Skip to main content
React Doctor scans React codebases for security, performance, correctness, and accessibility issues. CodeRabbit runs React Doctor on relevant changed files in a secure sandbox. CodeRabbit runs React Doctor v0.9.18.

​
Files

React Doctor runs on changed files with these extensions:
  • .jsx
  • .tsx
  • .ts
  • .js
React Doctor always scans changed .jsx and .tsx files. It scans changed .js and .ts files only when the nearest package.json declares a React dependency such as react, react-dom, react-native, preact, or @preact/compat. React Doctor skips .mjs and .cjs files even when a nearby package declares a React dependency.

​
Configuration

​
boolean
default:true
Enable React Doctor
.coderabbit.yaml
CodeRabbit supports these static React Doctor config files:
  • doctor.config.json
  • doctor.config.jsonc
  • react-doctor.config.json
CodeRabbit also reads reactDoctor configuration from package.json. If a package uses package.json configuration without a supported static config file, CodeRabbit writes a temporary doctor.config.json beside that package.json using the selected review profile. Static config files can use JSON5 syntax, so comments, trailing commas, single-quoted strings, and unquoted keys are all allowed. Each file must contain a JSON object. package.json must be standard JSON.

​
Profiles

These defaults apply when CodeRabbit generates a React Doctor config. Supported repository config files control their own rule settings.
  • Chill: Reports security findings and definite bug findings. Performance, accessibility, maintainability, design-tagged, and test-noise-tagged rules are disabled.
  • Assertive: Reports security findings as errors and bug findings at their React Doctor default severity. Performance and accessibility findings are errors when their default severity is error, and warnings otherwise. Maintainability and test-noise-tagged rules remain disabled.
CodeRabbit also disables these React Doctor rules in generated configs for both profiles:
  • react-doctor/no-vulnerable-react-server-components
  • react-doctor/no-barrel-import
  • react-doctor/nextjs-no-img-element
  • react-doctor/js-combine-iterations
  • react-doctor/prefer-module-scope-pure-function
  • react-doctor/prefer-module-scope-static-value
  • react-doctor/only-export-components
  • react-doctor/no-giant-component
  • react-doctor/no-multi-comp
CodeRabbit also filters the react-in-jsx-scope rule from review comments after parsing React Doctor output. The review profile also decides which diagnostic severities reach review comments, whether the config is generated or comes from the repository: Chill reports only errors and drops warnings, and Assertive reports both errors and warnings.

​
Security policy and restrictions

React Doctor runs inside the CodeRabbit sandbox with the sandbox-installed react-doctor package. CodeRabbit does not install project npm packages or run repository-supplied React Doctor plugins. Executable React Doctor config files are not supported:
  • doctor.config.ts
  • doctor.config.js
  • doctor.config.mjs
  • doctor.config.cjs
  • doctor.config.mts
  • doctor.config.cts
CodeRabbit skips React Doctor if a supported static config file or package.json reactDoctor configuration declares a non-empty plugins array. React Doctor dead-code analysis is disabled in CodeRabbit runs.

​
When we skip React Doctor

CodeRabbit skips React Doctor when:
  • React Doctor is disabled in CodeRabbit settings.
  • The pull request does not change a supported file type.
  • The changed files do not include JSX and no nearby package.json declares a React project dependency.
  • React Doctor is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
  • The repository contains an executable React Doctor config file.
  • A React Doctor config declares non-empty plugins.
  • A supported static config file is malformed or does not parse to an object.

​
What’s next

ESLint

Review how CodeRabbit runs ESLint for JavaScript, TypeScript, and framework files.

Oxlint

Learn how CodeRabbit runs Oxlint for JavaScript and TypeScript projects.

All supported tools

Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.