react 19.2.9

Source: https://github.com/react/react
Tag scanned: v19.2.9
Directory: packages/react (only this part of the repository was scanned)
Compared with: v19.2.8 (0 signals introduced since)
Files: 85 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 7.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 12:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:165:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
dismissed LLM, confidence 0.95 Dev-mode console.error message in React's lazy() implementation, with the word 'import' split across a string concatenation.
Reasoning
The string 'imp' + 'ort()' is a split of an error-message literal. The adjacent comment in the same file ('Break up imports to avoid accidentally parsing them as dependencies') states the purpose: bundlers would otherwise treat the text as a real dynamic import. This is React's lazy() dev warning, a standard idiom and not obfuscation.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:169:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))\n\n" +
            'Did you accidentally put curly braces around the import?',
```
dismissed LLM, confidence 0.95 Example usage text in a React lazy() error message, with 'import' split to avoid bundler dependency parsing.
Reasoning
The split 'imp' + 'ort(...)' sits inside an example string shown to developers. The code comment explicitly explains the split is there to keep bundlers from parsing the text as a dependency. It is a documentation string, not executable payload.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:179:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
dismissed LLM, confidence 0.95 Second copy of the React lazy() dev warning with the 'import' keyword split across concatenated strings.
Reasoning
This is the same dev-only lazy() error message as the first finding, repeated in the other branch. The string is only logged via console.error and the split is the documented bundler workaround.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:183:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))",
          moduleObject,
```
dismissed LLM, confidence 0.95 Example code string in a React lazy() dev error, with 'import' split for bundler compatibility.
Reasoning
The fragment is an example string passed as a value in a dev error path, with the same documented comment explaining the 'imp' + 'ort' split. It is not dynamically executed and there is no encoding or dropper behaviour.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout v19.2.9
disclude scan --severity info --diff v19.2.8 packages/react