npm / react / 19.3.0-canary-ab0d927f-20261020

react 19.3.0-canary-ab0d927f-20261020

Source

https://github.com/react/react

Commit scanned

ab0d927f53f6 (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

a7cce7b31b8f (0 signals introduced since)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.7 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 16:29

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 React's lazy() dev-warning message string, which splits the word 'import' to avoid being parsed as a dependency.

   Reasoning

   The split string 'imp' + 'ort()' inside a console.error message is deliberate, as the adjacent comment states, to keep bundlers and parsers from treating the text as a real dynamic import dependency. This is a known React pattern in ReactLazy, not obfuscation of malicious code.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Developer warning text showing example lazy() usage, with 'import' split across concatenated literals.

   Reasoning

   The string concatenation splits 'import' in an error-message example, with an explicit comment explaining it avoids accidental dependency parsing. It is a benign developer-message string with no execution or payload.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Duplicate React lazy() dev-warning message splitting the word 'import'.

   Reasoning

   Same console.error warning text as the first finding, with the split 'imp' + 'ort()' and a comment-free but identical pattern in React's lazy implementation. Nothing executes the reconstructed string.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.97 Developer warning example string for lazy() usage, with 'import' split across literals.

   Reasoning

   The concatenated literal forms an example code string in a developer error message, with the split preceded by the same explanatory comment. It is inert text passed as a message argument.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/react/react react && cd react
git checkout ab0d927f53f6e1b5dcfc2c4e9fc438bdb5ffb678
disclude scan --severity info --diff a7cce7b31b8fa057550be8f82027b7f7ad2414c5 packages/react