js error message as the first finding, repeated in the development-only branch. The split is a deliberate, commented workaround in a warning string.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:117:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.97 Example code text in a React lazy error message, with 'import' split to avoid dependency parsing.

   Reasoning

   The string is an example code snippet in React's error message, with the 'import' split and an explicit comment explaining why. It is passed as a message argument, not executed or used to build a dynamic call.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout v19.1.10
disclude scan --severity info --diff v19.1.9 packages/react