react 19.3.0

Source: https://github.com/react/react
Tag scanned: v19.3.0
Directory: packages/react (only this part of the repository was scanned)
Compared with: v19.2.9 (0 signals introduced since)
Files: 84 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 4.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:49

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:196:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
likely benign LLM, confidence 0.97 A console.error message in React's lazy module that splits the word 'import' across string literals to keep bundlers from treating it as a real dynamic import.
Reasoning
This is React's own lazy() error message. The string is split as 'imp' + 'ort()' with an explicit comment saying the break is there so bundlers do not parse the text as a dependency. The concatenation is a deliberate way to keep a literal import() string in a message, not obfuscation.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:200:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))\n\n" +
            'Did you accidentally put curly braces around the import?',
```
likely benign LLM, confidence 0.97 A warning example string in React's lazy module that splits 'import' so the example text is not parsed as a dependency.
Reasoning
The split is 'imp' + 'ort' inside a developer-facing warning string, and the comment above it states the purpose: avoid being parsed as a dependency. It is a documentation string with no runtime execution or hidden payload.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:210:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
likely benign LLM, confidence 0.97 A second React lazy() console.error message that splits 'import' across concatenated literals for bundler safety.
Reasoning
Same pattern and same error message as the earlier finding in this file: a developer warning with the word 'import' split to avoid bundler dependency parsing. No execution or data hiding.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:214:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))",
          moduleObject,
```
likely benign LLM, confidence 0.97 A React lazy() error example string that splits 'import' to avoid being parsed as a dependency.
Reasoning
The snippet is a developer-facing example string split as 'imp' + 'ort' with the same explicit comment about avoiding dependency parsing. It is passed as message text, not executed.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout v19.3.0
disclude scan --severity info --diff v19.2.9 packages/react