react-native

Dependency profilecaution

Thirty runtime dependencies make the package operationally complex and increase transitive maintenance exposure, but this is reasonable for a full mobile framework.

Repo toolingcaution

The repository uses build tooling, but no security scanning tools were detected; the missing scanning coverage is a modest transparency gap rather than evidence of abandonment.

Security policycaution

No repository security policy was detected, leaving disclosure guidance unclear; the organization backing and active maintenance partly compensate but do not remove the gap.

Version stabilitycaution

Version 0.87.1 is not a prerelease, although the project remains below major version 1 and all recent releases are prereleases by the collected metric.

Workflow auditcaution

The audit found 108 of 117 action references unpinned, plus high-confidence template-injection and unpinned-image findings and secrets inheritance. No untrusted checkouts or script injections were found, and the reported trigger paths do not establish that those sinks share a workflow with pull_request_target or workflow_run.