nativekeel 0.1.3 → 0.1.5

package/bin/nativekeel.js

@@ -156,7 +156,9 @@ async function main() {
   return result.findings.some((f) => SEVERITIES.indexOf(f.severity) <= threshold) ? 1 : 0;
 }
 
+// Exit only after stdout has flushed: process.exit() right after a large write to a pipe
+// cuts the output off at 8 KB (`npx nativekeel --json | jq` got broken JSON).
 main().then(
-  (code) => process.exit(code),
+  (code) => process.stdout.write('', () => process.exit(code)),
   (e) => fail(e.stack || e.message),
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Health check for React Native apps: version support, New Architecture blockers, unmaintained native modules and leaked secrets.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -1,11 +1,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { cleanVersion, findPackageDir, installedVersion } from './project.js';
-import { createRegistry } from './registry.js';
+import { createRegistry, fetchJson } from './registry.js';
 import { scanSecrets } from './secrets.js';
 import { nativeChecks } from './native.js';
-import { findUnused } from './usage.js';
-import { matchKnownIssues } from './known-issues.js';
+import { findUnused, filesImportingWith } from './usage.js';
+import { matchKnownIssues, compareVersions } from './known-issues.js';
 import { COMPAT, bestRange, checkCompat } from './compat.js';
 import { interopProblems } from './interop.js';
 import {
@@ -47,13 +47,36 @@ function isNativeModule(root, name, dir) {
       return false;
     }
   }
-  // Without node_modules, trust React Native Directory's platform flags.
+  // Without node_modules, ask React Native Directory. Its ios/android flags mean "works on",
+  // not "has native code" (pure JS packages set them too), so prefer its hasNativeCode.
+  if (dir && dir.github && typeof dir.github.hasNativeCode === 'boolean') return dir.github.hasNativeCode;
   return !!(dir && (dir.ios || dir.android) && !dir.web);
 }
 
+function readJsonFile(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// Expo's pins are ~x.y.z (same minor), ^x.y.z (same major), or an exact version.
+export function satisfiesExpoRange(version, range) {
+  const m = String(range).trim().match(/^([~^]?)\s*(\d+)\.(\d+)\.(\d+)/);
+  if (!m) return true; // a range we do not understand: do not second-guess Expo
+  const [maj, min] = version.split('.').map(Number);
+  if (compareVersions(version, `${m[2]}.${m[3]}.${m[4]}`) < 0) return false;
+  if (m[1] === '^') return maj === Number(m[2]);
+  if (m[1] === '~') return maj === Number(m[2]) && min === Number(m[3]);
+  return compareVersions(version, `${m[2]}.${m[3]}.${m[4]}`) === 0;
+}
+
 // `offline: true` means the user asked for no network access (get returns nothing).
 export async function analyze(project, { get, now = new Date(), offline: forcedOffline = false } = {}) {
-  const registry = createRegistry(get);
+  // Requests that failed even after retries (rate limits, network): reported, never hidden.
+  const net = { failed: 0 };
+  const registry = createRegistry(get || ((url, headers) => fetchJson(url, headers, net)));
   const findings = [];
   const add = (f) => findings.push(f);
 
@@ -74,14 +97,35 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   if (!project.hasNodeModules) {
     warnings.push('node_modules not found: versions are read from package.json ranges and native detection is less accurate. Install dependencies for a precise report.');
   }
+  const rnSpec = project.deps['react-native'] || project.devDeps['react-native'];
+  if (!project.rnVersion && rnSpec) {
+    warnings.push(`React Native is declared as "${rnSpec}", which has no version number (a git fork or a workspace reference). Install dependencies so NativeKeel can read the installed version; version checks were skipped.`);
+  }
+  if (project.isLibrary) {
+    warnings.push('This looks like a React Native library, not an app (react-native is a peer dependency, or android/ builds a library). App Store and Google Play checks were skipped; scan the app that uses it for those.');
+  }
+  const reportIncomplete = () => {
+    if (net.failed && !offline) warnings.push(`${net.failed} request${net.failed === 1 ? '' : 's'} to npm or React Native Directory failed (rate limit or network), so some dependency checks may be missing. Run again in a few minutes.`);
+  };
   if (!offline && project.rnVersion && !rn) warnings.push('Could not fetch React Native releases from npm; version and New Architecture checks were skipped. Run again.');
   if (!offline && project.expoVersion && !expo) warnings.push('Could not fetch Expo releases from npm; the SDK check was skipped. Run again.');
 
   // 1. React Native version support
   const current = project.rnVersion;
+  // In an Expo project the SDK pins React Native: upgrading the SDK is how React Native moves,
+  // so the Expo finding carries the severity and this one only explains the link.
+  const rnFollowsExpo = !!(project.expoVersion && expo);
   if (rn && current) {
     const behind = rn.lines[0] - minorOf(current);
-    if (behind >= SUPPORTED_RN_MINORS) {
+    if (rnFollowsExpo && behind > 0) {
+      add({
+        id: 'rn-via-expo',
+        severity: 'info',
+        area: 'react-native',
+        title: `React Native ${current} comes with Expo SDK ${majorOf(project.expoVersion)}`,
+        detail: `Latest React Native is ${rn.latest} (${behind} minor${behind === 1 ? '' : 's'} behind). Upgrading the Expo SDK upgrades React Native with it.`,
+      });
+    } else if (behind >= SUPPORTED_RN_MINORS) {
       add({
         id: 'rn-unsupported',
         severity: behind >= CRITICAL_RN_MINORS_BEHIND ? 'critical' : 'high',
@@ -102,14 +146,16 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
     }
 
     // 2. New Architecture
-    const off = ['android', 'ios'].filter((p) => project.newArch[p] === false);
+    // Not set means the default: off before 0.76, on from 0.76.
+    const unset = minorOf(current) < 76 ? ['android', 'ios'].filter((p) => project.newArch[p] === null) : [];
+    const off = ['android', 'ios'].filter((p) => project.newArch[p] === false || unset.includes(p));
     if (minorOf(current) < NEW_ARCH_ONLY_MINOR && off.length && rn.lines[0] >= NEW_ARCH_ONLY_MINOR) {
       add({
         id: 'new-arch-disabled',
         severity: 'critical',
         area: 'new-architecture',
-        title: `New Architecture is disabled (${off.join(' + ')})`,
-        detail: `The legacy architecture was removed in 0.${NEW_ARCH_ONLY_MINOR}. This app cannot upgrade past 0.${NEW_ARCH_ONLY_MINOR - 1} until it migrates.`,
+        title: `New Architecture is ${unset.length === off.length ? 'off' : 'disabled'} (${off.join(' + ')})`,
+        detail: `${unset.length ? `Not set, and before React Native 0.76 the default is off. ` : ''}The legacy architecture was removed in 0.${NEW_ARCH_ONLY_MINOR}. This app cannot upgrade past 0.${NEW_ARCH_ONLY_MINOR - 1} until it migrates.`,
         fix: { kind: 'enable-new-arch', platforms: off },
       });
     }
@@ -140,7 +186,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   }
 
   // 4. Google Play target SDK
-  const target = project.android && project.android.targetSdk;
+  const target = !project.isLibrary && project.android && project.android.targetSdk;
   if (target) {
     const today = now.toISOString().slice(0, 10);
     const { updates, visibility } = PLAY_TARGET_SDK;
@@ -173,11 +219,16 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   const published = forcedOffline ? {} : await registry.publishDates(recencyCandidates);
   const daysSince = (date) => (date ? Math.floor((now - new Date(`${date}T00:00:00Z`)) / 86400000) : null);
 
+  const nativeOf = Object.fromEntries(names.map((n) => [n, isNativeModule(project.root, n, directory[n])]));
+  const versionOf = (n) => cleanVersion(installedVersion(project.root, n) || declaredRange(n));
+  const archSuspects = names.filter((n) => nativeOf[n] && directory[n] && directory[n].newArchitecture === false);
+  const codegen = forcedOffline ? {} : await registry.codegenSupport(archSuspects.map((n) => ({ name: n, version: versionOf(n) })));
+
   const deps = [];
   for (const name of names) {
     const dir = directory[name];
-    const version = cleanVersion(installedVersion(project.root, name) || declaredRange(name));
-    const native = isNativeModule(project.root, name, dir);
+    const version = versionOf(name);
+    const native = nativeOf[name];
     const release = published[name] || {};
     const age = daysSince(release.date);
     const revived = !!(dir && dir.unmaintained && age !== null && age <= RECENT_RELEASE_DAYS);
@@ -192,7 +243,22 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
     };
     deps.push(dep);
 
-    const noNewArch = native && dir && dir.newArchitecture === false;
+    const cg = codegen[name];
+    // Directory says no New Architecture, but npm may know better.
+    const archFixedIn = native && dir && dir.newArchitecture === false && cg && !cg.usedHas && cg.latestHas ? cg.latest : null;
+    const noNewArch = native && dir && dir.newArchitecture === false && !(cg && (cg.usedHas || cg.latestHas));
+    if (cg && cg.usedHas) dep.newArch = true;
+    if (archFixedIn) {
+      add({
+        id: `dep-risk:${name}`,
+        severity: 'medium',
+        area: 'dependency',
+        title: `${name} ${version || ''}: New Architecture support needs ${archFixedIn}`.replace('  ', ' '),
+        detail: `React Native Directory lists it without New Architecture support, but ${archFixedIn} ships a codegen spec. Update to ${archFixedIn} (check its changelog for breaking changes) instead of replacing it.`,
+        fix: { kind: 'bump-dep', name, from: version, to: archFixedIn, native },
+      });
+      continue;
+    }
     // Only code that has to follow React Native or the OS goes stale; a finished JS utility does not.
     const stale = !dep.unmaintained && !revived && age !== null && age > STALE_RELEASE_DAYS && (native || !!release.rnLink);
     const alternatives = dir && dir.alternatives && dir.alternatives.length ? dir.alternatives : REPLACEMENTS[name] || [];
@@ -257,35 +323,54 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
   const newArchOn = project.newArch.android !== false && project.newArch.ios !== false && minorOf(current || '0.0') >= 76;
   // The legacy architecture ends at 0.81, so any older app with it off has to migrate; this
   // holds even when the latest release could not be fetched (offline).
-  const archOff = project.newArch.android === false || project.newArch.ios === false;
+  const archOff = project.newArch.android === false || project.newArch.ios === false || (!!current && minorOf(current) < 76 && (project.newArch.android === null || project.newArch.ios === null));
   const newArchRequired =
     findings.some((f) => f.id === 'new-arch-disabled') || (archOff && current && minorOf(current) < NEW_ARCH_ONLY_MINOR);
   for (const { issue, dep } of matchKnownIssues({ deps, rnVersion: current, newArchOn, newArchRequired })) {
+    let { severity, title, detail } = issue;
+    if (issue.evidence) {
+      const files = filesImportingWith(project.root, issue.evidence.imports, issue.evidence.pattern);
+      if (files.length) {
+        detail = `Found in ${files.slice(0, 3).join(', ')}${files.length > 3 ? ` and ${files.length - 3} more` : ''}. ${detail}`;
+      } else {
+        ({ severity, title, detail } = { ...issue, ...issue.withoutEvidence });
+      }
+    }
     add({
       id: `known:${issue.id}`,
-      severity: issue.severity,
+      severity,
       area: 'dependency',
-      title: issue.title,
-      detail: `${issue.detail} (installed: ${dep.name} ${dep.version}; seen in: ${issue.source})`,
-      fix: { kind: 'known-issue', name: dep.name, title: issue.title, detail: issue.detail },
+      title,
+      detail: `${detail} (installed: ${dep.name} ${dep.version}; seen in: ${issue.source})`,
+      fix: { kind: 'known-issue', name: dep.name, title, detail },
     });
   }
 
   // Library ↔ React Native compatibility, from the libraries' own tables.
+  // Expo SDKs pin tested versions of these libraries (bundledNativeModules.json). A version
+  // inside Expo's range is a combination Expo ships, even where the library's table is stricter.
+  const expoDir = project.expoVersion ? findPackageDir(project.root, 'expo') : null;
+  const expoPins = expoDir ? readJsonFile(path.join(expoDir, 'bundledNativeModules.json')) : null;
+  const expoSdk = project.expoVersion ? majorOf(project.expoVersion) : null;
   if (current) {
     const rnMinor = minorOf(current);
     for (const dep of deps.filter((d) => COMPAT[d.name])) {
+      const pinned = expoPins && expoPins[dep.name];
+      if (pinned && dep.version && satisfiesExpoRange(dep.version, pinned)) continue;
       const problem = checkCompat(dep.name, dep.version, rnMinor, newArchOn);
       // Also check the architecture this app has to move to.
       const ahead = !problem && newArchRequired ? checkCompat(dep.name, dep.version, rnMinor, true) : null;
       if (!problem && !ahead) continue;
       const best = bestRange(dep.name, rnMinor, problem ? newArchOn : true);
+      let expoNote = '';
+      if (pinned) expoNote = ` Expo SDK ${expoSdk} expects ${pinned}: run \`npx expo install --fix\`.`;
+      else if (expoSdk) expoNote = ` Expo SDK ${expoSdk} pins a tested version of this package; \`npx expo install --check\` shows whether yours matches (install dependencies for a precise check).`;
       add({
         id: `compat:${dep.name}`,
-        severity: problem ? 'high' : 'medium',
+        severity: problem && !(expoSdk && !pinned) ? 'high' : 'medium',
         area: 'dependency',
         title: problem || `${ahead} (needed for the New Architecture)`,
-        detail: `${best ? `Use ${dep.name} ${best.range} on React Native ${current}. ` : ''}Source: ${COMPAT[dep.name].source}.${COMPAT[dep.name].note ? ` ${COMPAT[dep.name].note}` : ''}`,
+        detail: `${best ? `Use ${dep.name} ${best.range} on React Native ${current}. ` : ''}Source: ${COMPAT[dep.name].source}.${COMPAT[dep.name].note ? ` ${COMPAT[dep.name].note}` : ''}${expoNote}`,
         fix: { kind: 'compat', name: dep.name, range: best && best.range, forNewArch: !problem },
       });
     }
@@ -322,6 +407,15 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
         detail: `${value}Anyone who downloads the app can extract it. Revoke it now, then move the call to a server.`,
         fix: { kind: 'secret', label: s.label, file: s.file, line: s.line, bundled: true },
       });
+    } else if (s.committed !== false && s.inComment) {
+      add({
+        id: `secret:${s.rule}:${s.file}`,
+        severity: 'medium',
+        area: 'secret',
+        title: `${s.label} in a commented-out line (${where})`,
+        detail: `${value}Comments are not shipped in the app, but the line is in the repository and its git history. If the value is real, rotate it; either way, delete the line.`,
+        fix: { kind: 'secret', label: s.label, file: s.file, line: s.line, bundled: false },
+      });
     } else if (s.committed !== false) {
       add({
         id: `secret:${s.rule}:${s.file}`,
@@ -334,6 +428,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
     }
   }
 
+  reportIncomplete();
   findings.sort((a, b) => SEVERITIES.indexOf(a.severity) - SEVERITIES.indexOf(b.severity));
   return {
     tool: 'nativekeel',

package/src/compat.js

@@ -7,7 +7,7 @@ import { compareVersions } from './known-issues.js';
 
 export const COMPAT = {
   'react-native-screens': {
-    source: 'https://github.com/software-mansion/react-native-screens#support-for-fabric (checked 2026-10-03)',
+    source: 'https://github.com/software-mansion/react-native-screens#support-for-fabric (checked 2026-10-04)',
     newArch: [
       { from: '4.0.0', to: '4.4.99', rnMin: 76 },
       { from: '4.5.0', to: '4.13.99', rnMin: 77 },
@@ -26,9 +26,13 @@ export const COMPAT = {
     ],
   },
   'react-native-gesture-handler': {
-    source: 'https://github.com/software-mansion/react-native-gesture-handler#gesture-handler-2 (checked 2026-10-03)',
+    source: 'https://github.com/software-mansion/react-native-gesture-handler#react-native-support (Gesture Handler 2 table; 3.x needs 0.82+; checked 2026-10-04)',
     note: 'Gesture Handler supports the three latest React Native minors; the table gives minimums.',
     newArch: [
+      { from: '2.0.0', to: '2.9.99', rnMin: 63 },
+      { from: '2.10.0', to: '2.13.99', rnMin: 64 },
+      { from: '2.14.0', to: '2.15.99', rnMin: 67 },
+      { from: '2.16.0', to: '2.17.99', rnMin: 68 },
       { from: '2.18.0', to: '2.20.99', rnMin: 73 },
       { from: '2.21.0', to: '2.23.99', rnMin: 74 },
       { from: '2.24.0', to: '2.24.99', rnMin: 75 },
@@ -39,6 +43,10 @@ export const COMPAT = {
       { from: '3.0.0', rnMin: 82 },
     ],
     legacy: [
+      { from: '2.0.0', to: '2.9.99', rnMin: 63 },
+      { from: '2.10.0', to: '2.13.99', rnMin: 64 },
+      { from: '2.14.0', to: '2.15.99', rnMin: 67 },
+      { from: '2.16.0', to: '2.17.99', rnMin: 68 },
       { from: '2.18.0', to: '2.20.99', rnMin: 73 },
       { from: '2.21.0', to: '2.23.99', rnMin: 74 },
       { from: '2.24.0', to: '2.24.99', rnMin: 75 },
@@ -49,7 +57,8 @@ export const COMPAT = {
     ],
   },
   'react-native-reanimated': {
-    source: 'https://docs.swmansion.com/react-native-reanimated/docs/guides/compatibility/ and /docs/3.x/guides/compatibility/ (checked 2026-10-03)',
+    source: 'Reanimated compatibility.json, the data behind docs.swmansion.com/react-native-reanimated/docs/guides/compatibility (rows assume the latest patch of each minor)',
+    // Generated by scripts/reanimated-compat.mjs on 2026-10-04 from https://raw.githubusercontent.com/software-mansion/react-native-reanimated/main/packages/react-native-reanimated/compatibility.json
     newArch: [
       { from: '3.0.0', to: '3.0.99', rnMin: 71, rnMax: 71 },
       { from: '3.1.0', to: '3.5.99', rnMin: 72, rnMax: 72 },
@@ -60,22 +69,32 @@ export const COMPAT = {
       { from: '3.17.0', to: '3.17.99', rnMin: 75, rnMax: 79 },
       { from: '3.18.0', to: '3.18.99', rnMin: 75, rnMax: 80 },
       { from: '3.19.0', to: '3.19.99', rnMin: 78, rnMax: 81 },
-      { from: '4.0.0', to: '4.1.99', rnMin: 78, rnMax: 81 },
-      { from: '4.2.0', to: '4.3.99', rnMin: 80, rnMax: 84 },
-      { from: '4.4.0', to: '4.5.99', rnMin: 83, rnMax: 86 },
-      { from: '4.6.0', to: '4.6.99', rnMin: 83, rnMax: 88 },
-      { from: '4.7.0', to: '4.8.99', rnMin: 86, rnMax: 88 },
+      { from: '4.0.0', to: '4.0.99', rnMin: 78, rnMax: 81 },
+      { from: '4.1.0', to: '4.1.99', rnMin: 78, rnMax: 82 },
+      { from: '4.2.0', to: '4.2.99', rnMin: 80, rnMax: 84 },
+      { from: '4.3.0', to: '4.3.99', rnMin: 81, rnMax: 85 },
+      { from: '4.4.0', to: '4.4.99', rnMin: 83, rnMax: 86 },
+      { from: '4.5.0', to: '4.5.99', rnMin: 83, rnMax: 86 },
+      { from: '4.6.0', to: '4.6.99', rnMin: 83, rnMax: 87 },
+      { from: '4.7.0', to: '4.7.99', rnMin: 86, rnMax: 88 },
+      { from: '4.8.0', to: '4.8.99', rnMin: 86, rnMax: 88 },
     ],
     legacy: [
+      { from: '2.3.0', to: '2.4.99', rnMin: 63, rnMax: 67 },
+      { from: '2.5.0', to: '2.9.99', rnMin: 63, rnMax: 68 },
+      { from: '2.10.0', to: '2.10.99', rnMin: 63, rnMax: 69 },
+      { from: '2.11.0', to: '2.13.99', rnMin: 63, rnMax: 70 },
+      { from: '2.14.0', to: '2.17.99', rnMin: 63, rnMax: 71 },
       { from: '3.0.0', to: '3.2.99', rnMin: 63, rnMax: 71 },
       { from: '3.3.0', to: '3.4.99', rnMin: 63, rnMax: 72 },
-      { from: '3.5.0', to: '3.5.99', rnMin: 66, rnMax: 71 },
-      { from: '3.6.0', to: '3.8.99', rnMin: 66, rnMax: 72 },
-      { from: '3.9.0', to: '3.15.99', rnMin: 70, rnMax: 73 },
-      { from: '3.16.0', to: '3.16.99', rnMin: 71, rnMax: 77 },
-      { from: '3.17.0', to: '3.17.99', rnMin: 73, rnMax: 79 },
-      { from: '3.18.0', to: '3.18.99', rnMin: 73, rnMax: 80 },
-      { from: '3.19.0', to: '3.19.99', rnMin: 77, rnMax: 81 },
+      { from: '3.5.0', to: '3.5.99', rnMin: 66, rnMax: 72 },
+      { from: '3.6.0', to: '3.8.99', rnMin: 66, rnMax: 73 },
+      { from: '3.9.0', to: '3.14.99', rnMin: 71, rnMax: 74 },
+      { from: '3.15.0', to: '3.15.99', rnMin: 72, rnMax: 75 },
+      { from: '3.16.0', to: '3.16.99', rnMin: 74, rnMax: 77 },
+      { from: '3.17.0', to: '3.17.99', rnMin: 75, rnMax: 79 },
+      { from: '3.18.0', to: '3.18.99', rnMin: 75, rnMax: 80 },
+      { from: '3.19.0', to: '3.19.99', rnMin: 78, rnMax: 81 },
       { from: '4.0.0', unsupported: true },
     ],
     note: 'Reanimated 4 also needs react-native-worklets; Reanimated 3.x is no longer actively maintained.',

package/src/known-issues.js

@@ -38,9 +38,19 @@ export const KNOWN_ISSUES = [
     rnFrom: 76,
     when: 'newArch',
     severity: 'high',
-    title: 'react-native-linear-gradient 2.x crashes the New Architecture when a screen unmounts',
-    detail: "2.x has no Fabric component, so BVLinearGradient runs through the interop layer. Its children are not detached before React Native recycles them: \"RCTComponentViewRegistry: Attempt to recycle a mounted view\" (an abort on iOS, right after login in the app where it was found). React Native 0.76+ draws gradients itself: replace it with a small component that sets experimental_backgroundImage: 'linear-gradient(...)' and drop the native package.",
-    source: 'real upgrade of an RN 0.80 app, 2026-10-04 (UI test after login)',
+    title: 'LinearGradient around a Modal: a known New Architecture crash',
+    detail: "react-native-linear-gradient 2.x has no Fabric component, so it runs through the interop layer. When a LinearGradient contains a Modal (or a Modal-based bottom sheet), closing it can abort the app: \"RCTComponentViewRegistry: Attempt to recycle a mounted view\" (upstream issue #718). React Native 0.76+ draws gradients itself: experimental_backgroundImage: 'linear-gradient(...)' on a View.",
+    source: 'real upgrade of an RN 0.80 app, 2026-10-04 (UI test after login); upstream issue #718',
+    // Only high when the code has the crashing shape; many apps use 2.x under Fabric without it.
+    evidence: {
+      imports: 'react-native-linear-gradient',
+      pattern: '<Modal\\b|<RBSheet\\b|<BottomSheetModal\\b|react-native-modal|react-native-raw-bottom-sheet',
+    },
+    withoutEvidence: {
+      severity: 'low',
+      title: 'react-native-linear-gradient 2.x runs through the New Architecture interop layer',
+      detail: "It has no Fabric component. No LinearGradient next to a Modal was found, which is the layout known to crash (upstream issue #718). React Native 0.76+ can draw gradients itself (experimental_backgroundImage), which removes a native dependency.",
+    },
   },
 ];
 

package/src/native.js

@@ -62,7 +62,7 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         severity: 'critical',
         area: 'store',
         title: `React Native ${project.rnVersion} does not support 16 KB memory pages`,
-        detail: `Google Play rejects updates without 16 KB page support since ${PAGE_SIZE_16K.since} (extensions ended ${PAGE_SIZE_16K.extensionUntil}). React Native supports it from 0.${PAGE_SIZE_16K.firstRnMinor}.`,
+        detail: `Google Play rejects updates without 16 KB page support since ${PAGE_SIZE_16K.since} (extensions ended ${PAGE_SIZE_16K.extensionUntil}). React Native supports it from 0.${PAGE_SIZE_16K.firstRnMinor}${project.expoVersion ? ', which in Expo means SDK 53 or later (SDK 52 ships React Native 0.76)' : ''}.`,
         fix: { kind: 'upgrade-rn-min', to: `0.${PAGE_SIZE_16K.firstRnMinor}.0` },
       });
     }
@@ -131,7 +131,8 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
   const appGradle = read(path.join(root, 'android', 'app', 'build.gradle')) || read(path.join(root, 'android', 'app', 'build.gradle.kts')) || '';
   const gradleProps = read(path.join(root, 'android', 'gradle.properties')) || '';
   const podfile = read(path.join(root, 'ios', 'Podfile')) || '';
-  if (/com\.facebook\.flipper|FLIPPER_VERSION/.test(appGradle + gradleProps) || /use_flipper!|FlipperConfiguration\.enabled/.test(podfile)) {
+  const flipperWired = /com\.facebook\.flipper/.test(appGradle) || /^\s*[^#\n]*(use_flipper!|FlipperConfiguration\.enabled)/m.test(podfile);
+  if (flipperWired) {
     add({
       id: 'flipper',
       severity: 'medium',
@@ -140,6 +141,15 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
       detail: 'Flipper was removed from React Native in 0.74 and its native libraries are not 16 KB aligned. Remove the Flipper dependencies and initialization code before upgrading; use React Native DevTools instead.',
       fix: { kind: 'remove-flipper' },
     });
+  } else if (/^\s*FLIPPER_VERSION\s*=/m.test(gradleProps)) {
+    // A leftover property from an old template: harmless, but worth deleting.
+    add({
+      id: 'flipper-leftover',
+      severity: 'low',
+      area: 'native',
+      title: 'Leftover FLIPPER_VERSION in android/gradle.properties',
+      detail: 'Nothing uses it (Flipper is not wired into the build). Delete the line so nobody wonders whether Flipper is still there.',
+    });
   }
 
   // Podfile still loading the CLI's native_modules.rb: React Native provides use_native_modules!
@@ -278,15 +288,28 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
 
   // iOS privacy manifest: required by App Store Connect since 1 May 2024. React Native itself
   // uses "required reason" APIs, so every React Native app needs one.
-  if (hasIos) {
+  if (hasIos && !project.isLibrary) {
     const manifests = findFiles(path.join(root, 'ios'), (name) => name.endsWith('.xcprivacy'));
-    if (!manifests.length) {
+    // From 0.75, `pod install` writes the manifest (with React Native's and the pods' reasons)
+    // and adds it to the app target, unless the Podfile turns aggregation off.
+    const aggregationOff = /privacy_file_aggregation_enabled\s*(?:=>|:)\s*false|RCT_AGGREGATE_PRIVACY_FILES['"]?\]?\s*=\s*['"]?0/.test(podfile);
+    const generated = rn !== null && rn >= 75 && !aggregationOff;
+    if (!manifests.length && generated) {
+      add({
+        id: 'ios-privacy-manifest',
+        severity: 'low',
+        area: 'store',
+        title: 'iOS privacy manifest is generated at pod install, not committed',
+        detail: "React Native 0.75+ creates PrivacyInfo.xcprivacy during `pod install` with the required-reason APIs of React Native and your pods. Commit it, then add what only you know: collected data types and tracking. App Store Connect checks those too.",
+        fix: { kind: 'privacy-manifest', generated: true },
+      });
+    } else if (!manifests.length) {
       add({
         id: 'ios-privacy-manifest',
         severity: 'high',
         area: 'store',
         title: 'iOS privacy manifest (PrivacyInfo.xcprivacy) is missing',
-        detail: 'App Store Connect rejects uploads that use required-reason APIs without declaring them. React Native uses several (UserDefaults, file timestamps, system boot time). Add PrivacyInfo.xcprivacy to the app target.',
+        detail: `App Store Connect rejects uploads that use required-reason APIs without declaring them. React Native uses several (UserDefaults, file timestamps, system boot time). ${rn !== null && rn < 75 ? 'React Native before 0.75 does not add it to the app for you: ' : ''}Add PrivacyInfo.xcprivacy to the app target.`,
         fix: { kind: 'privacy-manifest' },
       });
     }
@@ -365,7 +388,14 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
   // someone publish as you. The debug keystore and its public 'android' password are fine.
   const tracked = gitTracked(root);
   if (tracked) {
-    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug/i.test(path.basename(f)));
+    const nonEmpty = (f) => {
+      try {
+        return fs.statSync(path.join(root, f)).size > 0;
+      } catch {
+        return false;
+      }
+    };
+    const signing = tracked.filter((f) => /\.(jks|keystore)$/i.test(f) && !/debug/i.test(path.basename(f)) && nonEmpty(f));
     for (const f of signing) {
       add({
         id: `signing-keystore:${f}`,
@@ -376,7 +406,16 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         fix: { kind: 'secret', label: 'Release keystore', file: f, line: 1, bundled: false },
       });
     }
-    for (const f of tracked.filter((x) => /(^|\/)AuthKey_[A-Z0-9]+\.p8$/.test(x))) {
+    // An empty placeholder file is not a key (some repos commit one so fastlane paths resolve).
+    const hasContent = (f, marker) => {
+      try {
+        const text = fs.readFileSync(path.join(root, f), 'utf8');
+        return marker ? text.includes(marker) : text.length > 0;
+      } catch {
+        return false;
+      }
+    };
+    for (const f of tracked.filter((x) => /(^|\/)AuthKey_[A-Z0-9]+\.p8$/.test(x) && hasContent(x, 'PRIVATE KEY'))) {
       add({
         id: `signing-asc-key:${f}`,
         severity: 'critical',
@@ -386,7 +425,7 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
         fix: { kind: 'secret', label: 'App Store Connect API key', file: f, line: 1, bundled: false },
       });
     }
-    for (const f of tracked.filter((x) => /\.p12$/i.test(x))) {
+    for (const f of tracked.filter((x) => /\.p12$/i.test(x) && nonEmpty(x))) {
       add({
         id: `signing-p12:${f}`,
         severity: 'high',
@@ -401,8 +440,13 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
       const text = read(path.join(root, f)) || '';
       const leaked = [
         ...[...text.matchAll(/^\s*([A-Z0-9_]*(?:STORE|KEY)_PASSWORD)\s*=\s*(\S+)\s*$/gm)].map((m) => ({ name: m[1], value: m[2] })),
-        ...[...text.matchAll(/\b(storePassword|keyPassword)\s*=?\s*["']([^"']+)["']/g)].map((m) => ({ name: m[1], value: m[2] })),
-      ].filter((l) => l.value !== 'android' && !/^System\.getenv|^\$\{?[A-Z_]+\}?$/.test(l.value));
+        // Not `props['storePassword']`: there the name is a lookup key, not an assignment.
+        ...[...text.matchAll(/(?<![\w'"[])(storePassword|keyPassword)\s*=?\s*["']([^"'\n]+)["']/g)].map((m) => ({ name: m[1], value: m[2] })),
+      ]
+        .map((l) => ({ ...l, value: l.value.replace(/^["']|["']$/g, '') }))
+        // Not leaks: the debug keystore's public password, environment references, empty
+        // values and template placeholders (*****, <password>, your_password).
+        .filter((l) => l.value && l.value !== 'android' && !/^System\.getenv|^\$\{?[A-Z_]+\}?$/.test(l.value) && !/^(\*+|x+|<.*>|your[_-]?\w*|changeme)$/i.test(l.value));
       if (leaked.length) {
         add({
           id: `signing-password:${f}`,

package/src/plan.js

@@ -125,8 +125,40 @@ function safetyNetPhase(tool) {
   };
 }
 
+// Libraries whose version an Expo SDK decides (from Expo's bundledNativeModules.json). When the
+// app's own copy of that file is installed it is used instead; this list covers scans without
+// node_modules.
+const EXPO_PINNED = new Set([
+  'react-native-reanimated', 'react-native-worklets', 'react-native-gesture-handler', 'react-native-screens',
+  'react-native-safe-area-context', 'react-native-webview', 'react-native-svg', 'react-native-pager-view',
+  'react-native-maps', 'react-native-view-shot', 'react-native-get-random-values', 'react-native-keyboard-controller',
+  '@react-native-async-storage/async-storage', '@react-native-community/datetimepicker', '@react-native-community/slider',
+  '@react-native-community/netinfo', '@react-native-picker/picker', '@react-native-masked-view/masked-view',
+  'lottie-react-native', '@shopify/flash-list', '@shopify/react-native-skia', '@stripe/stripe-react-native',
+]);
+
+function expoPinnedNames(root) {
+  try {
+    let dir = root;
+    while (true) {
+      const file = path.join(dir, 'node_modules', 'expo', 'bundledNativeModules.json');
+      if (fs.existsSync(file)) return new Set(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))));
+      const parent = path.dirname(dir);
+      if (parent === dir) return EXPO_PINNED;
+      dir = parent;
+    }
+  } catch {
+    return EXPO_PINNED;
+  }
+}
+
 export function buildPlan(result) {
-  const pm = commands[packageManager(result.project.root)];
+  const isExpo = !!result.project.expo;
+  const basePm = commands[packageManager(result.project.root)];
+  // In Expo projects `npx expo install` picks the version that matches the SDK.
+  const pm = isExpo ? { ...basePm, add: 'npx expo install' } : basePm;
+  const pinned = isExpo ? expoPinnedNames(result.project.root) : new Set();
+  const movesWithExpo = (name) => isExpo && (/^(expo-|@expo\/)/.test(name) || name === 'expo' || name === 'jest-expo' || pinned.has(name));
   const installed = new Set(result.deps.map((d) => d.name));
   const byKind = (kind) => result.findings.filter((f) => f.fix && f.fix.kind === kind).map((f) => f.fix);
   const phases = [];
@@ -190,7 +222,10 @@ export function buildPlan(result) {
   }
 
   const storeSteps = [];
-  if (byKind('privacy-manifest').length) {
+  const privacy = byKind('privacy-manifest')[0];
+  if (privacy && privacy.generated) {
+    storeSteps.push('Run `pod install`, commit the generated `PrivacyInfo.xcprivacy`, and add your collected data types and tracking to it (React Native only fills in the required-reason APIs).');
+  } else if (privacy) {
     storeSteps.push('Add `PrivacyInfo.xcprivacy` to the iOS app target. Start from the file in the React Native template and declare the required-reason APIs your app and SDKs use (UserDefaults, file timestamps, system boot time, disk space).');
   }
   const align = byKind('align-16kb')[0];
@@ -263,7 +298,8 @@ export function buildPlan(result) {
     });
   }
 
-  const nativeBumps = byKind('bump-dep').filter((d) => d.native);
+  const expoMoves = byKind('bump-dep').filter((d) => movesWithExpo(d.name));
+  const nativeBumps = byKind('bump-dep').filter((d) => d.native && !movesWithExpo(d.name));
   if (nativeBumps.length) {
     phases.push({
       title: 'Update native modules on the current React Native version',
@@ -281,6 +317,7 @@ export function buildPlan(result) {
       steps: [`In \`${depProvider.file}\`: \`#import <ReactAppDependencyProvider/RCTAppDependencyProvider.h>\` and \`self.dependencyProvider = [RCTAppDependencyProvider new];\` before \`[super application:didFinishLaunchingWithOptions:]\`.`],
     });
   }
+  let deferredArch = null;
   if (arch) {
     const steps = [];
     for (const j of byKind('interop-job')) {
@@ -301,11 +338,18 @@ export function buildPlan(result) {
     steps.push('Clean everything (`./gradlew clean`, `watchman watch-del-all`, delete `ios/build` and `ios/Pods`). Switching architecture without a clean build fails on stale codegen output (e.g. missing `Native…Spec` classes).');
     steps.push('Build debug and release on both platforms.');
     steps.push('Click through every screen that uses a native module. Interop-layer problems show up at runtime, not at build time.');
-    phases.push({
-      title: 'Turn on the New Architecture on your current version',
-      why: `React Native 0.${NEW_ARCH_ONLY_MINOR} removed the legacy architecture. Switching now, before changing the React Native version, keeps the two kinds of breakage apart.`,
-      steps,
-    });
+    // Before 0.76 the New Architecture is too immature to switch on in place: do it on the way,
+    // at the first stop between 0.76 and 0.81 (or Expo SDK 52+), in its own commit.
+    const currentMinor = Number((result.project.reactNative || '0.99').split('.')[1]);
+    if (currentMinor < 76) {
+      deferredArch = steps;
+    } else {
+      phases.push({
+        title: 'Turn on the New Architecture on your current version',
+        why: `React Native 0.${NEW_ARCH_ONLY_MINOR} removed the legacy architecture. Switching now, before changing the React Native version, keeps the two kinds of breakage apart.`,
+        steps,
+      });
+    }
   }
 
   const rn = byKind('upgrade-rn')[0];
@@ -332,6 +376,19 @@ export function buildPlan(result) {
       from = to;
       return step;
     });
+    if (deferredArch) {
+      const hops = upgradeHops(rn.from, rn.to);
+      const at = hops.findIndex((h) => Number(h.split('.')[1]) >= 76 && Number(h.split('.')[1]) < NEW_ARCH_ONLY_MINOR);
+      if (at >= 0) {
+        steps.splice(
+          at + 1,
+          0,
+          `**Stop at ${hops[at]} and turn on the New Architecture** before going further: 0.${NEW_ARCH_ONLY_MINOR} removed the legacy one. Do it in its own commit:`,
+          ...deferredArch.map((x) => `New Architecture: ${x}`),
+        );
+        deferredArch = null;
+      }
+    }
     steps.push('Bump `react`, `@react-native/*` packages and the Metro/Babel config to the versions the Upgrade Helper shows for the target.');
     const patchesReview = byKind('patches-review')[0];
     if (patchesReview) {
@@ -349,11 +406,26 @@ export function buildPlan(result) {
   const expo = byKind('upgrade-expo')[0];
   if (expo) {
     const steps = [];
-    for (let v = expo.from + 1; v <= expo.to; v++) steps.push(`SDK ${v - 1} → ${v}: \`npx expo install expo@^${v}.0.0 --fix\`, read the SDK ${v} changelog, run \`npx expo-doctor\`, build.`);
+    for (let v = expo.from + 1; v <= expo.to; v++) {
+      steps.push(`SDK ${v - 1} → ${v}: \`npx expo install expo@^${v}.0.0 --fix\`, read the SDK ${v} changelog, run \`npx expo-doctor\`, build.`);
+      // SDK 52 ships React Native 0.76, the first version where switching is practical.
+      if (deferredArch && v >= 52) {
+        steps.push(`**At SDK ${v}, turn on the New Architecture** before going further (it is the default from SDK 53, and React Native 0.${NEW_ARCH_ONLY_MINOR} removed the legacy one):`, ...deferredArch.map((x) => `New Architecture: ${x}`));
+        deferredArch = null;
+      }
+    }
+    steps.push('Each SDK brings its own React Native version; do not upgrade React Native separately.');
+    if (expoMoves.length) {
+      const names = expoMoves.map((d) => `\`${d.name}\``);
+      steps.push(`\`npx expo install --fix\` also moves ${names.slice(0, 8).join(', ')}${names.length > 8 ? ` and ${names.length - 8} more` : ''} to the versions each SDK expects. Do not bump them yourself: a newer major than the SDK supports fails to build.`);
+    }
+    if (!result.project.managed) {
+      steps.push('This app has its own android/ and ios/ folders: after each SDK, apply the native changes from Expo\'s native project upgrade helper (docs.expo.dev/bare/upgrade), then `pod install` and build both platforms.');
+    }
     phases.push({ title: `Upgrade Expo SDK ${expo.from} → ${expo.to}`, why: 'Expo only supports one SDK step at a time reliably.', steps });
   }
 
-  const jsBumps = byKind('bump-dep').filter((d) => !d.native);
+  const jsBumps = byKind('bump-dep').filter((d) => !d.native && !movesWithExpo(d.name));
   if (jsBumps.length) {
     phases.push({
       title: 'Update JavaScript-only packages',

package/src/project.js

@@ -42,12 +42,71 @@ export function installedVersion(root, name) {
   return pkg ? pkg.version : null;
 }
 
+// pnpm and Bun "catalogs": a dependency declared as `catalog:` or `catalog:<name>` takes its
+// version from the workspace root (pnpm-workspace.yaml, or package.json `workspaces.catalog`).
+// Returns { default: {pkg: range}, <name>: {...} } or null.
+export function readCatalogs(root) {
+  let dir = root;
+  while (true) {
+    const yaml = readText(path.join(dir, 'pnpm-workspace.yaml'));
+    if (yaml) return parsePnpmCatalogs(yaml);
+    const pkg = dir !== root ? readJson(path.join(dir, 'package.json')) : null;
+    const ws = pkg && pkg.workspaces && !Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg;
+    if (ws && (ws.catalog || ws.catalogs)) return { default: ws.catalog || {}, ...(ws.catalogs || {}) };
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+// Just enough YAML for the two catalog sections: `catalog:` and `catalogs: <name>:` maps of
+// "package": version lines. Anything else in the file is ignored.
+function parsePnpmCatalogs(text) {
+  const out = { default: {} };
+  let section = null; // 'default' or a named catalog
+  let inCatalogs = false;
+  const unquote = (v) => v.trim().replace(/^["']|["']$/g, '');
+  for (const raw of text.split('\n')) {
+    const line = raw.replace(/\s+#.*$/, '');
+    if (!line.trim()) continue;
+    const indent = line.length - line.trimStart().length;
+    const m = line.trim().match(/^("[^"]+"|'[^']+'|[^:\s]+)\s*:\s*(.*)$/);
+    if (!m) continue;
+    const key = unquote(m[1]);
+    const value = m[2];
+    if (indent === 0) {
+      inCatalogs = key === 'catalogs';
+      section = key === 'catalog' ? 'default' : null;
+    } else if (inCatalogs && !value) {
+      section = key;
+      out[section] = out[section] || {};
+    } else if (section && value) {
+      out[section][key] = unquote(value);
+    }
+  }
+  return out;
+}
+
+function resolveCatalogRefs(deps, catalogs) {
+  if (!catalogs) return deps;
+  const out = { ...deps };
+  for (const [name, spec] of Object.entries(deps)) {
+    if (typeof spec !== 'string' || !spec.startsWith('catalog:')) continue;
+    const which = spec.slice('catalog:'.length) || 'default';
+    const version = catalogs[which] && catalogs[which][name];
+    if (version) out[name] = version;
+  }
+  return out;
+}
+
 export function loadProject(root) {
   const pkg = readJson(path.join(root, 'package.json'));
   if (!pkg) throw new Error(`No package.json found in ${root}`);
-  const deps = { ...(pkg.dependencies || {}) };
+  const usesCatalog = JSON.stringify([pkg.dependencies, pkg.devDependencies]).includes('"catalog:');
+  const catalogs = usesCatalog ? readCatalogs(root) : null;
+  const deps = resolveCatalogRefs({ ...(pkg.dependencies || {}) }, catalogs);
   // Monorepos often keep react-native in devDependencies; autolinking still links native modules from there.
-  const devDeps = { ...(pkg.devDependencies || {}) };
+  const devDeps = resolveCatalogRefs({ ...(pkg.devDependencies || {}) }, catalogs);
   const declared = (name) => deps[name] || devDeps[name];
   if (!declared('react-native') && !declared('expo')) {
     throw new Error('This does not look like a React Native app (no react-native or expo dependency). Run it inside your app folder.');
@@ -57,9 +116,16 @@ export function loadProject(root) {
   const hasIos = fs.existsSync(path.join(root, 'ios'));
   const appConfig = readJson(path.join(root, 'app.json'));
 
+  // A React Native library (or an example inside one) is not an app: store checks do not apply.
+  const androidGradle = readText(path.join(root, 'android', 'build.gradle')) || '';
+  const isLibrary =
+    !!(pkg.peerDependencies && pkg.peerDependencies['react-native']) ||
+    /apply plugin:\s*['"]com\.android\.library['"]|id\s*\(?\s*['"]com\.android\.library['"]/.test(androidGradle);
+
   return {
     root,
     name: pkg.name,
+    isLibrary,
     deps,
     devDeps,
     rnVersion: cleanVersion(installedVersion(root, 'react-native') || declared('react-native') || ''),

package/src/registry.js

@@ -1,11 +1,28 @@
 const UA = { 'User-Agent': 'nativekeel' };
 
-export async function fetchJson(url, headers = {}) {
-  try {
-    const res = await fetch(url, { headers: { ...UA, ...headers }, signal: AbortSignal.timeout(30000) });
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// GET a JSON document. Returns null for "not found" (a package that does not exist is an
+// answer, not an error). Rate limits (429) and server errors are retried with backoff; if the
+// request still fails, `stats.failed` is incremented so the report can say it is incomplete.
+export async function fetchJson(url, headers = {}, stats = null, { retries = 3, wait = sleep } = {}) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const res = await fetch(url, { headers: { ...UA, ...headers }, signal: AbortSignal.timeout(30000) });
+      if (res.ok) return await res.json();
+      if (res.status === 404) return null;
+      if ((res.status === 429 || res.status >= 500) && attempt < retries) {
+        const after = Number(res.headers.get('retry-after'));
+        await wait(Math.min(Number.isFinite(after) && after > 0 ? after * 1000 : 1000 * 2 ** attempt, 10000));
+        continue;
+      }
+    } catch {
+      if (attempt < retries) {
+        await wait(1000 * 2 ** attempt);
+        continue;
+      }
+    }
+    if (stats) stats.failed++;
     return null;
   }
 }
@@ -69,6 +86,26 @@ export function createRegistry(get = fetchJson) {
       return out;
     },
 
+    // Whether the version in use, and the latest, ship a codegen spec (`codegenConfig` in their
+    // package.json), i.e. native New Architecture support. React Native Directory's flag lags
+    // releases, so this is the tie-breaker before calling a package a blocker.
+    async codegenSupport(list, concurrency = 8) {
+      const out = {};
+      const queue = [...list];
+      const manifest = (name, tag) => get(`https://registry.npmjs.org/${name.replace('/', '%2F')}/${tag}`);
+      const worker = async () => {
+        while (queue.length) {
+          const { name, version } = queue.shift();
+          const latest = await manifest(name, 'latest');
+          if (!latest) continue;
+          const used = version && version !== latest.version ? await manifest(name, version) : latest;
+          out[name] = { latest: latest.version, latestHas: !!latest.codegenConfig, usedHas: !!(used && used.codegenConfig) };
+        }
+      };
+      await Promise.all(Array.from({ length: concurrency }, worker));
+      return out;
+    },
+
     // Stable versions of a package, newest release line first.
     async releaseLines(name, pick) {
       // The abbreviated "install" document is a fraction of the full packument's size.

package/src/secrets.js

@@ -18,7 +18,7 @@ const RULES = [
   { id: 'openai-key', label: 'OpenAI API key', re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\b/g },
   { id: 'anthropic-key', label: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{32,}\b/g },
   { id: 'github-token', label: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
-  { id: 'slack-token', label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { id: 'slack-token', label: 'Slack token', re: /\bxox[baprs]-\d{6,}-[A-Za-z0-9-]{10,}\b/g },
   { id: 'sendgrid-key', label: 'SendGrid API key', re: /\b(?<v>SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})\b/g },
   { id: 'twilio-key', label: 'Twilio API key', re: /\b(?<v>SK[0-9a-fA-F]{32})\b/g },
   { id: 'google-oauth-secret', label: 'Google OAuth client secret', re: /\b(?<v>GOCSPX-[A-Za-z0-9_-]{28})\b/g },
@@ -40,6 +40,35 @@ const RULES = [
   },
 ];
 
+// Values that are obviously not real: docs examples, test fixtures, templates.
+const PLACEHOLDER = /example|test|dummy|fake|sample|placeholder|xxxx|changeme|redacted|your[_-]?(?:api[_-]?)?(?:key|token|secret)/i;
+
+// Test code is never part of the app bundle.
+const TEST_PATH = /(^|\/)(__tests__|__mocks__|__fixtures__|test|tests|e2e|fixtures)\/|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)tests?\.[cm]?[jt]sx?$|[a-z]Test\.[cm]?[jt]sx?$/;
+
+const JS_FILE = /\.[cm]?[jt]sx?$/;
+
+// A JSON file only ends up in the JavaScript bundle when code imports it (a service-account
+// file lying in the project root is committed, not shipped). Native resources (plist, xml) and
+// assets under android/ and ios/ are packaged by the build, so they always ship.
+function importedJsonNames(files) {
+  const names = new Set();
+  for (const file of files) {
+    if (!JS_FILE.test(file)) continue;
+    let text;
+    try {
+      if (fs.statSync(file).size > MAX_FILE_BYTES) continue;
+      text = fs.readFileSync(file, 'utf8');
+    } catch {
+      continue;
+    }
+    for (const m of text.matchAll(/['"`]([^'"`\n]+\.json)['"`]/g)) names.add(path.basename(m[1]));
+  }
+  return names;
+}
+
+const isCommentLine = (line) => /^\s*(\/\/|\/\*|\*|#|<!--)/.test(line);
+
 export function mask(value) {
   if (value.length <= 8) return '****';
   return `${value.slice(0, 4)}…${value.slice(-2)}`;
@@ -69,7 +98,9 @@ function gitTrackedFiles(root) {
 export function scanSecrets(root) {
   const findings = [];
   const tracked = gitTrackedFiles(root);
-  for (const file of walk(root)) {
+  const files = [...walk(root)];
+  let jsonImports = null; // computed only if a JSON file holds a secret
+  for (const file of files) {
     let text;
     try {
       if (fs.statSync(file).size > MAX_FILE_BYTES) continue;
@@ -77,19 +108,31 @@ export function scanSecrets(root) {
     } catch {
       continue;
     }
+    const lines = text.split('\n');
     for (const rule of RULES) {
       for (const m of text.matchAll(rule.re)) {
         if (rule.validate && !rule.validate(m)) continue;
+        if (PLACEHOLDER.test(m[0])) continue;
         const rel = path.relative(root, file);
+        const posix = rel.split(path.sep).join('/');
         const value = m.groups && m.groups.v;
+        const line = text.slice(0, m.index).split('\n').length;
+        // Comments are stripped from the bundle; a key there is committed, not shipped.
+        const inComment = isCommentLine(lines[line - 1] || '');
+        let unreferencedJson = false;
+        if (file.endsWith('.json') && !/^(android|ios)\//.test(posix)) {
+          jsonImports = jsonImports || importedJsonNames(files);
+          unreferencedJson = !jsonImports.has(path.basename(file));
+        }
         findings.push({
           rule: rule.id,
           label: rule.label,
           file: rel,
-          line: text.slice(0, m.index).split('\n').length,
+          line,
           preview: value ? mask(value) : null,
-          inAppBundle: !SERVER_DIRS.has(rel.split(path.sep)[0]),
-          committed: tracked ? tracked.has(rel.split(path.sep).join('/')) : null,
+          inAppBundle: !SERVER_DIRS.has(posix.split('/')[0]) && !TEST_PATH.test(posix) && !inComment && !unreferencedJson,
+          inComment,
+          committed: tracked ? tracked.has(posix) : null,
         });
       }
     }

package/src/usage.js

@@ -22,6 +22,10 @@ const IMPLICIT = [
   /^@react-native\//, // versioned with React Native, used by the build
   /^@react-native-community\/cli/,
   /^react-native-vector-icons$/, // fonts linked by the build
+  // Work by being installed: native auto-registration or compiler output.
+  /^react-native-webp-format$/, // iOS WebP decoder registers itself with the image loader
+  /^@react-native-firebase\/(crashlytics|perf)$/, // collect natively without any JS call
+  /^react-compiler-runtime$/, // imported by babel-plugin-react-compiler output
 ];
 
 function walk(dir, exts, out = []) {
@@ -58,7 +62,7 @@ export function packageOf(spec) {
 
 export function importedPackages(text) {
   const found = new Set();
-  const re = /(?:\bfrom\s*|\bimport\s*\(?\s*|\brequire\s*\(\s*|\bjest\.(?:mock|requireActual)\s*\(\s*)['"]([^'"\n]+)['"]/g;
+  const re = /(?:\bfrom\s*|\bimport\s*\(?\s*|\brequire(?:\.resolve)?\s*\(\s*|\bjest\.(?:mock|requireActual)\s*\(\s*)['"]([^'"\n]+)['"]/g;
   for (const m of text.matchAll(re)) {
     const pkg = packageOf(m[1]);
     if (pkg) found.add(pkg);
@@ -102,22 +106,38 @@ export function findUnused(project) {
     readSmall(path.join(root, 'app.config.js')),
     readSmall(path.join(root, 'app.config.ts')),
     readSmall(path.join(root, 'react-native.config.js')),
+    // metro/babel/jest config and friends: aliases such as `crypto: 'crypto-browserify'`.
+    ...fs
+      .readdirSync(root)
+      .filter((f) => /\.config\.[cm]?[jt]s$|^\.babelrc|^rn-cli\.config/.test(f))
+      .map((f) => readSmall(path.join(root, f))),
   ].join('\n');
+  // CLI tools run from scripts by their command name, which can differ from the package name.
+  const scriptText = JSON.stringify(pkgJson.scripts || {});
+  const usedByBin = (name) => {
+    const dir = findPackageDir(root, name);
+    try {
+      const bin = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).bin;
+      const bins = typeof bin === 'string' ? [name.split('/').pop()] : Object.keys(bin || {});
+      return bins.some((b) => scriptText.includes(b));
+    } catch {
+      return false;
+    }
+  };
 
-  // Required by another dependency (peer or regular).
+  // Required by any installed package (peer or regular), including indirect ones: e.g.
+  // @react-navigation/elements, pulled in by the stack navigator, peers on masked-view.
   const requiredByOthers = new Set();
-  for (const other of Object.keys(project.deps)) {
-    const dir = findPackageDir(root, other);
-    if (!dir) continue;
+  for (const manifest of installedManifests(root)) {
     try {
-      const m = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+      const m = JSON.parse(fs.readFileSync(manifest, 'utf8'));
       for (const k of ['peerDependencies', 'dependencies']) for (const d of Object.keys(m[k] || {})) requiredByOthers.add(d);
     } catch {
       // unreadable manifest
     }
   }
 
-  const candidates = names.filter((n) => !used.has(n) && !requiredByOthers.has(n) && !configText.includes(n));
+  const candidates = names.filter((n) => !used.has(n) && !requiredByOthers.has(n) && !configText.includes(n) && !usedByBin(n));
   if (!candidates.length) return [];
 
   const nativeText = ['ios', 'android'].flatMap((d) => walk(path.join(root, d), NATIVE_EXT)).map(readSmall).join('\n');
@@ -125,3 +145,46 @@ export function findUnused(project) {
     .filter((n) => !nativeText.includes(n) && !nativeTokens(root, n).some((t) => nativeText.includes(t)))
     .map((name) => ({ name, native: nativeTokens(root, name).length > 0 }));
 }
+
+// package.json of every package in the node_modules folders from the app up to the filesystem
+// root (monorepos hoist), one level of scopes deep. Nested node_modules are skipped.
+function installedManifests(root) {
+  const out = [];
+  let dir = root;
+  while (true) {
+    const nm = path.join(dir, 'node_modules');
+    let entries = [];
+    try {
+      entries = fs.readdirSync(nm, { withFileTypes: true });
+    } catch {
+      // none here
+    }
+    for (const e of entries) {
+      if (!e.isDirectory() && !e.isSymbolicLink()) continue;
+      if (e.name.startsWith('@')) {
+        try {
+          for (const sub of fs.readdirSync(path.join(nm, e.name))) out.push(path.join(nm, e.name, sub, 'package.json'));
+        } catch {
+          // unreadable scope
+        }
+      } else if (!e.name.startsWith('.')) {
+        out.push(path.join(nm, e.name, 'package.json'));
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return out;
+    dir = parent;
+  }
+}
+
+// Source files (relative paths) that import `pkg` and whose text matches `pattern`.
+export function filesImportingWith(root, pkg, pattern) {
+  const re = new RegExp(pattern);
+  const out = [];
+  for (const file of walk(root, JS_EXT)) {
+    const text = readSmall(file);
+    if (!text.includes(pkg) || !importedPackages(text).has(pkg)) continue;
+    if (re.test(text)) out.push(path.relative(root, file));
+  }
+  return out.sort();
+}