{"_id":"@amit1392/rn-dep-scanner","_rev":"2-9b766a77c0fed3d5fdd319aea19f8f94","name":"@amit1392/rn-dep-scanner","dist-tags":{"latest":"1.1.0"},"versions":{"1.1.0":{"name":"@amit1392/rn-dep-scanner","version":"1.1.0","keywords":["react-native","reactnative","dependencies","dependency-check","compatibility","npm","cli","mobile"],"author":{"name":"amit13091992@gmail.com"},"license":"MIT","_id":"@amit1392/rn-dep-scanner@1.1.0","maintainers":[{"name":"amit1392","email":"amit13091992@gmail.com"}],"bin":{"rn-dep-scanner":"dist/index.js"},"dist":{"shasum":"d18c0f34161c4829239876015d7dc0bf80f7627f","tarball":"https://registry.npmjs.org/@amit1392/rn-dep-scanner/-/rn-dep-scanner-1.1.0.tgz","fileCount":103,"integrity":"sha512-lMgbmZUufqZSWs/ZP9J7lN1mWCI15U0ejht00fqt7AQxO4jA2LSKYD3gBxG59xpARzr6QIeZqqCcwN71pPL4eQ==","signatures":[{"sig":"MEYCIQCM8Atqyj7hhomYmRB201ih7OuTaD5L0QBEe/rtyttRfgIhAIUvfWE0dPEbocVcFLLxeCCj35/14eR3bmEvQk706VmU","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":181266},"main":"dist/index.js","type":"module","types":"./dist/index.d.ts","engines":{"node":">=18.0.0"},"gitHead":"4705cf241497525b7fde21a73b5fbcd721a33c2f","scripts":{"dev":"tsx src/index.ts","test":"tsx --test test/**/*.test.ts","build":"tsc","prepare":"npm run build"},"_npmUser":{"name":"amit1392","email":"amit13091992@gmail.com"},"_npmVersion":"11.12.1","description":"React Native dependency scanner - compatibility, breaking changes & security vulnerabilities","directories":{},"_nodeVersion":"24.15.0","dependencies":{"ora":"^9.4.1","chalk":"^6.0.0","semver":"^7.8.5","commander":"^15.0.0"},"preferGlobal":true,"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.12","typescript":"^7.0.2","@types/node":"^26.3.0","@types/semver":"^7.8.0"},"_npmOperationalInternal":{"tmp":"tmp/rn-dep-scanner_1.1.0_1787925073987_0.7450321827620057","host":"s3://npm-registry-packages-npm-production"},"deprecated":"Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."}},"time":{"created":"2026-08-28T13:51:13.737Z","modified":"2026-09-08T19:32:31.856Z","1.1.0":"2026-08-28T13:51:14.129Z"},"author":{"name":"amit13091992@gmail.com"},"license":"MIT","keywords":["react-native","reactnative","dependencies","dependency-check","compatibility","npm","cli","mobile"],"description":"React Native dependency scanner - compatibility, breaking changes & security vulnerabilities","maintainers":[{"name":"amit1392","email":"amit13091992@gmail.com"}],"readme":"# rn-dep-scanner\n\nA comprehensive React Native dependency scanner that detects compatibility issues, breaking changes, and security vulnerabilities in your project.\n\n## Features\n\n- **Compatibility Analysis** — Detects version mismatches with React and React Native\n- **Breaking Change Detection** — Alerts on major breaking changes in dependencies\n- **Security Vulnerability Scanning** — Identifies known CVEs and security issues (powered by OSV.dev)\n- **Resolved Version Detection** — Analyzes actual installed versions from lock files\n- **Package Manager Detection** — Supports npm, yarn, pnpm, and bun\n- **JSON Output** — Machine-readable output for CI/CD integration\n- **Strict Mode** — Exit codes for automated quality gates\n\n## What's New in v1.1\n\n✅ **OSV.dev Integration** — Real-time vulnerability data instead of hardcoded CVEs  \n✅ **Proper Version Comparison** — Fixed semantic versioning bugs (was using string comparison)  \n✅ **Lockfile Parsing** — Extracts resolved versions from npm package-lock.json  \n✅ **Clear Compatibility Status** — Distinguishes \"not checked\" from \"compatible\"  \n✅ **Security References** — Each finding includes CVE/GHSA IDs and source URLs  \n✅ **Offline Mode** — Local cache with 24-hour TTL for when OSV is unavailable\n\n## Installation\n\n```bash\nnpm install -g rn-dep-scanner\n```\n\nOr use with `npx`:\n\n```bash\nnpx rn-dep-scanner\n```\n\n## Usage\n\n### Basic Check\n\n```bash\nrn-dep-scanner check\n```\n\nOutput:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n   RN Deps Scanner\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nEnvironment\n───────────\n✓ React Native: 0.83.0\n✓ React: 19.2.0\nℹ Package Manager: npm\n\nAnalyzing Dependencies\n──────────────────────\n\nBreaking Changes\n────────────────\n⚠️  CRITICAL  react-native-reanimated@4.1.0\n  • Removed Animated API compatibility\n  • Changed worklet syntax and compilation\n\nSecurity Vulnerabilities\n────────────────────────\n🔒 react-native-webview@11.25.0\n  🔴 CVE-2023-9999: XSS vulnerability in postMessage API\n     Fix: upgrade to 11.26.0\n\nSummary\n───────\n8 dependencies checked\n8 compatible\n⚡ Breaking changes detected: 1\n🔒 Security vulnerabilities: 1\n```\n\n### JSON Output\n\nFor CI/CD integration:\n\n```bash\nrn-dep-scanner check --json\n```\n\nReturns:\n\n```json\n{\n  \"reactNative\": {\n    \"current\": \"0.83.0\"\n  },\n  \"react\": {\n    \"current\": \"19.2.0\"\n  },\n  \"packageManager\": \"npm\",\n  \"summary\": {\n    \"total\": 8,\n    \"compatible\": 8,\n    \"warnings\": 0,\n    \"errors\": 0,\n    \"breakingChanges\": 1,\n    \"securityVulnerabilities\": 1\n  },\n  \"issues\": [],\n  \"breakingChanges\": [\n    {\n      \"package\": \"react-native-reanimated\",\n      \"version\": \"4.1.0\",\n      \"severity\": \"critical\",\n      \"changes\": [\n        \"Removed Animated API compatibility\",\n        \"Changed worklet syntax and compilation\",\n        \"Modified gesture handler integration\"\n      ]\n    }\n  ],\n  \"securityVulnerabilities\": [\n    {\n      \"package\": \"react-native-webview\",\n      \"version\": \"11.25.0\",\n      \"vulnerabilities\": [\n        {\n          \"id\": \"CVE-2023-9999\",\n          \"severity\": \"critical\",\n          \"description\": \"XSS vulnerability in postMessage API\",\n          \"affectedVersions\": [\"<11.26.0\"],\n          \"fixedVersion\": \"11.26.0\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n### Strict Mode\n\nExit with code 1 if there are errors or critical issues:\n\n```bash\nrn-dep-scanner check --strict\n```\n\n### Custom Working Directory\n\nCheck a specific directory:\n\n```bash\nrn-dep-scanner check --cwd /path/to/project\n```\n\n## Scanned Packages\n\nThe tool includes compatibility rules and breaking change detection for:\n\n- `react-native` (0.71, 0.72, 0.73+)\n- `react-native-reanimated` (3.x, 4.x)\n- `react-native-screens` (3.x, 4.x)\n- `react-native-gesture-handler` (2.x, 3.x)\n- `react-native-safe-area-context` (4.x)\n- `react-native-vector-icons` (10.x)\n- `@react-navigation/native` (6.x, 7.x)\n- `@react-native-async-storage/async-storage` (1.x)\n- `react-native-vision-camera` (3.x, 4.x)\n- `react-native-webview` (11.x)\n- `axios`, `lodash`, and more\n\n## How It Works\n\n1. **Environment Detection** — Reads `package.json` to find React Native and React versions\n2. **Lockfile Resolution** — Parses npm lock files to extract resolved dependency versions (not just ranges)\n3. **Dependency Analysis** — Scans all dependencies with actual installed versions\n4. **Compatibility Checking** — Validates version compatibility using proper semantic versioning\n5. **Breaking Change Detection** — Alerts on major version changes with breaking API modifications\n6. **Security Scanning** — Fetches vulnerability data from OSV.dev with local caching and fallback\n7. **Report Generation** — Displays issues in readable format or JSON\n\n## Security Data\n\nAs of v1.1.0, security vulnerability detection uses:\n- **Primary**: OSV.dev API for real-time vulnerability data (authoritative, community-maintained)\n- **Fallback**: Local database for offline mode (updated with major releases)\n- **Caching**: 24-hour TTL cache stored in `~/.rn-scanner-cache/`\n\nThis ensures accurate, trustworthy vulnerability reporting instead of hardcoded CVE lists.\n\n## Resolved vs Requested Versions\n\nThe scanner now distinguishes between:\n- **Requested Version** — What's specified in `package.json` (e.g., `^1.2.3`)\n- **Resolved Version** — What's actually installed per lockfile (e.g., `1.2.5`)\n\nSecurity and compatibility checks operate on resolved versions for accuracy.\n\n## Scripts\n\n```bash\nnpm run dev      # Run in development mode\nnpm run build    # Build TypeScript to JavaScript\nnpm run test     # Run tests\nnpm run prepare  # Pre-publish build\n```\n\n## Development\n\nClone and install:\n\n```bash\ngit clone <repo>\ncd rn-dep-scanner\nnpm install\n```\n\nRun in development:\n\n```bash\nnpm run dev check\n```\n\nBuild:\n\n```bash\nnpm run build\n```\n\n## License\n\nMIT\n\n## Contributing\n\nContributions welcome! Please submit pull requests with additional compatibility rules, breaking changes, or vulnerability data.\n","readmeFilename":"README.md"}