Hidden Dependency Detection Report
Summary
3 findings: 0 critical, 2 high, 1 medium, 0 low
Polarities: 2 risks, 0 strengths, 0 opportunities, 1 observation
3 paths traced, 1 suggestion
Findings
1. The Tiny Package on Everyone's Hot Path (risk · high · confidence: verified)
Element: scheduler
File: packages/scheduler
4 direct dependents (react-dom, react-art, react-native-renderer) plus every reconciliation cycle — high fan-in for a single-purpose utility.
Measurement: 4 direct dependents
Recommendation: Pin scheduler to one internal version; add cross-renderer scheduling regression tests.
2. Unpublished Kernel With ~125 Import Sites (risk · high · confidence: verified)
Element: shared
File: packages/shared
published:false yet ~125 import sites in the reconciler alone, plus react-dom-bindings and server-components.
Measurement: 125 import sites (trend stable)
Recommendation: Treat shared as a versioned internal contract; lint against deep imports.
3. React Is the Universal Peer Hub (observation · medium · confidence: verified)
Element: react
File: packages/react
Seven packages peer-depend on react. Expected for the core API, but the most change-sensitive surface on the board.
Measurement: 7 inbound dependents
Paths
Everything Schedules Through One Package (risk · high)
react-dom → scheduler (branches: react-art, react-native-renderer, react-reconciler)
The Unpublished Kernel Under the Renderers (risk · high)
react-dom-bindings → shared (branches: react-reconciler, server-components)
React: the Universal Peer-Dependency Hub (observation · medium)
use-subscription → use-sync-external-store → react (branches: react-cache, react-refresh, devtools, server-components, build-tooling)
Suggestions
- modify node — Promote shared to a documented internal contract to make the hidden coupling explicit.