react 19.3.1

Source: https://github.com/react/react
Tag scanned: v19.3.1
Directory: packages/react (only this part of the repository was scanned)
Compared with: v19.3.0 (0 signals introduced since)
Files: 84 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 3.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 12:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:196:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
likely benign LLM, confidence 0.97 Error message string in React.lazy split to avoid the word 'import' being parsed as a dependency.
Reasoning
The string is split across concatenation to keep bundlers from parsing an import() inside an error message string; the source comment says so explicitly. The text is a developer-facing console.error message in React's lazy implementation. No execution or payload is involved.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:200:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))\n\n" +
            'Did you accidentally put curly braces around the import?',
```
likely benign LLM, confidence 0.97 Example code inside a React warning message is split to avoid bundler dependency parsing.
Reasoning
The comment states the split is intentional so the bundler does not treat the example code in the string as a real dependency. This is a documentation string in an error message with no dynamic execution.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:210:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
likely benign LLM, confidence 0.97 Duplicate of the React lazy error message split across concatenation.
Reasoning
Same pattern as the first finding: a duplicated console.error message in React's lazy module, split for bundler safety and used only for logging.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:214:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))",
          moduleObject,
```
likely benign LLM, confidence 0.96 Example code string in React lazy warning, split to avoid bundler parsing.
Reasoning
Same intentional split of example code in a developer warning, with an explicit comment explaining the reason. The string is only logged.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/react/react react && cd react
git checkout v19.3.1
disclude scan --severity info --diff v19.3.0 packages/react