npm / react / 19.3.0-canary-99c106c4-20261014

react 19.3.0-canary-99c106c4-20261014

Source

https://github.com/react/react

Commit scanned

99c106c43439 (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

98ce535fdb6f (0 signals introduced since)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

7.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-15 12:41

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   dismissed LLM, confidence 0.95 A console error message in React's lazy loader with 'import' split across a string concatenation.

   Reasoning

   The string is split to avoid bundlers or parsers treating the word 'import' in an error message as a real dynamic import dependency. The adjacent comment states this purpose. The concatenation only builds a console.error message and does not execute or hide any behaviour.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   dismissed LLM, confidence 0.95 A developer hint string in React's lazy loader that splits the word 'import' to keep bundlers from parsing it.

   Reasoning

   The code comment says the import keyword is broken up to avoid accidental dependency parsing. The string is an example snippet in a developer-facing warning, so the split is a legitimate authoring choice and not obfuscation.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   dismissed LLM, confidence 0.95 A second console error message in React's lazy loader with 'import' split across a concatenation.

   Reasoning

   This is the same console.error message as the earlier finding in the same file. The split 'imp' + 'ort' serves only to keep bundlers from treating the text as an import, which is benign.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   dismissed LLM, confidence 0.95 A developer example string in React's lazy loader with 'import' split for bundler safety.

   Reasoning

   This is a developer-facing example string in React's lazy loader, and the adjacent comment gives the reason for splitting 'import'. It is a false positive from the token pass's keyword-reconstruction heuristic.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout 99c106c43439ad7af05d42f66582d8d05190e9ff
disclude scan --severity info --diff 98ce535fdb6ff559a5dd76b58c1bcaa983804957 packages/react