nativekeel 0.1.5 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Health check for React Native apps: version support, New Architecture blockers, unmaintained native modules and leaked secrets.",
   "type": "module",
   "bin": {

package/src/analyze.js

@@ -15,6 +15,7 @@ import {
   RECENT_RELEASE_DAYS,
   STALE_RELEASE_DAYS,
   PLAY_TARGET_SDK,
+  RENAMED,
   REPLACEMENTS,
   SUPPORTED_EXPO_MAJORS,
   SUPPORTED_RN_MINORS,
@@ -31,8 +32,10 @@ const lineOf = (v) => {
 };
 
 // react, react-native and @react-native/* move together with the React Native version; @babel/* and types are tooling.
+// Also packages that move with React Native and React themselves (Metro, the scheduler, react-is).
 const isTracked = (name) =>
-  !['react-native', 'react', 'expo'].includes(name) &&
+  !['react-native', 'react', 'expo', 'react-dom', 'react-is', 'react-test-renderer', 'scheduler', 'hermes-engine'].includes(name) &&
+  !/^metro(-|$)/.test(name) &&
   !name.startsWith('@react-native/') &&
   !name.startsWith('@babel/') &&
   !name.startsWith('@types/');
@@ -261,7 +264,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
     }
     // Only code that has to follow React Native or the OS goes stale; a finished JS utility does not.
     const stale = !dep.unmaintained && !revived && age !== null && age > STALE_RELEASE_DAYS && (native || !!release.rnLink);
-    const alternatives = dir && dir.alternatives && dir.alternatives.length ? dir.alternatives : REPLACEMENTS[name] || [];
+    const alternatives = RENAMED[name] ? [RENAMED[name]] : dir && dir.alternatives && dir.alternatives.length ? dir.alternatives : REPLACEMENTS[name] || [];
     if (noNewArch || dep.unmaintained || stale) {
       const problems = [
         noNewArch && 'no New Architecture support',
@@ -277,7 +280,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
         area: 'dependency',
         title: `${name}: ${problems.join(', ')}`,
         detail: `${why}${alternatives.length ? ` Alternatives: ${alternatives.join(', ')}.` : ''}`,
-        fix: { kind: 'replace-dep', name, native, noNewArch, unmaintained: dep.unmaintained || stale, alternatives },
+        fix: { kind: 'replace-dep', name, native, noNewArch, unmaintained: dep.unmaintained || stale, alternatives, renamedTo: RENAMED[name] || null },
       });
     } else if (revived) {
       add({
@@ -342,7 +345,7 @@ export async function analyze(project, { get, now = new Date(), offline: forcedO
       area: 'dependency',
       title,
       detail: `${detail} (installed: ${dep.name} ${dep.version}; seen in: ${issue.source})`,
-      fix: { kind: 'known-issue', name: dep.name, title, detail },
+      fix: { kind: 'known-issue', name: dep.name, title, detail, severity },
     });
   }
 

package/src/native.js

@@ -191,7 +191,9 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
   }
   const patched = [];
   for (const f of patchFiles) {
-    const m = f.match(/^(.+?)\+(\d+\.\d+\.\d+[^.]*)(?:\+\d+)?\.patch$/);
+    // patch-package names: <pkg>+<version>.patch, <pkg>+<version>.dev.patch, and sequenced
+    // patches <pkg>+<version>+<NNN>[+<name>].patch (scoped packages use + for the slash).
+    const m = f.match(/^(.+?)\+(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?:\+\d+(?:\+[^/]*)?)?(?:\.dev)?\.patch$/);
     if (!m) continue;
     const pkg = m[1].replace(/\+/g, '/');
     const version = m[2];
@@ -226,7 +228,7 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
       id: 'patches-present',
       severity: 'info',
       area: 'native',
-      title: `${patched.length} patch-package patch${patched.length === 1 ? '' : 'es'}: ${patched.map((p) => p.pkg).join(', ')}`,
+      title: `${patched.length} patch-package patch${patched.length === 1 ? '' : 'es'}: ${[...new Set(patched.map((p) => p.pkg))].join(', ')}`,
       detail: 'Each was written against one library version and one React Native version. After every upgrade step check that each still applies and is still needed; a patch that adapted a library to an older React Native can break it on a newer one.',
       fix: { kind: 'patches-review', patches: patched },
     });
@@ -274,15 +276,18 @@ export function nativeChecks(project, { rnLatest = null, now = new Date() } = {}
   }
 
   // Hermes: JavaScriptCore is no longer bundled with React Native.
-  const hermesOff = /^\s*hermesEnabled\s*=\s*false/m.test(gradleProps) || /:hermes_enabled\s*=>\s*false/.test(podfile);
-  if (hermesOff) {
+  const hermesOffOn = [
+    /^\s*hermesEnabled\s*=\s*false/m.test(gradleProps) && 'android',
+    /^[^#\n]*:hermes_enabled\s*=>\s*false/m.test(podfile) && 'ios',
+  ].filter(Boolean);
+  if (hermesOffOn.length) {
     add({
       id: 'hermes-disabled',
       severity: 'medium',
       area: 'native',
-      title: 'Hermes is disabled (JavaScriptCore)',
+      title: `Hermes is disabled (JavaScriptCore on ${hermesOffOn.join(' + ')})`,
       detail: 'JavaScriptCore is no longer part of React Native; newer versions need the community JSC package. Switching to Hermes is the supported path and usually faster.',
-      fix: { kind: 'enable-hermes' },
+      fix: { kind: 'enable-hermes', platforms: hermesOffOn },
     });
   }
 

package/src/plan.js

@@ -67,10 +67,26 @@ const WEIGHTS = {
   'default-react-host': () => 0.25,
 };
 
+// Routine version bumps are many but cheap next to a React Native, architecture or store
+// change; capping them keeps a nearly current app with many outdated packages from being sized
+// like a migration.
+const BUMP_CAPS = { native: 6, js: 2 };
+
 export function complexity(findings) {
-  const score = Math.round(
-    findings.reduce((sum, f) => sum + (f.fix && WEIGHTS[f.fix.kind] ? WEIGHTS[f.fix.kind](f.fix) : 0), 0),
-  );
+  let nativeBumps = 0;
+  let jsBumps = 0;
+  let rest = 0;
+  for (const f of findings) {
+    if (!f.fix || !WEIGHTS[f.fix.kind]) continue;
+    const w = WEIGHTS[f.fix.kind](f.fix);
+    if (f.fix.kind === 'bump-dep') {
+      if (f.fix.native) nativeBumps += w;
+      else jsBumps += w;
+    } else {
+      rest += w;
+    }
+  }
+  const score = Math.round(rest + Math.min(nativeBumps, BUMP_CAPS.native) + Math.min(jsBumps, BUMP_CAPS.js));
   const size = score < 8 ? 'Small' : score < 20 ? 'Medium' : score < 40 ? 'Large' : 'Extra large';
   return { score, size };
 }
@@ -200,7 +216,8 @@ export function buildPlan(result) {
     });
   }
 
-  const known = byKind('known-issue');
+  // Low-severity notes stay in the report; the plan only carries what can break the app.
+  const known = byKind('known-issue').filter((k) => k.severity !== 'low');
   if (known.length) {
     phases.push({
       title: 'Avoid known traps',
@@ -228,6 +245,11 @@ export function buildPlan(result) {
   } else if (privacy) {
     storeSteps.push('Add `PrivacyInfo.xcprivacy` to the iOS app target. Start from the file in the React Native template and declare the required-reason APIs your app and SDKs use (UserDefaults, file timestamps, system boot time, disk space).');
   }
+  if (byKind('upgrade-rn-min').length) {
+    storeSteps.push(isExpo
+      ? '**16 KB memory pages:** Google Play rejects updates until the app is on Expo SDK 53 (React Native 0.79) or later. The Expo SDK phase below gets you there; reach SDK 53 before your next Play release.'
+      : '**16 KB memory pages:** Google Play rejects updates until the app is on React Native 0.77 or later. The React Native phase below gets you there; reach 0.77 before your next Play release.');
+  }
   const align = byKind('align-16kb')[0];
   if (align) {
     storeSteps.push(`Fix 16 KB alignment for ${align.libs.map((l) => `\`${l}\``).join(', ')}: find which package ships each library (\`grep -rl <lib> node_modules/*/android\`) and update it; libraries you build yourself need NDK r28+.`);
@@ -272,27 +294,46 @@ export function buildPlan(result) {
   if (byKind('remove-flipper').length) {
     cleanup.push('Remove Flipper: delete the `com.facebook.flipper` dependencies and `FLIPPER_VERSION` on Android, `use_flipper!` / Flipper config in the Podfile, and the `ReactNativeFlipper` initialization code. Use React Native DevTools instead.');
   }
-  if (byKind('enable-hermes').length) {
-    cleanup.push('Switch to Hermes: set `hermesEnabled=true` in `android/gradle.properties` and `:hermes_enabled => true` in the Podfile, then test anything that relied on JavaScriptCore behavior (Intl, Date parsing).');
+  const hermes = byKind('enable-hermes')[0];
+  if (hermes) {
+    const where = (hermes.platforms || ['android', 'ios']).map((pl) => (pl === 'android' ? 'set `hermesEnabled=true` in `android/gradle.properties`' : 'set `:hermes_enabled => true` in the Podfile'));
+    cleanup.push(`Switch to Hermes: ${where.join(' and ')}, then test anything that relied on JavaScriptCore behavior (Intl, Date parsing).`);
   }
   if (cleanup.length) {
     phases.push({ title: 'Remove legacy tooling', why: 'Leftovers from older templates break on newer React Native versions; removing them first shrinks the upgrade diff.', steps: cleanup });
   }
 
-  const replace = byKind('replace-dep').sort((a, b) => Number(b.noNewArch) - Number(a.noNewArch) || Number(b.native) - Number(a.native));
+  const allReplace = byKind('replace-dep');
+  // Abandoned pure-JS packages do not block an upgrade; they get their own, later phase.
+  const jsAbandoned = allReplace.filter((d) => !d.native && !d.noNewArch);
+  const interopPatched = new Set(byKind('interop-job').map((j) => j.name));
+  const replace = allReplace.filter((d) => d.native || d.noNewArch).sort((a, b) => Number(b.noNewArch) - Number(a.noNewArch) || Number(b.native) - Number(a.native));
   if (replace.length) {
     phases.push({
       title: 'Replace blocking and abandoned packages',
       why: 'These packages decide how far you can upgrade. Swap them while the app still runs on its current version, so every problem has one cause.',
       steps: replace.map((d) => {
         const reason = [d.noNewArch && 'no New Architecture support', d.unmaintained && 'unmaintained'].filter(Boolean).join(', ');
+        if (d.renamedTo) {
+          return `\`${d.name}\` moved to \`${d.renamedTo}\` (same API). \`${pm.remove} ${d.name} && ${pm.add} ${d.renamedTo}\`, then update the imports.`;
+        }
+        if (interopPatched.has(d.name) && !d.unmaintained) {
+          return `\`${d.name}\` (${reason}, native). The New Architecture step below patches it so it loads; move to a release with a TurboModule spec once one exists.`;
+        }
         const owned = d.alternatives.find((a) => installed.has(a));
         if (owned) {
           return `\`${d.name}\` (${reason}${d.native ? ', native' : ''}). You already use \`${owned}\`: move the remaining usage there, then \`${pm.remove} ${d.name}\`.`;
         }
-        const to = d.alternatives[0];
-        const cmd = to ? ` \`${pm.remove} ${d.name} && ${pm.add} ${to}\`` : '';
-        const options = d.alternatives.length ? `Options: ${d.alternatives.map((a) => `\`${a}\``).join(', ')}.${cmd}` : 'No known replacement: check for a maintained fork, or vendor and patch it with `patch-package`.';
+        // expo-* packages need Expo modules; a bare app without them should get another option first.
+        const usesExpoModules = isExpo || installed.has('expo');
+        const to = usesExpoModules ? d.alternatives[0] : d.alternatives.find((a) => !a.startsWith('expo-')) || d.alternatives[0];
+        const needsExpo = to && to.startsWith('expo-') && !usesExpoModules ? ' (Expo packages need Expo modules first: `npx install-expo-modules@latest`)' : '';
+        const cmd = to ? ` \`${pm.remove} ${d.name} && ${pm.add} ${to}\`${needsExpo}` : '';
+        const options = d.alternatives.length
+          ? `Options: ${d.alternatives.map((a) => `\`${a}\``).join(', ')}.${cmd}`
+          : d.noNewArch
+            ? 'No known replacement: check for a maintained fork, or vendor and patch it with `patch-package`.'
+            : 'Not a known blocker: keep it while it builds and passes your UI flows at every step below, and replace it (or patch it with `patch-package`) when it breaks.';
         return `\`${d.name}\` (${reason}${d.native ? ', native' : ''}). ${options}`;
       }),
     });
@@ -327,7 +368,7 @@ export function buildPlan(result) {
       steps.push(`In \`${depProvider.file}\`, add \`#import <ReactAppDependencyProvider/RCTAppDependencyProvider.h>\` and \`self.dependencyProvider = [RCTAppDependencyProvider new];\` before calling super. Without it the switch causes a launch crash in Release.`);
     }
     if (result.project.managed) {
-      steps.push('Set `"newArchEnabled": true` in `app.json` (under `expo`), then run `npx expo prebuild --clean` and build.');
+      steps.push('Set `"newArchEnabled": true` in `app.json` (under `expo`), then make a new development build (`eas build --profile development`, or `npx expo run:ios` / `npx expo run:android`). Expo Go cannot test this switch.');
     } else {
       if (arch.platforms.includes('android')) steps.push('Android: set `newArchEnabled=true` in `android/gradle.properties`.');
       if (arch.platforms.includes('ios')) steps.push('iOS: set `"newArchEnabled": "true"` in `ios/Podfile.properties.json` (or run `RCT_NEW_ARCH_ENABLED=1 bundle exec pod install`).');
@@ -335,8 +376,10 @@ export function buildPlan(result) {
     for (const c of byKind('compat').filter((x) => x.forNewArch && x.range)) {
       steps.unshift(`First move \`${c.name}\` to ${c.range}: the installed version does not support the New Architecture on this React Native version.`);
     }
-    steps.push('Clean everything (`./gradlew clean`, `watchman watch-del-all`, delete `ios/build` and `ios/Pods`). Switching architecture without a clean build fails on stale codegen output (e.g. missing `Native…Spec` classes).');
-    steps.push('Build debug and release on both platforms.');
+    if (!result.project.managed) {
+      steps.push('Clean everything (`./gradlew clean`, `watchman watch-del-all`, delete `ios/build` and `ios/Pods`). Switching architecture without a clean build fails on stale codegen output (e.g. missing `Native…Spec` classes).');
+    }
+    steps.push(result.project.managed ? 'Build a development and a production build for both platforms.' : 'Build debug and release on both platforms.');
     steps.push('Click through every screen that uses a native module. Interop-layer problems show up at runtime, not at build time.');
     // Before 0.76 the New Architecture is too immature to switch on in place: do it on the way,
     // at the first stop between 0.76 and 0.81 (or Expo SDK 52+), in its own commit.
@@ -357,20 +400,33 @@ export function buildPlan(result) {
     let from = rn.from;
     const tracked = result.deps.filter((d) => COMPAT[d.name]);
     const lastRange = {};
-    const steps = upgradeHops(rn.from, rn.to).map((to) => {
+    const lastMajor = {};
+    const hopList = upgradeHops(rn.from, rn.to);
+    // When the New Architecture switch happens on the way, library versions up to that stop
+    // must still run on the legacy architecture (Reanimated 4, for one, does not).
+    const switchAt = deferredArch
+      ? hopList.findIndex((h) => Number(h.split('.')[1]) >= 76 && Number(h.split('.')[1]) < NEW_ARCH_ONLY_MINOR)
+      : -1;
+    const majorOf = (v) => Number(String(v).split('.')[0]);
+    const steps = hopList.map((to, i) => {
       const minor = Number(to.split('.')[1]);
+      const archOn = switchAt < 0 || i > switchAt;
       const bumps = tracked
         .map((d) => {
-          const best = bestRange(d.name, minor, true);
-          // Prefer staying on the installed major when it still supports this hop.
-          const major = d.version ? Number(d.version.split('.')[0]) : null;
-          const same = major !== null && best && Number(best.from.split('.')[0]) !== major ? bestRange(d.name, minor, true, { major }) : null;
+          const best = bestRange(d.name, minor, archOn);
+          // Stay on the major of the previous step (or the installed one) while it still works.
+          const major = lastMajor[d.name] ?? (d.version ? majorOf(d.version) : null);
+          const same = major !== null && best && majorOf(best.from) !== major ? bestRange(d.name, minor, archOn, { major }) : null;
           return { name: d.name, best, same };
         })
         .filter((b) => b.best && (b.same || b.best).range !== lastRange[b.name])
         .map((b) => {
-          lastRange[b.name] = (b.same || b.best).range;
-          return b.same ? `\`${b.name}\` ${b.same.range} (or ${b.best.range}, a major migration)` : `\`${b.name}\` ${b.best.range}`;
+          const chosen = b.same || b.best;
+          const forcedMajor = !b.same && lastMajor[b.name] !== undefined && majorOf(chosen.from) !== lastMajor[b.name];
+          lastRange[b.name] = chosen.range;
+          lastMajor[b.name] = majorOf(chosen.from);
+          if (b.same) return `\`${b.name}\` ${b.same.range} (or ${b.best.range}, a major migration)`;
+          return `\`${b.name}\` ${b.best.range}${forcedMajor ? ' (a major migration: read its migration guide first)' : ''}`;
         });
       const step = `${from} → ${to}: apply the diff from ${UPGRADE_HELPER_URL(from, to)}${bumps.length ? `, move ${bumps.join(' and ')}` : ''}, reinstall pods, build both platforms, commit.`;
       from = to;
@@ -425,6 +481,18 @@ export function buildPlan(result) {
     phases.push({ title: `Upgrade Expo SDK ${expo.from} → ${expo.to}`, why: 'Expo only supports one SDK step at a time reliably.', steps });
   }
 
+  if (jsAbandoned.length) {
+    phases.push({
+      title: 'Plan replacements for abandoned JavaScript packages',
+      why: 'These do not block the upgrade (no native code), but nobody fixes their bugs any more. Replace them when you next touch that code.',
+      steps: jsAbandoned.map((d) => {
+        const owned = d.alternatives.find((a) => installed.has(a));
+        if (owned) return `\`${d.name}\`: you already use \`${owned}\`; move the remaining usage there, then \`${pm.remove} ${d.name}\`.`;
+        return `\`${d.name}\`${d.alternatives.length ? `: options ${d.alternatives.map((a) => `\`${a}\``).join(', ')}` : ': look for a maintained alternative, or keep it if it does what you need'}.`;
+      }),
+    });
+  }
+
   const jsBumps = byKind('bump-dep').filter((d) => !d.native && !movesWithExpo(d.name));
   if (jsBumps.length) {
     phases.push({
@@ -455,7 +523,9 @@ export function buildPlan(result) {
     title: 'Verify before you ship',
     why: 'An upgrade is done when the release build works on real devices, not when it compiles.',
     steps: [
-      'Release builds on both platforms (`./gradlew bundleRelease`, Xcode Archive).',
+      result.project.managed
+        ? 'Production builds on both platforms (`eas build --platform all --profile production`, or `npx expo run:android --variant release` and `npx expo run:ios --configuration Release`).'
+        : 'Release builds on both platforms (`./gradlew bundleRelease`, Xcode Archive).',
       'Test on a low-end Android device and on the newest iOS and Android versions.',
       'Ship to internal testing / TestFlight first and watch crash-free sessions for a few days before a staged rollout.',
       'Run `npx nativekeel` again: the report should have no critical or high findings.',

package/src/report-html.js

@@ -12,13 +12,22 @@ export function htmlReport(result, { brand = null, plan = null } = {}) {
   const n = countBySeverity(result.findings);
   const title = `${p.name || 'App'} health report`;
   const sevLabel = { critical: 'Critical', high: 'High', medium: 'Medium', low: 'Low', info: 'Info' };
-  const arch = (v) => (v === true ? 'on' : v === false ? 'off' : 'default');
+  const defaultOn = !!result.project.reactNative && Number(result.project.reactNative.split('.')[1]) >= 76;
+  const arch = (v) => (v === true ? 'on' : v === false ? 'off' : defaultOn ? 'on (default)' : 'off (default)');
 
+  // Outdated packages are many and alike: one collapsible table instead of a card each.
+  const isBump = (f) => f.id.startsWith('dep-major:');
   const rows = SEVERITIES.flatMap((sev) =>
     result.findings
-      .filter((f) => f.severity === sev)
+      .filter((f) => f.severity === sev && !isBump(f))
       .map((f) => `<li class="f ${sev}"><span class="tag">${sevLabel[sev]}</span><div><strong>${rich(f.title)}</strong><p>${rich(f.detail)}</p></div></li>`),
   ).join('\n');
+  const bumps = result.findings.filter(isBump);
+  const bumpTable = bumps.length
+    ? `<details class="bumps"><summary>${bumps.length} package${bumps.length === 1 ? ' is' : 's are'} a major version behind <span class="muted">(low)</span></summary><table><thead><tr><th>Package</th><th>Installed</th><th>Latest</th><th></th></tr></thead><tbody>${bumps
+        .map((f) => `<tr><td>${esc(f.fix.name)}</td><td>${esc(f.fix.from || '')}</td><td>${esc(f.fix.to || '')}</td><td class="muted">${f.fix.native ? 'native' : ''}</td></tr>`)
+        .join('')}</tbody></table></details>`
+    : '';
 
   const planHtml = plan
     ? `<section><h2>Upgrade plan <small>scope: ${esc(plan.complexity.size)}</small></h2>${plan.phases
@@ -49,6 +58,7 @@ h1{font-size:26px;margin:0 0 4px}h2{font-size:19px;margin:32px 0 12px}h2 small{f
 .stat.critical b{color:var(--critical)}.stat.high b{color:var(--high)}
 .facts{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 16px;margin-top:12px;display:flex;flex-wrap:wrap;gap:6px 24px;font-size:14px}
 ul.list{list-style:none;padding:0;margin:0;display:grid;gap:8px}
+details.bumps{margin-top:8px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}details.bumps summary{cursor:pointer;font-weight:600}details.bumps table{width:100%;border-collapse:collapse;margin-top:10px;font-size:14px}details.bumps th,details.bumps td{text-align:left;padding:4px 8px;border-top:1px solid var(--line)}.muted{color:var(--muted);font-weight:400}
 .f{display:flex;gap:12px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}
 .f p{margin:2px 0 0;color:var(--muted);font-size:14px}.f strong{overflow-wrap:anywhere}
 .tag{flex:none;font-size:12px;font-weight:600;text-transform:uppercase;letter-spacing:.03em;min-width:64px;padding-top:2px}
@@ -79,7 +89,7 @@ ${p.android && p.android.targetSdk ? `<span>targetSdk <b>${p.android.targetSdk}<
 <span>${result.deps.length} dependencies (${result.deps.filter((d) => d.native).length} native)</span>
 </div>
 <h2>Findings</h2>
-${result.findings.length ? `<ul class="list">${rows}</ul>` : '<p>No issues found.</p>'}
+${result.findings.length ? `${rows ? `<ul class="list">${rows}</ul>` : ''}${bumpTable}` : '<p>No issues found.</p>'}
 ${planHtml}
 <footer>${footer}</footer>
 </main></body></html>

package/src/report-md.js

@@ -14,7 +14,7 @@ export function markdownReport(result, { verbose = false } = {}) {
     [
       p.reactNative && `React Native **${p.reactNative}**${result.latest.reactNative ? ` (latest ${result.latest.reactNative})` : ''}`,
       p.expo && `Expo SDK **${p.expo.split('.')[0]}**`,
-      `New Architecture: Android ${p.newArch.android === false ? '**off**' : p.newArch.android ? 'on' : 'default'}, iOS ${p.newArch.ios === false ? '**off**' : p.newArch.ios ? 'on' : 'default'}`,
+      `New Architecture: Android ${archMd(p, p.newArch.android)}, iOS ${archMd(p, p.newArch.ios)}`,
     ].filter(Boolean).join(' · '),
     '',
     `${ICON.critical} ${n.critical} critical · ${ICON.high} ${n.high} high · ${ICON.medium} ${n.medium} medium · ${ICON.low} ${n.low} low`,
@@ -40,3 +40,10 @@ export function markdownReport(result, { verbose = false } = {}) {
   lines.push(`<sub>Generated by [NativeKeel](${SITE_URL}) · \`npx nativekeel plan\` for a step-by-step upgrade plan</sub>`);
   return `${lines.join('\n')}\n`;
 }
+
+// Not set means React Native's default: off before 0.76, on from 0.76.
+function archMd(p, v) {
+  if (v === false) return '**off**';
+  if (v === true) return 'on';
+  return p.reactNative && Number(p.reactNative.split('.')[1]) >= 76 ? 'on (default)' : '**off** (default)';
+}

package/src/report-sarif.js

@@ -49,7 +49,7 @@ export function sarifReport(result, { version = '0.0.0' } = {}) {
             ruleId: f.id.split(':')[0],
             level: LEVEL[f.severity],
             message: { text: `${f.title}. ${f.detail}` },
-            locations: [{ physicalLocation: { artifactLocation: { uri: loc.uri }, region: { startLine: loc.line } } }],
+            locations: [{ physicalLocation: { artifactLocation: { uri: toUri(loc.uri) }, region: { startLine: loc.line } } }],
             // Stable across runs so code scanning tracks one alert per finding.
             partialFingerprints: { nativekeelId: f.id },
             properties: { severity: f.severity, area: f.area },
@@ -59,3 +59,8 @@ export function sarifReport(result, { version = '0.0.0' } = {}) {
     ],
   };
 }
+
+// SARIF artifact locations are URIs: encode each path segment (spaces, #, %), keep the slashes.
+function toUri(file) {
+  return file.split(/[\\/]/).map(encodeURIComponent).join('/');
+}

package/src/report-text.js

@@ -14,7 +14,9 @@ export function textReport(result, { color = true, verbose = false } = {}) {
   const indent = '           ';
   const out = [];
   const p = result.project;
-  const arch = (v) => (v === true ? c.green('on') : v === false ? c.red('off') : c.gray('default'));
+  // Not set means React Native's default: off before 0.76, on from 0.76.
+  const defaultOn = !!p.reactNative && Number(p.reactNative.split('.')[1]) >= 76;
+  const arch = (v) => (v === true ? c.green('on') : v === false ? c.red('off') : defaultOn ? c.gray('on (default)') : c.red('off (default)'));
 
   out.push('');
   out.push(`${c.bold('NativeKeel health report')}  ${p.name || ''}`);

package/src/rules.js

@@ -53,6 +53,38 @@ export const REPLACEMENTS = {
   'react-native-code-push': ['expo-updates'],
   // react-native-elements was renamed to @rneui, which in turn is continued by @rn-vui.
   'react-native-elements': ['@rn-vui/themed'],
+  // Checked on npm and React Native Directory on 2026-10-04 (published and not flagged unmaintained).
+  'rn-fetch-blob': ['react-native-blob-util'],
+  '@react-native-community/blur': ['expo-blur'],
+  'react-native-randombytes': ['react-native-get-random-values', 'expo-crypto'],
+  'react-native-securerandom': ['react-native-get-random-values', 'expo-crypto'],
+  'react-native-tcp': ['react-native-tcp-socket'],
+  '@react-native-community/geolocation': ['expo-location'],
+  'react-native-geolocation-service': ['expo-location'],
+  'react-native-encrypted-storage': ['react-native-keychain', 'expo-secure-store'],
+  'react-native-navigation-bar-color': ['react-native-edge-to-edge', 'expo-navigation-bar'],
+  'react-native-quick-actions': ['expo-quick-actions'],
+  'react-native-version-number': ['react-native-device-info', 'expo-application'],
+  'react-native-mail': ['expo-mail-composer'],
+  'react-native-rate': ['expo-store-review'],
+  'react-native-print': ['expo-print'],
+  'react-native-i18n': ['react-native-localize', 'expo-localization'],
+  'expo-av': ['expo-audio', 'expo-video'],
+  'react-native-snap-carousel': ['react-native-reanimated-carousel'],
+  'react-native-iphone-x-helper': ['react-native-safe-area-context'],
+  'react-native-slider': ['@react-native-community/slider'],
+  'react-native-datepicker': ['@react-native-community/datetimepicker'],
+};
+
+// Packages that moved to a new name with the same API: swap the package, update the imports.
+export const RENAMED = {
+  '@react-native-community/async-storage': '@react-native-async-storage/async-storage',
+  '@react-native-community/cameraroll': '@react-native-camera-roll/camera-roll',
+  '@react-native-community/masked-view': '@react-native-masked-view/masked-view',
+  '@react-native-community/viewpager': 'react-native-pager-view',
+  '@react-native-community/picker': '@react-native-picker/picker',
+  '@react-native-community/clipboard': '@react-native-clipboard/clipboard',
+  'react-native-netinfo': '@react-native-community/netinfo',
 };
 
 export const UPGRADE_HELPER_URL = (from, to) =>

package/src/usage.js

@@ -26,6 +26,10 @@ const IMPLICIT = [
   /^react-native-webp-format$/, // iOS WebP decoder registers itself with the image loader
   /^@react-native-firebase\/(crashlytics|perf)$/, // collect natively without any JS call
   /^react-compiler-runtime$/, // imported by babel-plugin-react-compiler output
+  /^@react-native-vector-icons\//, // per-font packages: fonts linked by the build
+  /^(hermes-engine|postinstall-postinstall|react-native-web)$/, // engine, install hook, web target
+  // Named after Node.js core modules: dependencies require('stream'), Metro resolves the package.
+  /^(assert|buffer|constants|crypto|events|os|path|process|punycode|querystring|stream|string_decoder|timers|tty|url|util|vm|zlib)$/,
 ];
 
 function walk(dir, exts, out = []) {
@@ -102,6 +106,9 @@ export function findUnused(project) {
   const configText = [
     JSON.stringify(pkgJson.scripts || {}),
     JSON.stringify(pkgJson.jest || {}),
+    // rn-nodeify style aliases: { "react-native": { "crypto": "react-native-crypto" } }
+    JSON.stringify(pkgJson['react-native'] || {}),
+    JSON.stringify(pkgJson.browser || {}),
     readSmall(path.join(root, 'app.json')),
     readSmall(path.join(root, 'app.config.js')),
     readSmall(path.join(root, 'app.config.ts')),
@@ -137,7 +144,18 @@ export function findUnused(project) {
     }
   }
 
-  const candidates = names.filter((n) => !used.has(n) && !requiredByOthers.has(n) && !configText.includes(n) && !usedByBin(n));
+  // A package someone patched (patch-package) is one they care about: never call it unused.
+  const patched = new Set();
+  try {
+    for (const f of fs.readdirSync(path.join(root, 'patches'))) {
+      const m = f.match(/^(@[^+]+\+[^+]+|[^+@][^+]*)\+/);
+      if (m) patched.add(m[1].replace('+', '/'));
+    }
+  } catch {
+    // no patches folder
+  }
+
+  const candidates = names.filter((n) => !used.has(n) && !requiredByOthers.has(n) && !configText.includes(n) && !usedByBin(n) && !patched.has(n));
   if (!candidates.length) return [];
 
   const nativeText = ['ios', 'android'].flatMap((d) => walk(path.join(root, d), NATIVE_EXT)).map(readSmall).join('\n');