react_native_dependencies

Locked JavaScript dependencies for React Native.

Description

Reads package.json, one supported lockfile, and an optional normalized module snapshot during graph loading. The resolver records exact React Native and Hermes versions, emits one react_native_module target per snapshotted native package, and runs a frozen package-manager install as a cacheable action.

Package manager	Lockfile	Frozen install
npm	package-lock.json	npm ci
pnpm	pnpm-lock.yaml	pnpm install --frozen-lockfile
Yarn	yarn.lock	--frozen-lockfile for Yarn 1, --immutable for modern Yarn
Bun	bun.lock	bun install --frozen-lockfile

Set package_manager explicitly or leave it as auto. Automatic selection uses an explicit lockfile path first, then package.json's packageManager field, then the only supported lockfile supplied to the resolver.

Modern Yarn installs with its node-modules linker. pnpm public-hoists only @react-native/*, which makes the React Native Gradle plugin available at the conventional path expected by checked-in Android projects. Bun uses its hoisted linker.

The installed dependency tree is the shared input for Metro, Codegen, autolinking, and native application targets.

Include repository-local file: packages in srcs. Once stages those files beside the package manifest before installation, so the selected manager creates valid local links and changes to those packages invalidate the dependency action.

Use package_manager_files for text configuration such as .npmrc or .yarnrc.yml. Each file must also be present in resolver_inputs. Configuration must not contain authentication tokens or passwords because declared inputs may be uploaded to a shared cache. Include binary manager files such as an offline package archive in srcs, not resolver_inputs.

Attributes

Attribute	Type	Required	Default	Description
package_json	string	no	package.json	JavaScript package manifest
package_manager	string	no	auto	auto, npm, pnpm, yarn, or bun
package_manager_executable	string	no		Package manager executable override
lockfile	string	no		Lockfile path, detected when omitted
npmrc	string	no		Optional npm configuration without credentials
package_manager_files	list<string>	no	[]	Additional text configuration without credentials
modules_snapshot	string	no		Normalized native-module snapshot
resolver_inputs	list<string>	no	[]	Text inputs available to the resolver
node	string	no	node	Node.js executable
allow_network	bool	no	false	Permit package downloads missing from the local cache
install_args	list<string>	no	[]	Additional frozen-install arguments

Underscore-prefixed attributes are resolver-owned and must not be set by a package manifest.

Providers and capabilities

The target emits javascript_dependency_set and react_native_dependency_set. Its build capability exposes node_modules.

Package lifecycle scripts run during installation. allow_network = false uses each manager's offline mode and cache, but it does not sandbox direct network or filesystem access by lifecycle scripts. Bun currently offers a prefer-offline mode rather than a strict offline install, so a cache miss may still reach the registry.

This target models one application package and does not synthesize package manager workspaces. Switching package managers can also change native podspec checksums, so regenerate and check in Podfile.lock after a switch.

Example

[[target]]
name = "Dependencies"
kind = "react_native_dependencies"
srcs = [
  "package.json",
  "pnpm-lock.yaml",
  "react-native-modules.json",
  "packages/native-camera/**/*",
]

[target.attrs]
package_manager = "pnpm"
lockfile = "pnpm-lock.yaml"
modules_snapshot = "react-native-modules.json"
resolver_inputs = ["package.json", "pnpm-lock.yaml", "react-native-modules.json"]