React Audit Grep Patterns

React audit grep patterns

Select the correct bundled scan catalog for a React migration audit, preserve the verified grep syntax, and report findings consistently instead of relying on memory for fragile multi-line and context-flag patterns.

When to invoke

• "Run a React 18 migration audit."
• "Give me grep commands for React 19 removed APIs."
• "Scan this app for unsafe lifecycle methods and string refs."
• "Audit React tests for Enzyme and react-dom/test-utils."
• "Check React dependency and peer conflicts before upgrade."

Scan library map

Base patterns used across all scans

Use these exact base fragments unless the repository uses a different source root or extension set:

# Standard flags used throughout:
# -r = recursive
# -n = show line numbers
# -l = show filenames only (for counting affected files)
# --include="*.js" --include="*.jsx" = JS/JSX files only
# | grep -v "\.test\.\|\.spec\.\|__tests__" = exclude test files
# | grep -v "node_modules" = safety (usually handled by not scanning node_modules)
# 2>/dev/null = suppress "no files found" errors

# Source files only (exclude tests):
SRC_FLAGS='--include="*.js" --include="*.jsx"'
EXCLUDE_TESTS='grep -v "\.test\.\|\.spec\.\|__tests__"'

# Test files only:
TEST_FLAGS='--include="*.test.js" --include="*.test.jsx" --include="*.spec.js" --include="*.spec.jsx"'

Audit interpretation rules

Progressive disclosure and bundled resources

• references/react18-scans.md: full React 18.3.1 scan phases and summary script.
• references/react19-scans.md: full React 19 removed/deprecated API and test scan phases.
• references/test-scans.md: test-specific commands shared by both auditors.
• references/dep-scans.md: dependency, peer conflict, Enzyme, router, lockfile, and duplicate React commands.

Gotchas

• Do not rewrite the multi-line patterns from memory: batching scans rely on -A and -B context flags, then a second grep to locate nearby setState or await evidence.
• Counts are triage, not proof: inspect representative hits before claiming a file is safe or unsafe.
• Exclude tests intentionally: source scans and test scans answer different questions; do not mix them unless the reference says to.
• React 19 .propTypes is not a deletion command: runtime validation changes, but the standalone prop-types package can remain documentation/tooling.

Output template

## React audit grep result

**Status:** complete | partial | blocked
**Target:** React 18.3.1 | React 19 | tests | dependencies

| Scan area | Command source | Hits | Risk | Follow-up |
| --- | --- | --- | --- | --- |
| `<area>` | `references/<file>.md` | `<count or sample>` | Critical/High/Medium/Low | `<inspect/migrate/none>` |

### Commands run
```bash
<commands actually executed>
```

### Validation
- Reference files consulted: `<list>`
- Source root and extensions: `<src root and include flags>`

Quality gate

• The correct bundled reference was used for React 18.3.1, React 19, tests, or dependencies.
• SRC_FLAGS, EXCLUDE_TESTS, and TEST_FLAGS semantics were preserved or repository-specific changes were stated.
• Scan commands excluded node_modules and separated source files from test files where required.
• Multi-line async and batching scans kept their -A or -B context flags.
• Findings distinguish raw grep hits from confirmed migration defects.
• The output includes commands run, hit counts or samples, and follow-up actions.