@react-native/dev-middleware
Dev server middleware for React Native
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:connect | AI (dependencies): connect is a foundational, widely-used HTTP middleware framework; legitimate dependency for a dev-server middleware package. | ai | |
| dependencies | unvetted-dep:chrome-launcher | AI (dependencies): chrome-launcher is a standard, well-known utility for launching Chrome; appropriate for React Native dev tooling. | ai | |
| dependencies | unvetted-dep:@isaacs/ttlcache | AI (dependencies): TTL cache library from npm maintainer Isaac Schlueter; widely used and legitimate. | ai | |
| dependencies | unvetted-dep:chromium-edge-launcher | AI (dependencies): Standard browser-launching utility for Edge; appropriate for React Native dev tooling. | ai | |
| dependencies | unvetted-dep:@react-native/debugger-shell | AI (dependencies): First-party React Native monorepo package at matching version 0.85.2; consistent with coordinated monorepo release. | ai | |
| dependencies | unvetted-dep:@react-native/debugger-frontend | AI (dependencies): First-party React Native monorepo package at matching version 0.85.2; consistent with coordinated monorepo release. | ai |
Versions (showing 51 of 92)
| Version | Deps | Published |
|---|---|---|
| 0.86.2 | 12 / 4 | |
| 0.86.1 | 12 / 4 | |
| 0.86.0 | 12 / 4 | |
| 0.85.3 | 12 / 4 | |
| 0.85.2 | 12 / 4 | |
| 0.85.1 | 12 / 4 | |
| 0.85.0 | 12 / 4 | |
| 0.84.1 | 12 / 4 | |
| 0.84.0 | 12 / 4 | |
| 0.83.10 | 12 / 4 | |
| 0.83.9 | 12 / 4 | |
| 0.83.8 | 12 / 4 | |
| 0.83.7 | 12 / 4 | |
| 0.83.6 | 12 / 4 | |
| 0.83.5 | 12 / 4 | |
| 0.83.4 | 12 / 4 | |
| 0.83.3 | 12 / 4 | |
| 0.83.2 | 12 / 4 | |
| 0.83.1 | 12 / 4 | |
| 0.83.0 | 12 / 4 | |
| 0.82.1 | 12 / 4 | |
| 0.82.0 | 12 / 4 | |
| 0.81.6 | 11 / 3 | |
| 0.81.5 | 11 / 3 | |
| 0.81.4 | 11 / 3 | |
| 0.81.3 | 11 / 3 | |
| 0.81.2 | 11 / 3 | |
| 0.81.1 | 11 / 3 | |
| 0.81.0 | 11 / 3 | |
| 0.80.3 | 11 / 3 | |
| 0.80.2 | 11 / 3 | |
| 0.80.1 | 11 / 3 | |
| 0.80.0 | 11 / 3 | |
| 0.79.7 | 11 / 3 | |
| 0.79.6 | 11 / 3 | |
| 0.79.5 | 11 / 3 | |
| 0.79.4 | 11 / 3 | |
| 0.79.3 | 11 / 3 | |
| 0.79.2 | 11 / 3 | |
| 0.79.1 | 11 / 3 | |
| 0.79.0 | 11 / 3 | |
| 0.78.3 | 12 / 3 | |
| 0.78.2 | 12 / 3 | |
| 0.78.1 | 12 / 3 | |
| 0.78.0 | 12 / 3 | |
| 0.77.3 | 12 / 3 | |
| 0.77.2 | 12 / 3 | |
| 0.77.1 | 12 / 3 | |
| 0.77.0 | 11 / 3 | |
| 0.76.9 | 12 / 3 | |
| 0.76.8 | 12 / 3 |
v0.86.2
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (react-native-bot) on unknown date, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.86.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.79.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.79.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.77.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.77.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.77.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.