Reduce React Doctor false positives

[aidenybai]

Summary

• harden Three.js and R3F lifecycle, animation-loop, instancing, shader, resize, camera, and texture analysis
• improve JavaScript performance and async rules around stable receivers, intentional sequencing, fresh collections, and loop-local values
• refine security rules for safe DOM serialization, postMessage channels, and native bridge patterns
• add regression coverage for every confirmed detector failure and a patch changeset

Why

An exhaustive scan and source audit of 207 Thinky 3D viewer projects found 162 confirmed false-positive diagnostics. The detector assumptions did not consistently account for aliasing, stable lifecycle guards, non-escaping values, staged async work, or safe data-flow patterns.

The corpus now reports 712 diagnostics instead of 874. The remaining findings are direct rule-contract matches or evidence-required candidates; this does not claim that unknown false positives or false negatives are mathematically impossible.

Validation

• full test suite: 26,829 passed, 205 skipped
• focused regression suite: 196 passed
• staged React Doctor: 100/100, no findings
• lint
• typecheck: 16/16 tasks
• format check: 6,466 files
• build: 9/9 tasks
• JSON report smoke test
• exact scan of all 207 projects with no scanner stderr
• git diff --check

---

Note

Medium Risk
Touches security and performance detector logic (especially dangerous-html-sink and Three.js rules), so over-narrowing could hide real findings. Risk is tempered by pinned audit fixtures and broad regression coverage.

Overview
Reduces false positives across Three.js, JS performance, security, and async rules after an exhaustive audit of 207 Thinky 3D projects (163 confirmed FPs, 1 true positive).

Detectors now better recognize stable lifecycle guards, intentional async sequencing, non-escaping values, renderer aliases, and safe DOM data flows—cutting corpus diagnostics from 874 to 712.

Adds the pinned thinky-threejs-v14-audit exact-callsite corpus (regressions + one true positive), documents how to regenerate it, and ships a patch changeset.

^{Reviewed by Cursor Bugbot for commit 6b14d76. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1634

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1634

npm i https://pkg.pr.new/react-doctor@1634

commit: 6b14d76

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 6b14d76 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 90aa968. Configure here.}