# Risk map — react/react-native

> Canonical page: https://codevetter.com/unpack/react-native/risk-map

# Risk map — react/react-native

Scanned commit b7c0e4986a0242cdd47afd002f3e712e80914c3c (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Dominant risk is the long-running architecture migration: legacy bridge (ReactNativeHost/ReactInstanceManager, BatchedBridge/MessageQueue, runtime codegenNativeComponent fallback) coexists with bridgeless ReactHost + TurboModule proxy, so behavior diverges by mode. Generated-code drift is a second axis — feature flags, TS types, codegen output, and three committed API snapshots all fail CI if not regenerated. The dev-middleware WebSocket inspector endpoints are a security-sensitive surface when the dev server is exposed beyond localhost. Several foot-guns exist for tooling: preinstall mutates yarn.lock, Jest resolution diverges from Metro, and cli.js silently tolerates a missing community CLI.
- Legacy/new architecture split: ReactNativeHost is @Deprecated and logs LegacyArchitectureLogLevel.ERROR; ReactActivityDelegate.getReactNativeHost() is deprecated in favor of ReactHost; code paths still branch on global.RN$Bridgeless (e.g. codegenNativeComponent warns that runtime fallback 'will be an error in the future'). — [packages/react-native/ReactAndroid/src/main/java/com/facebook/react/ReactNativeHost.kt#L34-39](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/ReactNativeHost.kt#L34-L39) [packages/react-native/ReactAndroid/src/main/java/com/facebook/react/ReactActivityDelegate.java#L87-100](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/ReactActivityDelegate.java#L87-L100) [packages/react-native/Libraries/Utilities/codegenNativeComponent.js#L42-46](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/Libraries/Utilities/codegenNativeComponent.js#L42-L46)
- Runtime/type surface drift: index.js header warns 'Keep this file in sync with index.js.flow' — the runtime getters (incl. the untyped 'Touchable' re-export kept for a react-native-svg call site) can diverge from the declared public API, only caught by generated-types tests. — [packages/react-native/index.js#L19-25](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/index.js#L19-L25) [packages/react-native/index.js#L415-429](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/index.js#L415-L429) [packages/react-native/index.js.flow](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/index.js.flow)
- Dev-middleware attack surface: InspectorProxy opens unauthenticated WebSocket endpoints '/inspector/device' and '/inspector/debug' proxying full CDP control of connected apps, plus '/open-debugger' which launches local applications via the tool launcher; `start --host`/`--https`/`--cert`/`--key` options determine exposure — dangerous if bound to a non-localhost interface. — [packages/dev-middleware/src/inspector-proxy/InspectorProxy.js#L42-43](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/dev-middleware/src/inspector-proxy/InspectorProxy.js#L42-L43) [packages/dev-middleware/src/inspector-proxy/InspectorProxy.js#L233-253](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/dev-middleware/src/inspector-proxy/InspectorProxy.js#L233-L253) [packages/dev-middleware/src/createDevMiddleware.js#L115-140](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/dev-middleware/src/createDevMiddleware.js#L115-L140) [packages/community-cli-plugin/src/commands/start.js#L74-86](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/community-cli-plugin/src/commands/start.js#L74-L86)
- Dynamic resolution fragility: cli.js and react-native.config.js use require.resolve(..., {paths: [process.cwd()]}) for @react-native-community/* packages — correct under pnpm/isolated layouts but silently degrades (empty config, exit(1) with a warning) when the community CLI isn't installed; a module-scope try/catch swallows the missing dependency when cli.js is imported rather than executed. — [packages/react-native/cli.js#L24-40](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/cli.js#L24-L40) [packages/react-native/cli.js#L79-91](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/cli.js#L79-L91) [packages/react-native/react-native.config.js#L24-70](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/react-native.config.js#L24-L70)
- preinstall side effect: `yarn install` runs scripts/try-set-hermes-compiler-prebuilt.js which rewrites the hermes-compiler placeholder ('0.0.0') in packages/react-native/package.json and dirties yarn.lock — documented as expected, but it will pollute diffs and confuse automated installs. — [package.json#L35](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/package.json#L35) [scripts/try-set-hermes-compiler-prebuilt.js](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/scripts/try-set-hermes-compiler-prebuilt.js) [packages/react-native/package.json#L165](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/package.json#L165) [AGENTS.md](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/AGENTS.md)
- Generated-artifact drift is CI-enforced: codegen output, feature-flag accessors (yarn featureflags), types_generated + ReactNativeApi.d.ts (yarn build-types), scripts/cxx-api/api-snapshots (yarn cxx-api-build/--validate), and ReactAndroid/api/ReactAndroid.api are all regenerated-or-fail; hand-edits get reverted by CI validation. — [AGENTS.md](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/AGENTS.md) [packages/react-native-codegen/src/generators/RNCodegen.js#L215-238](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native-codegen/src/generators/RNCodegen.js#L215-L238) [packages/react-native/ReactNativeApi.d.ts](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/ReactNativeApi.d.ts) [packages/react-native/ReactAndroid/api/ReactAndroid.api](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/ReactAndroid/api/ReactAndroid.api) [scripts/cxx-api/api-snapshots](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/scripts/cxx-api/api-snapshots) [.github/workflows/validate-cxx-api-snapshots.yml](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/.github/workflows/validate-cxx-api-snapshots.yml)
- Metro bundling hard-depends on a one-time codegen build: without `yarn --cwd packages/react-native-codegen build`, bundling fails with 'Cannot find module @react-native/codegen/lib/parsers/flow/parser' — a documented bootstrap trap for fresh clones. — [AGENTS.md](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/AGENTS.md) [packages/react-native-codegen/src/parsers/flow/parser.js](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native-codegen/src/parsers/flow/parser.js)
- Jest fidelity gap: the custom resolver strips `exports` and moduleNameMapper hardcodes subpath aliases, so unit tests exercise a different module-resolution graph than Metro/Node — code relying on export conditions (e.g. types_generated, react-native-legacy-deep-imports) is untested by Jest. (inferred) — [jest.config.js#L24-38](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/jest.config.js#L24-L38) [packages/react-native/package.json#L30-63](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/package.json#L30-L63)
- DEV-only behavior divergence: LogBox.install, checkNativeVersion, setUpReactDevTools, InteractionManager-throwing getter, warnOnce deprecation banners, and the RN$Bridgeless codegen warning only run under __DEV__, so prod bundles take meaningfully different code paths (incl. AppContainer-dev vs AppContainer-prod and ReactFabric-dev/-prod/-profiling variants). — [packages/react-native/src/private/setup/setUpDefaultReactNativeEnvironment.js#L27-41](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/src/private/setup/setUpDefaultReactNativeEnvironment.js#L27-L41) [packages/react-native/index.js#L431-447](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/index.js#L431-L447) [packages/react-native/Libraries/ReactNative/AppContainer-dev.js](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/Libraries/ReactNative/AppContainer-dev.js) [packages/react-native/Libraries/Renderer/implementations/ReactFabric-prod.js](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/Libraries/Renderer/implementations/ReactFabric-prod.js)
- Ecosystem-coupled deprecations: exports for Clipboard, PushNotificationIOS, SafeAreaView, ProgressBarAndroid, DrawerLayoutAndroid, ImageBackground, UTFSequence remain (warnOnce) alongside legacy deep imports './Libraries/*' — removal is a breaking change deferred across releases; InteractionManager already throws in DEV. — [packages/react-native/index.js#L41-133](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/index.js#L41-L133) [packages/react-native/index.js#L243-338](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/index.js#L243-L338) [packages/react-native/package.json#L36-44](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/package.json#L36-L44) [packages/react-native/index.js#L431-447](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/packages/react-native/index.js#L431-L447)
- Fantom operational limits: debugging (FANTOM_DEBUG_JS/FANTOM_DEBUG_CPP) is Meta-internal only; FANTOM_PROFILE_CPP needs perf and is banned on CI; runTask() cannot be nested (throws); only a subset of the Jest global API is implemented (no test.each) — contributors must work within these limits or file gaps. — [private/react-native-fantom/__docs__/README.md#L276-283](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/private/react-native-fantom/__docs__/README.md#L276-L283) [private/react-native-fantom/__docs__/README.md#L369-396](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/private/react-native-fantom/__docs__/README.md#L369-L396) [private/react-native-fantom/__docs__/README.md#L479-493](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/private/react-native-fantom/__docs__/README.md#L479-L493)
- Large monorepo coupling: the scanned tree is ~3998 files with the file walk capped (1008 skipped); a single change can trigger lint -> build_fantom_runner -> run_fantom_tests (x3 retries) -> build_android -> e2e -> maestro -> build_npm_package chains in test-all.yml, so blast radius of even small changes is expensive CI-wise. (inferred) — [.github/workflows/test-all.yml#L295-414](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/.github/workflows/test-all.yml#L295-L414) [.github/workflows/test-all.yml#L39-90](https://github.com/react/react-native/blob/b7c0e4986a0242cdd47afd002f3e712e80914c3c/.github/workflows/test-all.yml#L39-L90)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)