react 19.3.1

Source: https://github.com/react/react
Tag scanned: v19.3.1
Directory: packages/react (only this part of the repository was scanned)
Compared with: v19.3.0 (0 signals introduced since)
Files: 84 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 5.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 4 of 4 warn and critical signals; 4 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 16:21

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:196:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
dismissed LLM, confidence 0.97 A console.error message in React's lazy loader, with the word 'import' split across a string concatenation.
Reasoning
This is an error-message string in React's lazy() implementation. The string is split as 'imp' + 'ort()' so bundlers and static analyzers do not parse the message text as a real dynamic import dependency, as the adjacent comment states. The token-pass match is a known false positive for a benign pattern.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:200:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))\\n\\nD…" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))\n\n" +
            'Did you accidentally put curly braces around the import?',
```
dismissed LLM, confidence 0.97 A help-text string showing example lazy() usage, with 'import' split across concatenation to avoid bundler parsing.
Reasoning
This is a developer-facing hint string inside React's lazy loader. The concatenation 'imp' + 'ort' exists so that the example text is not parsed as a dependency, as the comment explains. It executes no code and carries no obfuscation intent.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:210:11

concatenated string reconstructs `import`: "lazy: Expected the result of a dynamic import() call. Instea…" (token pass, confidence 0.65)
```
        console.error(
          'lazy: Expected the result of a dynamic imp' +
            'ort() call. ' +
            'Instead received: %s\n\nYour code should look like: \n  ' +
```
dismissed LLM, confidence 0.97 A second console.error message in React's lazy loader with 'import' split across concatenation.
Reasoning
This is the same React console.error message as the first finding, in the second validation branch of lazy(). The split string is a deliberate bundler-avoidance idiom in a well-known library, so it is benign.
info ~~warn~~ → info by review string-concat-construction packages/react/src/ReactLazy.js:214:13

concatenated string reconstructs `import`: "const MyComponent = lazy(() => import('./MyComponent'))" (token pass, confidence 0.65)
```
            // Break up imports to avoid accidentally parsing them as dependencies.
            'const MyComponent = lazy(() => imp' +
            "ort('./MyComponent'))",
          moduleObject,
```
dismissed LLM, confidence 0.97 An error-message example string for lazy() in React, with 'import' split across concatenation.
Reasoning
This is the same deliberate split-string example as the other ReactLazy findings, used in an error message passed to console.error. The code is documentation text in a legitimate library, not a hidden payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/react/react react && cd react
git checkout v19.3.1
disclude scan --severity info --diff v19.3.0 packages/react