npm / react / 19.3.0-canary-a6792708-20261019

react 19.3.0-canary-a6792708-20261019

Source

https://github.com/react/react

Commit scanned

a679270829ac (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

a4eb2dfa6fec (0 signals introduced since)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

5.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-21 16:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   dismissed LLM, confidence 0.97 A console.error message in React's lazy loader, with the word 'import' split across a string concatenation so the text is not parsed as a dependency.

   Reasoning

   This is React's lazy() error message split across string literals, with an explicit comment explaining the split is to avoid bundlers and parsers treating the text as a dynamic import dependency. It is a legitimate, well-known coding pattern in React source, with no execution or obfuscation of code.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   dismissed LLM, confidence 0.97 An example snippet in a React warning message, with 'import' split across string literals to avoid dependency parsing.

   Reasoning

   The concatenation builds an example code string for a developer warning message, and the source comment states the purpose is to avoid parsing the text as a real import. It is inert string data inside a console message, not executable obfuscation.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   dismissed LLM, confidence 0.97 A second console.error warning in React's lazy loader with 'import' split across string literals.

   Reasoning

   Same React lazy() warning message as the earlier finding, with the same explanatory split of the word 'import' inside a console.error string. Benign development-mode diagnostic text.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   dismissed LLM, confidence 0.97 Example code text in a React warning, with 'import' split across concatenated string literals for the stated parser-avoidance reason.

   Reasoning

   This is an example code string in a React development warning, with the source comment explaining the split prevents dependency parsing. It is plain message text passed to the logger, not a payload or dynamic execution.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout a679270829ac5786fe7cd3b65acd289d5338dbc7
disclude scan --severity info --diff a4eb2dfa6fec3da5a947eb84c99b059890bb5241 packages/react