npm / react / 19.3.0-canary-098d2e87-20261015

react 19.3.0-canary-098d2e87-20261015

Source

https://github.com/react/react

Commit scanned

098d2e87a1f7 (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

0972e23908b5 (0 signals introduced since)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

5.1 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-16 12:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   dismissed LLM, confidence 0.95 A console.error warning message in React's lazy() implementation, with the word 'import' split across a string concatenation.

   Reasoning

   The snippet is an error-message string split across concatenated literals so the bundler does not parse the word 'import' as a dependency. The code is a console.error warning in React's lazy loader. This is a deliberate, benign string-splitting pattern with no execution or hidden payload.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   dismissed LLM, confidence 0.95 An example usage string in a developer error hint, with 'import' split to avoid bundler parsing.

   Reasoning

   The source comment states the split exists to avoid accidental dependency parsing of the example import. The concatenated text is only a developer-facing hint about how to write lazy() usage. It is documentation text, not executable obfuscation.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   dismissed LLM, confidence 0.95 A second console.error warning message in React's lazy() implementation, using the same split-import string.

   Reasoning

   This is the same console.error warning as the first finding, a React lazy() error message with an intentionally split 'import' keyword. It is a legitimate, commented coding pattern in a well-known library.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   dismissed LLM, confidence 0.95 An example code string used in a React lazy() error message, with 'import' split across literals.

   Reasoning

   The snippet is a string literal used as an example in a developer-facing error object, with the split explained by the adjacent comment. It has no execution path and no sensitive behaviour, so it is a false positive from the token-pass string-concatenation heuristic.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout 098d2e87a1f7142947418d15f63f975b58c4685b
disclude scan --severity info --diff 0972e23908b573faa5beebc0eb1154f792c53b62 packages/react