npm / react / 19.3.0-canary-ba39b32a-20261019

react 19.3.0-canary-ba39b32a-20261019

Source

https://github.com/react/react

Commit scanned

ba39b32a467e (recorded by npm)

Directory

packages/react (only this part of the repository was scanned)

Compared with

b740af2510de (0 signals introduced since)

Files

84 scanned, 2 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 4 info

Scan time

4.6 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-20 15:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:194:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Error message string in React's lazy loader, split to avoid bundler dependency parsing.

   Reasoning

   This is React's own lazy() error message. The string is split so that the literal word 'import' does not get parsed as a dependency by bundlers and tooling, as the adjacent comment states. Benign.

2. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:198:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))\n\n" +
               'Did you accidentally put curly braces around the import?',

   likely benign LLM, confidence 0.97 Documentation string in an error message showing example lazy import usage.

   Reasoning

   Developer-facing error text showing example code, with the word 'import' split across concatenated literals and an explicit comment explaining why. No execution or hidden payload. Benign.

3. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:208:11

   concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)

           console.error(
             'lazy: Expected the result of a dynamic imp' +
               'ort() call. ' +
               'Instead received: %s\n\nYour code should look like: \n  ' +

   likely benign LLM, confidence 0.97 Duplicate of React's lazy() error message with split 'import' keyword.

   Reasoning

   Same React lazy() error message as the earlier finding, duplicated in a second branch. Benign string splitting for the same reason.

4. info warn → info by review string-concat-construction packages/react/src/ReactLazy.js:212:13

   concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)

               // Break up imports to avoid accidentally parsing them as dependencies.
               'const MyComponent = lazy(() => imp' +
               "ort('./MyComponent'))",
             moduleObject,

   likely benign LLM, confidence 0.97 Example code string in a React lazy warning, split deliberately.

   Reasoning

   The concatenated string is only an error-message example and is passed as data to console output, not executed. The split is the documented intent to avoid bundler parsing. Benign.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout ba39b32a467ea462ffb06db242da2bfc09e23af8
disclude scan --severity info --diff b740af2510de1e19fcb399abb862af26ff95ac80 packages/react