@callstack/react-native-visionos

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:eval-usage	AI (semgrep): Upstream React Native dev-server bundle loading pattern; eval is intentional and scoped to dev tooling.	ai	2026/05/23
semgrep	semgrep:child-process-import	AI (semgrep): CLI wrapper legitimately uses child_process to spawn React Native tooling; stable pattern for this package.	ai	2026/05/23
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require resolves @react-native-community/cli at runtime; standard RN CLI delegation pattern.	ai	2026/05/23
phantom-deps	phantom-dep:ws	AI (phantom-deps): ws is a declared dependency used transitively in RN's WebSocket/Metro infrastructure; config-file reference is expected.	ai	2026/05/23
phantom-deps	phantom-dep:babel-jest	AI (phantom-deps): Referenced in jest-preset config files; standard RN ecosystem pattern.	ai	2026/05/23
phantom-deps	phantom-dep:flow-enums-runtime	AI (phantom-deps): Flow runtime dep referenced in config; standard for RN packages using Flow.	ai	2026/05/23
phantom-deps	phantom-dep:@react-native/gradle-plugin	AI (phantom-deps): Platform-specific Gradle plugin; not directly imported in JS but legitimately declared.	ai	2026/05/23
phantom-deps	phantom-dep:babel-plugin-syntax-hermes-parser	AI (phantom-deps): Babel config reference; standard RN/Hermes parser plugin pattern.	ai	2026/05/23

Version	Deps	Published
0.79.6	36 / 0	2025-08-23