@react-native/metro-config

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package, which can make package ownership less transparent. The organization-backed React Native monorepo context partly compensates, but the missing explicit mention remains a caution.

Repo toolingcaution

The repository uses Babel, TypeScript, and npm build tooling. No security-scanning tools were detected, leaving a modest security-process gap in an otherwise established build setup.

Security policycaution

The repository has no SECURITY.md or other detected security policy. This reduces transparency for reporting vulnerabilities, though the active organization-backed project provides substantial compensating maintenance evidence.

Token permissionscaution

Eleven workflows lack top-level permissions and eight declare top-level write access. Although some workflows are read-only and no untrusted checkout was detected, the broad write-permission profile is a real repository-hardening concern.

Version stabilitycaution

Version 0.87.1 is not marked prerelease, but all recent releases are reported in the prerelease-share measure, so the package remains outside a stable major-version line. This is a modest compatibility caveat rather than an abandonment concern.