You should add the entire JS runtime you have to ship along React to that attack surface.