IntAnalyze report: react@18.3.1

REVIEW risk score 14/100

Packagereact
Version18.3.1
Sourcehttps://github.com/facebook/react @ a87edf62d7d69705ddbcec9a24f0780b3db7535f (gitHead), directory packages/react
Integritysha512 OK
Files20 in package, 74 in source
LLMno (disabled with --no-llm)
Toolintanalyze 0.1.0

Summary

react@18.3.1 is REVIEW (risk score 14/100): 0 suspicious and 3 changed file(s) differ from the source. Most important: package.json (IA-MANIFEST-002, IA-MANIFEST-005), LICENSE (IA-FILE-001), README.md (IA-FILE-002).

Findings

PathVerdictSeverityRulesReason
package.json CHANGED MEDIUM IA-MANIFEST-002, IA-MANIFEST-005 package.json: new dependency not in the source, manifest fields differ from the source
LICENSE CHANGED LOW IA-FILE-001 document not found in the repo
README.md CHANGED LOW IA-FILE-002 documentation differs from the source

Expected differences

Build output mapped to source (14)

Details

package.json CHANGED MEDIUM

package.json: new dependency not in the source, manifest fields differ from the source

Why it matters: IA-MANIFEST-002: Dependency or optionalDependency in the package that the source package.json does not declare.; IA-MANIFEST-005: Other package.json field differs from the source (version, gitHead and _-prefixed fields are ignored).

Recommended action: Review the difference and confirm it is an intended part of the release build.

Explained by rule text. Rules: IA-MANIFEST-002, IA-MANIFEST-005.

Evidence
Diff (source → package)
--- source/package.json
+++ package/package.json
@@ -5,6 +5,6 @@
     "react"
   ],
-  "version": "19.0.0",
-  "homepage": "https://react.dev/",
+  "version": "18.3.1",
+  "homepage": "https://reactjs.org/",
   "bugs": "https://github.com/facebook/react/issues",
   "license": "MIT",
@@ -14,22 +14,18 @@
     "index.js",
     "cjs/",
+    "umd/",
     "jsx-runtime.js",
-    "jsx-runtime.react-server.js",
     "jsx-dev-runtime.js",
-    "react.react-server.js"
+    "react.shared-subset.js"
   ],
   "main": "index.js",
   "exports": {
     ".": {
-      "react-server": "./react.react-server.js",
+      "react-server": "./react.shared-subset.js",
       "default": "./index.js"
     },
     "./package.json": "./package.json",
-    "./jsx-runtime": {
-      "react-server": "./jsx-runtime.react-server.js",
-      "default": "./jsx-runtime.js"
-    },
-    "./jsx-dev-runtime": "./jsx-dev-runtime.js",
-    "./src/*": "./src/*"
+    "./jsx-runtime": "./jsx-runtime.js",
+    "./jsx-dev-runtime": "./jsx-dev-runtime.js"
   },
   "repository": {
@@ -40,4 +36,12 @@
   "engines": {
     "node": ">=0.10.0"
+  },
+  "dependencies": {
+    "loose-envify": "^1.1.0"
+  },
+  "browserify": {
+    "transform": [
+      "loose-envify"
+    ]
   }
-}
+}

LICENSE CHANGED LOW

document not found in the repo

Why it matters: IA-FILE-001: File found nowhere in the repository and not explained as build output (LOW for documentation files, which are never executed).

Recommended action: Review the difference and confirm it is an intended part of the release build.

Explained by rule text. Rules: IA-FILE-001.

Evidence

README.md CHANGED LOW

documentation differs from the source

Why it matters: IA-FILE-002: File present in both trees with different content (LOW for documentation or when lines are only removed).

Recommended action: Review the difference and confirm it is an intended part of the release build.

Explained by rule text. Rules: IA-FILE-002.

Evidence
Diff (source → package)
--- source/README.md
+++ package/README.md
@@ -26,12 +26,12 @@
 
 const root = createRoot(document.getElementById('root'));
-root.render(<Counter />);
+root.render(<App />);
 ```
 
 ## Documentation
 
-See https://react.dev/
+See https://reactjs.org/
 
 ## API
 
-See https://react.dev/reference/react
+See https://reactjs.org/docs/react-api.html

Rules triggered